PEFYPEFY
Back to the site

Privacy Policy

What PEFY collects, why, how long it is kept, and what you can do about it.

Updated 28 August 2026

This is a courtesy translation. The Thai text is the version that applies, and Thai law governs this agreement.

  1. 01Scope

    This policy covers the PEFY website, the API behind it, and the emails we send.

    It does not cover what you do on a third party’s site, including the blockchain networks used to settle cryptocurrency payments.

  2. 02What we collect

    Only what the platform needs to run:

    • Account: username, email address, display name, and the profile you choose to fill in (avatar, pronouns, bio, colours).
    • Security: a scrypt hash of your password — never the password itself — plus failed sign-in counts, lockout state, and the time and IP of your last sign-in.
    • Sessions: a SHA-256 hash of each session token, the issuing IP, and the browser user-agent. The token itself is never stored.
    • Two-factor: an AES-256-GCM encrypted TOTP secret and scrypt hashes of your recovery codes, if you enable it.
    • Commerce: orders, order lines, transactions, invoices, issued licences, download entitlements and download events.
    • Seller verification: ID card, held-card photo, face photo and bank documents, stored outside the public directory and readable only by review staff. Address, date of birth, ID number and bank account number are stored encrypted.
    • Preferences: theme, language, currency, region, notification and accessibility choices.
    • Support: messages you send to the assistant, and the replies.
    • Logs: audit events, security events and sign-in attempts, each with an IP address.

  3. 03What we do not collect

    • Card numbers. We have no card rail, so there is nothing to store.
    • Your plaintext password, at any point after it reaches the server.
    • Your cryptocurrency wallet’s private keys or seed phrase.
    • Third-party advertising or cross-site tracking identifiers.
    • Precise location. Country is inferred from your connection to pick a currency, and nothing finer is recorded.

  4. 04Why we hold it

    • To run your account and let you sign in — without this there is no service.
    • To take payment, deliver what you bought, and issue the licence that proves your rights.
    • To keep the platform secure: rate limiting, lockouts and abuse detection.
    • To verify sellers as Terms §2 requires, and to pay money into the right account.
    • To meet accounting and tax obligations, which require records of completed sales to survive.
    • To answer support requests.

  5. 05Cookies

    We use first-party cookies only. There are no third-party or advertising cookies on this site.

    • Necessary: your session, the CSRF token, your cart, and your language, region and currency choice. These cannot be switched off.
    • Preferences: remembers choices such as theme and dismissed banners across visits.
    • Analytics: anonymous usage data indicating which pages are worth improving.
    • Your choice is stored in a first-party cookie for one year, and you can change it at any time.

  6. 06Who we share it with

    We do not sell your data and do not share it for advertising. It reaches a third party only where the platform cannot function otherwise:

    • An email provider, to deliver verification links, password resets, receipts and security alerts. It receives your address and the message body.
    • A payment or blockchain network, to settle a transaction. Cryptocurrency transactions are public on their network by design.
    • An AI provider, if the support assistant is configured to use one. It receives your messages and the lookups made on your behalf, never your password, licence keys or recovery codes.
    • Law enforcement, where we are legally required to and the request is valid.

  7. 07How long we keep it

    • Account data: until you delete your account.
    • Orders, transactions and licences: retained after account deletion, detached from your identity, because accounting records must survive.
    • Verification documents: kept while the seller account is open, and removed when the shop closes, unless a dispute or legal obligation is outstanding.
    • Sessions: revoked on sign-out and expired after seven days.
    • Delivered email records: pruned on a schedule. Failed ones are kept until someone has looked at them.
    • Support transcripts: pruned on a schedule.
    • Security and audit logs: retained for a limited period, then pruned.

  8. 08How it is protected

    • Passwords are hashed with scrypt and a per-user salt, and compared in constant time.
    • Session tokens are stored only as SHA-256 hashes, so a database leak yields nothing replayable.
    • Licence keys, TOTP secrets and sellers’ personal details are encrypted with AES-256-GCM, which detects tampering rather than decrypting to garbage.
    • Every database query uses bound parameters, which makes SQL injection structurally impossible rather than filtered.
    • Every mutating request carries a CSRF token, every endpoint is rate limited, and every administrative action is logged.
    • Uploads are stored outside the public directory and served with a type read from the file’s own bytes.

  9. 09Your rights

    Under Thailand’s PDPA and equivalents such as the GDPR and CCPA you have rights over your data. Most can be exercised yourself, immediately:

    • Access and portability: export your account, orders and licences as JSON from Settings.
    • Correction: edit your profile and preferences at any time.
    • Erasure: delete your account from Settings. Your identity, profile, avatar and preferences are erased and your username and email are freed. Paid orders and issued licences survive, detached.
    • Objection and restriction: contact us and we will action it.
    • Complaint: you may complain to Thailand’s data protection authority, or your local equivalent.

  10. 10International transfers

    Depending on where this deployment and its providers are hosted, your data may be processed outside your country. Where that happens we rely on the safeguards our providers offer.

  11. 11Minors

    PEFY sets a minimum age of twelve under Terms §1, and a minor needs a guardian’s consent before registering. If you believe an underage account exists, or one was created without that consent, contact us and we will remove it.

  12. 12Changes

    We may update this policy. The date at the top always reflects the current version, and material changes will be announced before they take effect.

  13. 13Contact

    Questions about this policy, or to exercise a right that is not self-service: aisukiz.official.th@gmail.com.

Terms of ServiceLicence termsPrivacy PolicyLegal & licensing