Privacy Policy
Last updated: October 2026
1. Information We Collect
We collect personal data you provide directly when creating an account, onboarding as a creator, or purchasing music licenses. This includes your name, email address, country/locale, and billing metadata. For creators, we collect payout beneficiary details (bank account name/number or PromptPay ID) and AMLO/KYC verification documents. Payment card details are processed directly and encrypted by Stripe; we never store raw card numbers on our infrastructure.
2. Legal Bases & Purpose of Processing
Under Art. 6 GDPR and Thailand PDPA Section 24, we process personal data under the following legal bases: (a) Performance of Contract: fulfilling license purchases, generating time-limited presigned MinIO/S3 download links, and calculating creator payouts; (b) Legal Obligation: maintaining 3% Thai Withholding Tax records (Section 40(3)), generating 50 Tawi certificates, and retaining server traffic logs for 90 days under the Computer Crime Act B.E. 2560 Section 26; (c) Legitimate Interests: fraud prevention with Stripe Radar, cryptographic audio fingerprint verification, and platform security.
3. Third-Party Service Providers & Sub-Processors
We engage trusted sub-processors under strict Data Processing Agreements (DPAs): Better Auth (session management), Stripe Payments & Stripe Connect (payment processing and automated KYC), AWS / MinIO (encrypted object storage), and Nodemailer / Google Cloud (transactional email dispatch). We strictly prohibit sub-processors from using your personal information for independent advertising purposes.
4. Infrastructure Security & Cryptographic Protection
Digital master files (WAV, FLAC, PDF) are stored in private buckets and are never accessible via public URLs. Download access is gated via signed HMAC-SHA256 presigned URLs with short-lived expiration windows. All transmission occurs over TLS 1.3 with HTTP Strict Transport Security (HSTS), X-Frame-Options: SAMEORIGIN, and strict Content-Type sniffing defenses.
5. Traffic Data Retention (Computer Crime Act B.E. 2560 Section 26)
In compliance with Section 26 of Thailand's Computer Crime Act, our platform automatically logs connection traffic data (IP address, NTP Stratum 3 synchronized timestamps, request URI, HTTP status code, and client user-agent) into our immutable trafficLog table. These logs are preserved securely for a statutory minimum of 90 days and up to 2 years upon formal judicial order.
6. Data Subject Rights (PDPA & EU GDPR)
Under Chapter 3 of the PDPA and Chapter 3 of the GDPR, you possess irrevocable rights regarding your data: (1) Right of Access & Portability: download your complete data profile in structured JSON format via /api/user/data-export; (2) Right to Rectification: modify profile and shop data in your dashboard; (3) Right to Erasure: submit an automated account deletion request via /api/user/erasure (subject to statutory financial retention requirements); (4) Right to Withdraw Consent: toggle non-essential analytics cookies at any time; (5) Right to Lodge a Complaint: submit grievances to Thailand's PDPC or your competent European Data Protection Authority.
7. Server Hosting Location & Cross-Border Data Transfers
Our physical servers, Docker containers, and PostgreSQL clusters are located in Nuremberg and Falkenstein, Federal Republic of Germany (European Union). Transfers of personal data between Thailand and our German infrastructure comply with PDPA Section 28/29 and GDPR Chapter V, relying on the recognized adequacy of European data protection regulations and Standard Contractual Clauses.
8. Data Protection Officer (DPO) & Regulatory Contact
For questions regarding this policy, exercising your PDPA/GDPR data subject rights, or reporting security incidents, contact our Data Protection Officer at: Email: [email protected]. Postal: Legal & Privacy Division, AMOOKSAN Platform, Bangkok, Thailand.