Privacy Policy (PDPA Notice)

1. Data Controller & PDPA Compliance Commitment

TrendSnap operates as the Data Controller under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and applicable international privacy standards. We apply strict data minimization: we collect only the data strictly required to authenticate your account, process orders, mint your digital collectibles, and comply with accounting and security obligations.

2. Personal Data We Collect (and What We Never Collect)

We collect: (a) Account & Contact Data: email address, chosen collector handle, preferred language, and account creation timestamp; (b) Transaction & Order Data: order IDs, card editions purchased, payment method type, provider charge reference IDs, THB/USDC amounts, and refund status; (c) Blockchain & Wallet Data: your managed email-wallet address, external public wallet addresses you voluntarily link via cryptographic signature, token IDs, and on-chain transaction hashes; (d) Activity & Security Data: watchlist items, emoji reactions, referral codes, and hashed session tokens / IP rate-limiting logs. We NEVER collect or store full credit/debit card numbers, CVV codes, bank login credentials, wallet seed phrases, or user private keys.

3. Purpose & Lawful Basis for Processing

We process your data under the following PDPA lawful bases: (a) Contractual Necessity: to send sign-in codes, lock checkout prices, verify payments, mint NFTs to your wallet, and display your collection; (b) Legal Obligation: to retain payment invoices, tax records, and refund audit trails as required by Thai revenue and financial laws; (c) Legitimate Interest: to enforce rate limits, prevent automated bot scalping, detect payment fraud, and maintain service security; (d) Explicit Consent: to send optional promotional drop notifications by email, which you may opt into or withdraw at any time.

4. Public Blockchain Permanence & Showcase Visibility

Please be aware that blockchain networks (such as Base) are public, decentralized, and immutable ledgers. When a card is minted or transferred on-chain, the receiving wallet address, token ID, edition number, and transaction hash become permanently visible on public block explorers and cannot be erased or modified by TrendSnap. On our website, your public collector showcase (/u/your-handle) displays your handle and collected cards—never your email address.

5. Data Sharing & Regulated Sub-processors

We never sell, rent, or trade your personal data to third parties or advertisers. We share minimal necessary data only with vetted service providers acting under strict confidentiality: (a) Payment Gateways (e.g., Omise / PromptPay processors) to process fiat charges and refunds; (b) Blockchain Minting & RPC Infrastructure (AgentBee / Base nodes) to execute token minting; and (c) Transactional Email Providers to deliver 6-digit OTP codes, receipts, and mint confirmations.

6. Cookies & Browser Storage Policy

TrendSnap uses only strictly necessary first-party cookies: an HttpOnly, SameSite=Lax session cookie ('session') to keep you signed in securely, a language preference cookie ('lang'), and an invite attribution cookie ('ref'). We do not use third-party advertising pixels, cross-site behavioral tracking cookies, or invasive fingerprinting scripts.

7. Data Retention Schedule

Your account profile, watchlist, and reactions are retained for as long as your account remains active, and are immediately purged or anonymized upon your account deletion request. One-time sign-in codes expire within 15 minutes. Financial order records and payment references are retained in anonymized form for the statutory accounting and tax period required under Thai law (typically 5 to 10 years).

8. Information Security Measures

We protect your data using defense-in-depth technical safeguards: SHA-256 hashing of all session tokens and OTP codes at rest, strict Content-Security-Policy (CSP) headers with zero inline script execution, Cross-Site Request Forgery (CSRF) origin validation, X-Frame-Options clickjacking protection, and automated rate limiting on authentication and checkout endpoints.

9. Your Rights Under PDPA (Self-Service Export & Erasure)

Under the PDPA, you have the right to access, rectify, export (data portability), restrict, object to processing, withdraw consent, and request erasure of your personal data. You can exercise your right to data portability and erasure immediately at any time via 'My Cards → Settings': click 'Download my data' (/me/export.json) to receive a complete machine-readable JSON archive of your data, or use 'Delete my account' (/me/delete) to permanently delete your account and anonymize historical order records.

10. Contact & Data Protection Inquiries

For any questions regarding these Terms, our Privacy Policy, or to file a PDPA request or complaint, please contact our Data Protection & Support team at support@trendsnap.example. You also retain the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) of Thailand.