1. Data controller and contact
FactoryStudio operates FactoryStudio Code Catalog (“we”, “us”) in Thailand. For this service we are the data controller.
Privacy, access, correction, and deletion requests: hello@factorystudio.pro. You may also submit a deletion request from My Account → Profile after sign-in.
We do not publish a company registration number on this website. If a legal entity record is issued, this section will be updated before it is displayed.
2. Personal data we collect
Identity data from the sign-in provider (currently Google via Supabase Auth): name, email address, and a unique account identifier.
Account data we create: member role, last seen time, product access grants, and optional expiry dates.
Legal records: timestamps for acceptance of the Terms of Service, Product Purchase Terms, and Privacy Policy; whether marketing messages were consented to; policy version; and deletion requests.
Usage data needed to run downloads: product and file identifiers, version, time of authorized download, and security events such as blocked or rate-limited requests.
Device preference: the selected Thai or English language stored in the fs_locale preference cookie and localStorage on your browser. This is not used for advertising.
We collect payment records for bank-transfer checkout: product identifier, amount copied from the server catalog (not from the browser), payer name, transfer reference, slip image stored privately in Cloudflare R2, review status, and timestamps.
We do not ask for unused registration fields such as a separate work email or company name on the public register screen.
3. Purposes and lawful bases (PDPA)
Contract / requested service: creating your account, assigning product access, delivering downloads, and showing your member workspace.
Consent: marketing emails or similar promotional contact, only if you tick the separate marketing box. That box is never pre-selected.
Legitimate interests and legal duty: security, abuse prevention, rate limiting, recording legal acceptance, and responding to lawful requests.
We do not sell personal data.
4. Retention periods
Account identity and role: for the life of the account, then up to 24 months after closure or completed deletion, unless a longer period is required by law.
Legal acceptance and marketing-consent records: for the life of the account plus 24 months (to show what was agreed).
Payment and slip records: at least 24 months after the purchase transaction is completed, and longer if Thai tax or accounting law requires it.
Security and rate-limit records: up to 12 months.
Deletion requests: until the request is completed, then 24 months as proof of the request.
Language preference stays on your device until you clear site data or change the language again.
When a period ends we delete or irreversibly anonymise the data, except where we must keep a minimal record to establish, exercise, or defend legal claims.
5. Disclosure and processors
Google: sign-in identity, if you choose Continue with Google.
Vercel hosts the application, Supabase provides authentication and PostgreSQL storage, and Cloudflare provides private R2 file storage, DNS, and optional security/CDN services. Processing may occur outside Thailand under each provider’s terms.
We will name any future payment or email provider in this policy before that provider receives personal data.
We disclose data if required by Thai or other applicable law, or to professional advisers bound to confidentiality.
6. Your rights under PDPA
You may request: access to your personal data; a copy in a commonly used electronic format (data portability, where technically feasible); correction of inaccurate data; erasure; restriction of processing; objection to processing based on legitimate interests; and withdrawal of consent (for marketing, without affecting downloads you already received).
You may lodge a complaint with the Office of the Personal Data Protection Commission (PDPC) of Thailand if you believe we have not handled your data lawfully.
To exercise rights, email hello@factorystudio.pro from the address on your account, or use My Account → Profile. We may need to verify your identity. We aim to respond within 30 days.
7. Account and data deletion process
Signed-in members can press Request account deletion on the Profile page. You may also email hello@factorystudio.pro with the subject “Data deletion request”.
We log the request time, freeze marketing, and then delete or anonymise account identity, consents, product grants, and download history associated with the account, within 30 days, except records we must keep as described in Retention.
Source files already stored on your own computers are not deleted remotely. Continued use of those copies remains governed by the Software License.
8. Cookies and similar storage
See the Cookie Policy. We currently use essential authentication cookies and a language preference in localStorage. We do not use Google Analytics, Meta Pixel, or advertising cookies. A consent banner will be added only if non-essential tracking is introduced.
9. Children
The catalog is intended for adult professionals and organisational use. We do not knowingly create accounts for children under 20 years of age (Thai majority). Contact us if you believe we hold such data.
10. Updates
The effective date at the top of this policy is the current version identifier. Material changes will be posted here. Where PDPA requires fresh consent, we will ask you to accept the new version before using member features.