1. Data we collect
FindEdu collects only what's needed to operate the school-discovery service:
- Account: email, first/last name, password (bcrypt-hashed)
- Profile fields you fill in: child grade, preferred curriculum
- Inquiry forms: contents + your contact info
- Saved schools (Shortlist)
- Technical: IP address, user agent, referrer (for security + spam control)
2. Purpose
- Provide search / comparison / shortlist functionality
- Forward inquiries to the school you indicate
- Improve data quality and user experience
- Comply with the Personal Data Protection Act B.E. 2562 (Thailand PDPA)
3. Recipients
- Schools you send inquiries to — they receive your form content and email
- Infrastructure providers (Supabase, Vercel) under data-processing agreements
- We do not sell or rent your data to third parties
4. Retention
Account data and inquiry history are retained for as long as the account is active. Closed inquiries are kept up to 2 years for audit and internal statistics.
5. Your rights (PDPA)
- Access and request a copy of your data
- Correct inaccurate data
- Delete your account and personal data (request via privacy@findedu.test)
- Withdraw consent (where processing relies on consent)
- File a complaint with the PDPC (Personal Data Protection Committee)
6. Cookie usage
- Necessary (always on): authentication, security, shortlist state
- Language: remember your TH/EN preference
- Analytics (optional): usage stats (not currently installed)
- Marketing (optional): not currently used
7. Contact our DPO
Questions or rights requests: privacy@findedu.test
This policy is being reviewed by PDPA counsel before full public launch.