Privacy Policy

1. Data controller

Controller: Aura Dress Rental
Service model: online-only dress rental based in Chiang Mai, Thailand; we currently have no physical storefront or fitting location
Contact channel: LINE OA @a2dress
We operate a single-tenant online dress rental business and determine the purposes and means of processing your personal data.

2. Personal data we collect

We may collect the following data as necessary to provide our services:
• Identity: full name, display name, LINE profile photo
• Contact: phone number, LINE ID, email (if provided)
• Booking: selected dress, use and return dates, size, delivery address or Google Maps pin (if you provide it), and special notes
• Payment: transfer proof (slip), amount, payment date — we do not store credit card numbers; supported payment methods are shown during booking
• Profile & loyalty: membership tier, reward points, booking history, favorite dresses, and saved addresses
• Technical: cookies, IP address, browser type, and site usage (with analytics configured to reduce identification where possible)

3. Sources of data

We receive data from:
• You directly — when booking, uploading a slip, updating your profile, or messaging us on LINE OA
• LINE Platform — when you sign in with LINE Login (LIFF), within the scope LINE and you authorize
• Automated systems — site usage logs and essential cookies
We do not purchase customer lists from third parties.

4. Purposes and legal bases

We use data to:
• Process bookings, confirm slots, coordinate delivery and returns, and provide after-rental support
• Verify identity, prevent misuse, and manage member accounts
• Verify rental fees and other booking-related payments (if applicable)
• Send LINE OA notifications about booking status, changes, or important updates
• Operate loyalty points and member benefits
• Improve the website, analyze usage, and maintain system security
• Comply with applicable laws
Legal bases include contract performance, consent (where required), legitimate interests, and legal obligation.

5. Disclosure to third parties

We may disclose data only as necessary to:
• Infrastructure providers: Supabase (database and auth), Vercel (hosting) — under data protection agreements
• LINE Corporation — for LINE Login and Messaging API per LINE policies
• Google — for Google Maps (when you pin a delivery location) and analytics/Search Console as configured
• Sentry — for error logging (technical data; not direct slip content)
We do not sell your personal data and disclose to authorities only when required by law.

6. Retention

We retain data only as long as needed:
• Booking and payment records: at least 5 years from the transaction date (accounting and disputes)
• Member accounts and points: while the account is active, deleted within 90 days after you request account deletion
• Transfer slips: as long as needed for verification and business records
• System logs and cookies: per cookie policy or until you delete them
When no longer necessary, we delete or anonymize data.

7. Security measures

We apply reasonable safeguards including HTTPS encryption, database access controls (Row Level Security), restricted admin access, industry-standard token/password handling, and staff confidentiality training.
No system is 100% secure. If a personal data breach occurs, we will notify as required by law.

8. Your rights under PDPA

Under PDPA you may:
• Request access to and copies of your personal data
• Request correction of inaccurate or incomplete data
• Request deletion or destruction when no longer legally required
• Request restriction of processing in certain cases
• Object to processing based on legitimate interests
• Withdraw consent (where processing relies on consent) without affecting prior lawful processing
• Request data portability in a machine-readable format (where applicable)
Submit requests via LINE OA @a2dress with your name and details. We respond within 30 days (or as required by law). You may complain to Thailand’s Personal Data Protection Committee (PDPC) if unsatisfied.

9. Cookies and tracking

We use essential cookies for sign-in, language, and session security. These are required to provide the service and cannot be switched off.
Analytics cookies and tools (Google Analytics, Google Tag Manager, Meta Pixel) do not run until you accept them in the cookie consent banner. Before you consent we load none of these providers' scripts and send no usage data at all.
Once you accept, we collect only what is needed to improve dress search and the booking flow: the type of page you opened, the language you use, the dress identifier you viewed, the rental duration you selected, how many dresses your search found, and which contact button you clicked. We never send your name, phone number, address, email, booking number, payment amount, or the destination of a contact link to analytics.
You can change your mind at any time through the “Cookie settings” link in the site footer. Withdrawing consent stops collection immediately. You can also block cookies in your browser, though some features may not work.
We do not use personal data for third-party targeted advertising without consent.

10. International transfers

Some providers (e.g. Supabase, Vercel, Google, LINE, Sentry) may process data on servers outside Thailand. We implement appropriate PDPA safeguards such as standard contractual clauses or adequate protection mechanisms.

11. Policy updates

We may update this policy from time to time. The “Last updated” date above reflects the latest revision. For material changes, we will notify via the website or LINE OA where appropriate.
Continued use after publication means you acknowledge the updated policy.