What Information We Collect

We collect different types of information depending on how you interact with our platform. Some you give us directly, some we gather automatically, and some comes from how you use the budgeting features.

Information You Provide Directly

When you create an account or use our services, you share:

• Name and email address for account creation
• Phone number if you want SMS notifications about budget alerts
• Financial goals and monthly budget targets you set up
• Transaction categories and spending patterns you manually input
• Payment information if you upgrade to premium features

Information We Collect Automatically

Our systems log technical information to keep things running smoothly:

• IP address and general location data (city level, not street address)
• Device type, browser, and operating system details
• Pages you visit and features you use most often
• Time spent on different sections of the platform
• Error logs and performance metrics

How We Use Your Information

Everything we collect serves specific purposes. We're not in the business of hoarding data just because we can.

Data Type	Purpose
Account Information	Creating and maintaining your profile, sending important updates about service changes
Budget Data	Generating spending insights, creating monthly reports, sending alerts when you're near limits
Usage Patterns	Improving features, fixing bugs, understanding which tools people actually find helpful
Technical Logs	Troubleshooting problems, preventing security issues, optimizing performance
Payment Details	Processing subscriptions, handling refunds, maintaining billing records

We analyze aggregated, anonymized data to understand trends. For example, we might look at whether most users prefer weekly or monthly budget reviews. But we're never looking at individual user behavior in a creepy way.

Data Storage and Security

Your data lives on servers located in Singapore and Japan. We chose these locations for speed and reliability for users across Thailand and Southeast Asia.

Security measures include:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Regular security audits by third-party specialists
• Two-factor authentication available for all accounts
• Automated backup systems with 30-day retention
• Access controls limiting which team members can view what data

Real talk though: no system is 100% secure. We do everything reasonable to protect your information, but we can't guarantee absolute security. That's why we minimize what we collect in the first place.

Sharing Your Information

We don't sell your data. Period. That's not our business model and never will be.

When We Share Data

There are limited situations where we share information with third parties:

• Payment processors (Stripe) to handle subscription billing
• Email service providers (SendGrid) to send account notifications and budget alerts
• Analytics tools (self-hosted) to understand how people use the platform
• Cloud infrastructure providers (AWS) where our servers physically exist
• Legal authorities if required by Thai law or valid court orders

Every third-party service we use signs data processing agreements. They're contractually obligated to protect your information and can only use it for the specific services they provide to us.

International Transfers

Because our servers are in Singapore and Japan, your data crosses international borders. Both countries have strong data protection frameworks. We ensure appropriate safeguards are in place for these transfers, including standard contractual clauses and regular compliance reviews.

Your Rights Under Thai PDPA

Thailand's Personal Data Protection Act gives you specific rights. Here's what you can do and how to actually do it:

Right to Access

You can request a copy of all personal data we hold about you. We'll provide it in a readable format within 30 days. Go to your account settings and click "Request Data Export" or email us at contact@datastreamrelay.com.

Right to Rectification

Found something wrong in your account? You can update most information directly through your profile settings. For things you can't change yourself, send us an email and we'll fix it within 7 business days.

Right to Erasure

Want to delete your account entirely? You can do that from account settings. We'll remove your data within 30 days, though we may keep some information if legally required (like transaction records for tax purposes, which we're required to retain for 7 years under Thai law).

Right to Data Portability

You can download your budget data in CSV or JSON format anytime. This makes it easy to move to another service if you decide Datastreamrelay isn't for you anymore.

Right to Object

You can object to certain types of data processing. For example, if we want to use your data for new purposes beyond what's described here, you can say no. We'll respect that unless we have compelling legitimate reasons that override your interests.

Right to Restrict Processing

In some situations, you can ask us to limit how we use your data. Maybe you've contested the accuracy of information and want us to pause processing while we verify it. We'll honor these requests where legally appropriate.

Data Retention

We keep different types of data for different periods:

• Active account data: Kept as long as your account exists
• Deleted account data: Removed within 30 days (except legal retention requirements)
• Transaction records: 7 years (Thai tax law requirement)
• Technical logs: 90 days for troubleshooting purposes
• Analytics data: Anonymized after 6 months, then kept indefinitely
• Support communications: 3 years for quality assurance

When data reaches the end of its retention period, we permanently delete it from our systems and backups. You don't need to remind us or follow up.

Cookies and Tracking

We use cookies, but we're pretty minimal about it compared to most sites.

Essential Cookies

These keep you logged in and remember your preferences. You can't really use the site without them. They expire when you close your browser or after 30 days of inactivity.

Analytics Cookies

These help us understand which features people actually use. We run our own analytics rather than using Google Analytics, so your data isn't shared with advertising networks. You can opt out in your account settings.

We don't use advertising cookies or third-party tracking pixels. We don't participate in ad networks or retargeting campaigns.

Changes to This Policy

We'll update this policy occasionally as our service evolves or legal requirements change. When we make material changes, we'll email you at least 30 days before they take effect.

Minor updates (fixing typos, clarifying existing practices) won't trigger notifications, but we'll always update the "Last Updated" date at the top of this page.

If you disagree with changes, you can close your account before they take effect. We'll process your data under the old policy until your account is fully deleted.

Children's Privacy

Datastreamrelay is designed for adults managing their own finances. We don't knowingly collect information from anyone under 18. If you're a parent and discover your child has created an account, contact us and we'll delete it immediately.

Legal Basis for Processing

Under Thai PDPA, we need a legal basis to process your data. Here's what applies:

• Consent: You agree to our terms when creating an account
• Contract Performance: We need your data to provide the budgeting service you signed up for
• Legal Obligation: Some data retention is required by Thai tax and financial laws
• Legitimate Interest: We analyze usage patterns to improve the service, which benefits all users

You can withdraw consent anytime for processing based on consent. That won't affect the lawfulness of processing before you withdrew consent.