Privacy policy

This policy explains how the company that operates Wanrak ("we") handles personal data of people who visit this website and of organizers, planners and team members who use the studio. It is written for the laws of Thailand (PDPA), the European Union and the United Kingdom (GDPR and UK GDPR), California (CCPA) and other US states.

Guests of an event are covered by the guest privacy notice: for their data, the event's host decides and we only process it for the host.

Who is responsible

We are the controller of the data described in this policy. You can reach us, and our data protection contact, through the contact page. If the law requires us to appoint a representative in the European Union or the United Kingdom, or a data protection officer, we will name them here.

What we collect

• Account: your email address, your name if you add it, language, time zone, sign-in records and two-step sign-in settings.
• Workspaces and events: the workspaces, events, sites, settings and teams you create, and your role in them. Guest data you add is handled as described in the data processing agreement.
• Your messages to us: what you send through the contact form or by email.
• Billing (once paid plans launch): your plan, invoices and billing address. Card details go directly to the payment provider; we never see them.
• Technical data: what the service needs to run and stay safe, such as your IP address (stored only as a one-way hash, for rate limits and security records), device and browser type, and error reports. Our logs and error reports are filtered so they never hold names, contact details, invitation codes or tokens.
• Cookies: essential cookies only, unless you allow analytics. See the cookie policy.

We do not knowingly collect data from children under 13 (or the higher age set by your country). Organizer accounts are for adults only.

Why we use it, and our legal bases

• To provide Wanrak (create your account, run your events, sign you in, send service emails): performance of our contract with you.
• To keep Wanrak secure and prevent abuse (rate limits, audit records, fraud and abuse checks, reviewing reports): our legitimate interest in a safe service, and our legal obligations.
• To support you and improve the service (answer messages, fix errors, understand which features are used, in aggregate): our legitimate interest.
• Analytics on this website and in the studio: only with your consent, which you can withdraw at any time.
• To comply with the law (tax records, answering lawful requests from authorities): legal obligation.
• News about Wanrak: only if you ask for it, and you can unsubscribe at any time.

Where we rely on legitimate interests, you can object (see your rights below). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Who we share it with

We share personal data only with:

• Service providers that run Wanrak for us under contract and only on our instructions: Supabase (database, sign-in and file storage, in Singapore), Vercel (hosting; servers in Singapore and a global network), Resend (email delivery), Sentry (error monitoring, filtered as described above), Amazon Web Services (automatic image checks in Singapore, when turned on) and, once paid plans launch, Stripe (payments). We give notice before adding or replacing a provider that handles guest data, as the data processing agreement describes.
• Your team: people you invite to a workspace or event see your name and role.
• Authorities and others where the law requires it, or to protect the rights, safety and property of our users, the public or us.
• A buyer or successor, if Wanrak is sold or merged, under the same protections.

We do not sell personal data and we do not share it for cross-context behavioral advertising, as those terms are used in California law, and we have not done so in the past 12 months. We use sensitive personal information only to provide the service.

International transfers

Our main servers are in Singapore, and some providers work in the United States and other countries. When data from the European Economic Area, the United Kingdom or Thailand goes to a country without an adequacy decision, we use the safeguards the law accepts, such as the European Commission's standard contractual clauses, the UK addendum to them, or a provider's certification under the EU-US Data Privacy Framework and its UK extension. You can ask us for a copy of the safeguards through the contact page.

How long we keep it

• Account data: until you delete your account. Deleting it removes your name, memberships and empty drafts at once and blocks the account; 30 days later the account, its sign-in email included, is erased for good.
• A deleted event: can be restored for 30 days, then deleted for good, files included.
• Messages through the contact form: 12 months.
• Audit and security records: kept for security without contact details, for as long as needed to protect the service.
• Billing records: as long as tax law requires.
• Backups: copies of the database are kept for up to 7 days, so deleted data disappears from backups within that time. We restore backups only to recover from a disaster.

Your rights

Depending on where you live, you may have the right to:

• know what personal data we hold about you and get a copy, in a portable format;
• correct it;
• delete it;
• object to or restrict some uses, including use based on legitimate interests and direct marketing;
• withdraw consent at any time, without affecting what was done before;
• opt out of the sale or sharing of personal data and of targeted advertising (we do neither);
• not be treated differently for using these rights;
• appeal our answer to a request, where your state law provides an appeal.

You can see, change, download and delete most of your data yourself on the studio's account page. For anything else, use the contact page. We may need to confirm your identity first. An authorized agent may ask for you where the law allows, with proof of authority. We answer within the time the law sets: 30 days under the PDPA, one month under the GDPR (extendable when requests are complex) and 45 days under US state laws (extendable once).

You may also complain to a data protection authority: in Thailand the Personal Data Protection Committee, in the EU the authority of the country where you live or work, in the UK the Information Commissioner's Office, or your state attorney general or privacy agency in the US. We would welcome the chance to address your concern first.

Security

We protect data with encryption in transit, private file storage shared only through short-lived links, strict separation between events that is tested automatically, role-based access, optional two-step sign-in and records of sensitive actions. Staff access is limited and recorded. No system is completely secure; if a breach affects you, we will tell you and the authorities as the law requires.

Changes

We may update this policy. We post the new version here with its date and tell account holders about important changes before they take effect.

Last updated: 2 November 2026.