Privacy Policy
This policy explains how WhipWhiplash collects, uses, and shares your personal data, in line with Thailand’s Personal Data Protection Act B.E. 2562 (PDPA).
1.Data controller
2.What we collect
- Account data: your display name, email (if the sign-in provider shares it), profile picture, and sign-in method, received when you sign up or sign in with email/password or Google.
- Card content: the card title, messages, recipient and sender names, dates, photos, videos, theme, and font you choose.
- Order data: the template, amount, payment method, status, time, a transaction ID from our payment provider, and a receipt email if you entered one.
- TrueMoney Wallet number: passed to our payment provider to take the payment. We do not store it.
- Technical data: cookies that keep you signed in and remember your language, how many times a card was opened (not who opened it), and server access logs such as IP address and browser type.
We never receive or store your bank account number, card details, or passwords.
3.How we use it
- To make, save, show, and publish your cards as you ask (performance of a contract)
- To take payments and keep accounting and tax records (performance of a contract and legal obligation)
- To prevent fraud and misuse and keep the service secure (legitimate interest)
- To answer your questions and requests
We do not sell your data, use it for advertising, or use third-party advertising or tracking cookies.
4.Who can see your cards
Only you can see a draft.
Anyone with the link or QR code can open a published card without signing in, until it expires. We do not list cards anywhere, but if a link is posted publicly, search engines may find it, so leave out anything you do not want others to see.
5.Other people in your cards
If you put a recipient’s or anyone else’s name, photo, or details in a card, you must have the right or their consent to do so. If that person asks us to remove it, we may disable the card.
6.Service providers
- Our database provider: database, sign-in, and photo and video storage, with servers in Singapore
- Our payment provider: PromptPay and TrueMoney Wallet payments
- Google: confirming your identity when you sign in with Google
- Our website host: carrying data between your browser and our servers
These providers use the data only to provide their services to us. Some data is therefore stored outside Thailand, for example in Singapore, and we choose providers with adequate data protection standards.
We may disclose data when the law or an order from a government authority requires it.
7.How long we keep it
- Drafts: until you delete them
- Published cards and account data: while your account exists, or until you ask us to delete them
- Order records: for as long as accounting and tax law requires, even after an account is deleted
8.Your rights
Under the PDPA you have the right to:
- Access your data and get a copy of it
- Correct data that is wrong
- Have your data or account deleted
- Restrict or object to how we use your data
- Receive your data to move it to another service
- Withdraw consent you gave earlier
- Complain to the Personal Data Protection Committee
You can delete drafts yourself on the My cards page. For anything else, message us through the channels below and we will reply within 30 days.
9.Security
All data travels over encrypted HTTPS, and access controls let each account reach only its own cards and orders.
10.Minors
This service is not designed for children under 10. Users under 20 should have a parent’s or guardian’s permission before paying.
11.Changes to this policy
We may update this policy. If we make a significant change, we will announce it on the site.