Privacy Policy
Last updated: 2026-09-29
1. Data Controller
The data controller for personal data processed on the ebo-ok platform is ebo-ok.com (บริษัทผู้ให้บริการ), which determines the purposes and means of processing your personal data as described in this policy. You can reach our privacy team at privacy@ebo-ok.com.
2. Information We Collect
We collect information you provide directly: email address, display name, profile information, and payment details processed securely through Stripe. We also automatically collect usage data such as pages visited, features used, and device information.
3. Lawful Basis for Processing
We process your personal data only where a lawful basis applies: performance of a contract, for creating and managing your account, processing book purchases, credit top-ups and seller payouts; legitimate interest, for platform security, fraud prevention and service improvement; and your consent, for optional processing that is not necessary to provide the service, such as non-essential communications. Where processing is based on consent, you may withdraw it at any time without affecting processing already carried out before the withdrawal.
4. How We Use Your Information
We use your information to provide and improve our services, process payments, send transactional emails, personalize your experience, and ensure platform security. We do not sell your personal information to third parties.
5. Information Sharing
We share information with: Stripe for payment processing, AI service providers for content generation (no personal data is shared — only book content), and as required by law. Your email may be used for PDF watermarking on purchased books.
6. Cross-Border Data Transfers
Some of our service providers store or process data outside Thailand: Stripe (payment processing, United States), Cloudflare R2 (file storage), MongoDB Atlas (database hosting), OpenRouter (AI content generation) and Resend (transactional email). Where personal data is transferred abroad, we ensure the destination country provides adequate data protection or that appropriate safeguards required by the Personal Data Protection Act (PDPA), such as contractual data protection obligations, are in place.
7. Seller Identity Verification (Stripe Connect)
To receive payouts from book sales, sellers connect a Stripe account. During onboarding, Stripe collects identity information — including an identity document, date of birth and bank account details — for identity verification (KYC), anti-money-laundering compliance and payout eligibility. This data is collected and held by Stripe under its own privacy policy and the Stripe Connected Account Agreement; ebo-ok stores only your Stripe account identifier and connection status.
8. Cookies
We use essential cookies for authentication and session management. We use httpOnly cookies for JWT tokens to enhance security. No third-party tracking cookies are used.
Author statistics
When you open a book page or an author profile we record the visit so the author can see how their work is doing. We use a random identifier generated by your own browser and stored only on your device, together with a country code, a coarse device type (mobile, tablet or desktop), the host name of the site that referred you, and the campaign code of any link you clicked. We do not store IP addresses and we do not build device fingerprints. Authors see aggregate figures only, and the email address of a buyer is always shown to them partially masked (for example k****n@gmail.com), both on screen and in exported CSV files. Statistics are deleted automatically after 730 days, and you can clear the identifier at any time by clearing this site data in your browser. If you sign in or sign up after clicking a campaign link, we keep that campaign code with your account for up to 30 days, so a purchase made on another device still counts towards that link.
9. Data Security
We implement industry-standard security measures including encrypted connections (HTTPS), secure password hashing, JWT token rotation, and secure payment processing through Stripe.
10. Your Rights as a Data Subject
Under the Personal Data Protection Act (PDPA), you have the right to access and obtain a copy of your personal data, rectify inaccurate data, erase your data, restrict its use, object to processing, receive your data in a portable format, and withdraw consent at any time where processing is based on consent. You can delete your account from your account settings, which permanently anonymizes your personal information, and you can request a data export by contacting support. If you believe your data has been processed unlawfully, you also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC).
11. Data Retention
We retain your data for as long as your account is active. When you delete your account, personal data is anonymized. Transaction and credit-ledger records are retained for as long as legal, accounting and tax obligations require. Payout records and seller verification references connected to Stripe are kept for the period required by anti-money-laundering and financial regulations, after which they are deleted or anonymized.
12. Changes to This Policy
We may update this privacy policy periodically. We will notify you of significant changes via email or in-app notification.
13. Contact
For privacy-related questions, or to exercise any of your rights, contact our data protection contact at privacy@ebo-ok.com. We will respond to rights requests within the period required by the PDPA.