Privacy Policy
Last updated: July 12, 2026 · Compliant with Thailand PDPA (พ.ร.บ. คุ้มครองข้อมูลส่วนบุคคล) & EU GDPR.
1. Who we are
Snapblox is operated by Snapblox, a business registered in Bangkok, Thailand, with technical operations by ODW Digital Media Solution. We are the "Data Controller" for personal data collected through our platform.
Our Data Protection Officer (DPO) can be reached at odwnow@gmail.com.
2. Data we collect
2.1 From booth guests (photobooth users)
- Photos voluntarily taken through the booth camera
- Timestamp + session ID — for analytics + QR download
- Consent record — whether the guest accepted the photo policy
- We do not collect names, phone numbers, email, or other identifying information from guests
2.2 From account holders (business customers)
- Name, email, phone, business address (for billing + support)
- Login/session data (for authentication)
- Business content (templates, brand assets, promo copy)
- Usage analytics (dashboard access, actions taken)
2.3 Automatically collected
- IP address, browser type, device info
- Pages visited on our website
- Cookies — see Cookie Policy
3. How we use data
- Photos: printed to thermal receipt · stored on cloud for QR download · deleted in 30 days
- Analytics: aggregated statistics (photos/day) — no personal identifiers
- Support: respond to customer inquiries
- Billing: process subscriptions and invoices
- Legal: comply with law enforcement requests, tax authorities
We do not sell personal data. We do not use guest photos for marketing, machine learning training, or share with advertisers.
4. Sharing with third parties
We share limited data with these service providers, under contract:
- Supabase Inc. (Ireland, USA) — hosted database + storage
- Netlify Inc. (USA) — website hosting + CDN
- Stripe Inc. (Ireland, USA) — payment processing (for paid plans)
- Google Fonts (USA) — font delivery
All processors are contractually bound to protect your data. We use Standard Contractual Clauses for cross-border transfers where required.
5. Data retention
- Guest photos: 30 days after capture
- Aggregated analytics: indefinitely (no personal identifiers)
- Account data: for the duration of your subscription, plus 90 days after cancellation (for reactivation grace period)
- Billing records: 7 years (Thai tax law)
- Audit logs: 2 years
6. Your rights
Under Thailand PDPA (§37) and GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectify — correct inaccurate data
- Delete — request erasure (subject to legal retention rules)
- Restrict processing
- Port — receive your data in a machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time
- Complain to the PDPC (Personal Data Protection Committee in Thailand) or your local supervisory authority
To exercise these rights, email odwnow@gmail.com. We respond within 30 days.
7. Security
- Data encrypted at rest (AES-256) via Supabase
- Data in transit encrypted with TLS 1.3
- Access controlled by Row Level Security (only your tenant sees your data)
- Authentication via magic link email (no password to steal)
- Regular security audits of dependencies
Despite our efforts, no system is 100% secure. We will notify affected users and the PDPC within 72 hours of any material data breach, as required by law.
8. Minors
The Service is not intended for use by individuals under 20 (age of majority in Thailand) without parental consent. If you operate a booth where minors will use it, you are responsible for obtaining lawful parental/guardian consent under PDPA §20.
ODW Digital Media Solution
Bangkok, Thailand
Email: odwnow@gmail.com
DPO: odwnow@gmail.com
For PDPA complaints: Personal Data Protection Committee (สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล) · pdpc.or.th