Effective Date: April 7, 2026 Last Updated: April 7, 2026
BrandStromX Co., Ltd. (“Company”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you access or use the BrandBox Platform at https://brandstromx.co.th/.
This Policy is issued in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) of the Kingdom of Thailand and applies to all users of the Platform.
By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please stop using the Platform immediately.
For general information about our company, visit https://brandstromx.co.th/.
BrandStromX Co., Ltd. is the Data Controller responsible for your personal data collected through the Platform.
If you have any questions about this Policy or wish to exercise your rights, please contact us using the details in Section 12.
We collect only the personal data necessary to provide and improve the Platform. The categories of personal data we collect are:
We do not collect:
We collect personal data through the following means:
We process your personal data only where we have a valid legal basis under the PDPA. The table below sets out our processing purposes and corresponding legal bases:
| Purpose | Personal Data Used | Legal Basis |
|---|---|---|
| Creating and managing your account | Name, email, role | Contractual necessity |
| Authenticating your identity and managing sessions | Email, session tokens, IP address | Contractual necessity |
| Providing dashboard features and displaying campaign data | Ad account IDs, performance data | Contractual necessity |
| Storing markup and billing configurations | Ad account IDs, markup values | Contractual necessity |
| Security monitoring and fraud/abuse prevention | IP address, usage data, login timestamps | Legitimate interest |
| Improving Platform features and performance | Usage data, technical data | Legitimate interest |
| Complying with legal obligations | All relevant data | Legal obligation |
| Communicating service-related notices (e.g., updates, downtime) | Contractual necessity / Legitimate interest |
We will not process your personal data for purposes beyond those stated above without your prior consent or another valid legal basis.
We do not sell, rent, or trade your personal data. We may share your personal data with:
We engage trusted third-party service providers to operate the Platform, who process personal data on our behalf under appropriate data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database hosting | United States |
When you connect ad accounts, the Platform communicates with Meta (Facebook/Instagram) and Google Ads APIs using credentials you authorize. These providers process data under their own privacy policies.
We may disclose personal data to competent courts, government authorities, or regulators where required by applicable Thai law, court order, or legal process.
In the event of a merger, acquisition, or sale of all or part of our business assets, personal data may be transferred to the relevant successor entity. We will notify affected users in such circumstances.
Some of our service providers (notably Supabase) process personal data outside of Thailand. When we transfer personal data internationally, we take appropriate safeguards in accordance with Section 28 of the PDPA, including:
We retain personal data only for as long as is necessary for the purposes described in this Policy, or as required by applicable Thai law.
| Data Category | Retention Period |
|---|---|
| Account and identity data | Duration of active account + 3 years after closure |
| Session and authentication logs | 90 days |
| Usage and technical logs | 90 days |
| Business configuration data | Duration of active account + 3 years after closure |
| Advertising performance data | Duration of active account + 3 years after closure |
When personal data is no longer required, we will securely delete or anonymize it.
The Platform uses the following technologies strictly for operational purposes:
| Technology | Purpose | Duration |
|---|---|---|
| Session cookies | User authentication and session continuity | Session / Until logout |
| Local/session storage | Storing authentication tokens (Supabase JWT) | Session / Until logout |
We do not use advertising cookies, cross-site tracking cookies, or any third-party analytics cookies within the Platform.
Under the PDPA, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right to be informed | To know how your personal data is collected and used |
| Right of access | To request a copy of the personal data we hold about you |
| Right to rectification | To request correction of inaccurate or incomplete data |
| Right to erasure | To request deletion of your personal data where lawfully applicable |
| Right to restriction | To request that we limit how we use your data in certain circumstances |
| Right to data portability | To receive your data in a structured, machine-readable format |
| Right to object | To object to processing based on legitimate interests |
| Right to withdraw consent | To withdraw consent at any time where processing is consent-based |
To exercise any of these rights, please contact us at the details provided in Section 12. We will respond within 30 days of receiving your verified request, as required by the PDPA.
Please note that certain rights may be limited where we are required by law to retain data, or where exercising a right would adversely affect the rights of others.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:
While we take reasonable steps to protect your data, no system is completely secure. If you believe your account has been compromised, please contact us immediately.
For questions about this Privacy Policy, to submit a data subject rights request, or to contact our Data Protection Officer (DPO):
BrandStromX Co., Ltd. Website: https://brandstromx.co.th/
Please include “Privacy Request” or “PDPA Inquiry” in the subject line of your communication. We may need to verify your identity before processing your request.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable laws. We will post the updated Policy on the Platform with a revised “Last Updated” date. Where changes are material, we will notify registered users via email. Continued use of the Platform following such notification constitutes acceptance of the updated Policy.
This Privacy Policy was last updated on April 7, 2026 and is effective as of the same date.
