Privacy Policy

BUG MAI Co., Ltd., Thailand is the data controller. Contact for all privacy matters: bugmai.co.ltd@gmail.com.

From owners who create a page:

• Content you type: names, messages and letters, wishes and answers you set up, an optional passcode (we keep only a one-way hash, never the passcode itself);
• Up to 10 photos. We re-encode every photo and remove its metadata (EXIF), including GPS location, before storing it;
• Optional background music: the BugLove song you picked, or a Spotify link;
• Order data: pack, amount, discount code, status and the Stripe session reference. We never see or store card numbers; Stripe handles them.

When you log in, from the login provider you choose:

• Google: your name, email address, profile picture and provider ID;
• LINE: your display name, profile picture, provider ID and email address if you allow it;
• Facebook: your name, profile picture, provider ID and email address if available;
• TikTok (Login Kit): your display name, avatar and provider ID (open ID). TikTok does not give us your email. We do not post to TikTok or read your videos or followers;
• Email: your email address and a one-time 6-digit code (stored only as a hash and valid for 10 minutes).

From recipients (no account is needed to open a page):

• Events on the page: opened, answered, replied, and the text of a reply or wish the recipient chooses to send;
• A salted hash of the IP address (not the readable address) used to limit abuse and count visits;

From everyone who visits our own site:

• Page-view analytics without cookies: page path, referring site, campaign tags (UTM), language, whether the device is mobile, and a salted hash of the IP address. Bots are filtered out;
• Technical data our hosting provider processes to deliver the site, such as IP address and browser type, in server logs.

• To create, host and show your page, and to show you the tracking page (performance of the contract with you);
• To log you in and keep you logged in (performance of the contract; your consent when you choose a login provider);
• To take payment, apply discounts, issue refunds and keep accounting records (performance of the contract; legal obligation under Thai accounting and tax law);
• To prevent abuse, fraud and spam, protect security and enforce the Terms (our legitimate interests);
• To understand how the site is used and improve it, using cookie-less analytics (our legitimate interests);
• To answer your messages and requests (performance of the contract; legitimate interests);
• To comply with the law and requests from authorities (legal obligation).

We do not sell personal data, do not use it for advertising profiles and do not use your photos or messages to train AI models.

Photos and messages that include other people (for example the recipient) are placed there by you. Please make sure you have their consent.

• bl_session: a necessary, httpOnly login cookie. It holds a random token (we store only its hash) and lasts up to 90 days or until you log out;
• buglove_lang: remembers your language choice for up to a year;
• Short-lived cookies used during login (to prevent forgery of the login request), which expire within 10 minutes;
• Your browser's local storage keeps your draft's access key and a discount code you opened, on your device only.

We do not use advertising or cross-site tracking cookies. Our analytics use no cookies.

We share data only as needed to run the service, with processors that act on our instructions:

• Stripe (payments): processes your payment details; Stripe is also an independent controller for its own legal and fraud obligations;
• Hosting and database providers: run the website and store the data;
• Object storage provider: stores the re-encoded photos;
• Email sending provider: sends login codes and service emails;
• Login providers (Google, LINE, Meta/Facebook, TikTok): when you choose them, under their own privacy policies;
• Spotify: only if a page has a Spotify song link; its player loads when the recipient opens the page.

We may also disclose data to professional advisers, or to authorities when the law requires it. If the business is sold or merged, data may transfer to the new owner under this policy.

Pages are viewable by anyone who has the link: content you put on a page is shared with the people you give the link to, and they may pass it on.

Some providers (for example Stripe, hosting and login providers) process data on servers outside Thailand. When we send personal data abroad, we do so only where the destination offers adequate protection or with appropriate safeguards required by the PDPA (for example contractual terms).

• Free page: live for 24 hours from publishing. Paid page: live for the days purchased. After it ends there is a 30-day grace period in which you can add days;
• After the grace period, the page content and all photos are permanently deleted. Unused drafts are deleted after about 7 days;
• If you delete a page yourself, its photos and content are removed at once;
• Recipient events (opened, answered, replies) are kept with the site record while your account exists and are removed when you ask us to erase them;
• Account data (name, email, avatar, provider ID) is kept until you ask us to delete your account;
• Order and payment records are kept as long as the law requires for accounting and tax (generally at least 5 years);
• Page-view analytics hold only hashed IPs and are kept for a limited period for statistics;
• Short technical records for abuse limiting are deleted within about a day.

Backups may hold data for a short extra period before they are overwritten.

You can ask to:

• access your personal data and get a copy;
• correct data that is wrong or incomplete;
• delete or anonymise your data;
• receive your data in a common machine-readable format and have it sent to another controller where applicable;
• object to or restrict how we use it;
• withdraw consent you gave at any time (this does not affect past use; it may mean we can no longer provide parts of the service);

Email bugmai.co.ltd@gmail.com from the address linked to your account. We may need to verify your identity. We aim to answer within 30 days. We will explain if we cannot do what you ask (for example, records the law requires us to keep).

If you think we have not handled your data properly, you can complain to the Office of the Personal Data Protection Committee (PDPC) of Thailand, or take the matter to a court.

To delete a page and its photos: open your tracking page and choose delete.

To delete your account and the data linked to it, including data received from Facebook, Google, LINE or TikTok: email bugmai.co.ltd@gmail.com with the subject "Delete my data" from your account email, or message us on LINE. Tell us which login you used. We will confirm once it is done, generally within 30 days. You may also remove BugLove from the app permissions of your login provider.

We use HTTPS, store access tokens and passcodes only as hashes, serve photos through signed, short-lived links, limit login and request attempts, and restrict staff access. No system is perfectly secure; if there is a breach likely to affect your rights we will notify you and the PDPC as the law requires.

BugLove is for people aged 13 and over. We do not knowingly collect data from children under 13; if you believe we have, email us and we will delete it. Under Thai law, people under 20 should have a parent or guardian's consent for paid purchases.

We may update this policy and will change the date above. If a change is significant we will tell you on the site or by email.

BUG MAI Co., Ltd., Thailand. Email: bugmai.co.ltd@gmail.com.