Privacy policy
Last updated: 8 November 2026
This policy explains what personal data DSP (https://dspcreator.com) collects, why, and the choices you have. We follow the Thai Personal Data Protection Act B.E. 2562 (PDPA).
1. Data we collect
| What | When | Example |
|---|---|---|
| Account data | You register or buy | Email address, display name, password (stored only as a secure hash) |
| Order data | You buy or sell | Products, prices, coupons, receipts, refund requests |
| Payment data | You pay | Payment status and reference. Card numbers never reach our servers; they are handled by the payment provider. PromptPay slips you upload are kept with the transfer. |
| Creator data | You open a store | Store name, payout account, identity documents for verification (KYC) |
| Technical data | You use the site | IP address, browser type, pages viewed, sign-in times and security events |
2. Why we use it
- To provide the service (contract): create your account, process orders, deliver downloads and licence keys, pay creators and send receipts.
- To keep the marketplace safe (legitimate interest): prevent fraud, limit sign-in attempts, investigate reports.
- To meet legal duties (legal obligation): accounting, tax and anti-money-laundering records.
- Marketing emails only with your consent, which you can withdraw at any time in Account › Privacy.
3. Who receives it
- The creator you buy from receives your name, email and order details so they can support you.
- Payment providers (card payments and banks for PromptPay) process your payment.
- Hosting and email providers that run the site for us, under contracts that protect your data.
- Authorities when the law requires it.
We do not sell your personal data.
4. How long we keep it
Account data is kept while your account is open. Order, payment and payout records are kept for 5 years after the transaction, as required by Thai accounting and tax law. Security logs are kept for 1 year. After that the data is deleted or anonymised.
5. Cookies
We use only the cookies the site needs to work: your sign-in session, protection against cross-site request forgery, your cart and your light/dark theme choice. We do not use advertising cookies.
6. Your rights
Under the PDPA you can ask to access or receive a copy of your data, correct it, delete it, restrict or object to its use, and withdraw consent. You can download your data and request deletion yourself in Account › Privacy, or email support@dspcreator.com. We answer within 30 days. You may also complain to the Personal Data Protection Committee (PDPC) of Thailand.
7. Security
Passwords are hashed, connections use HTTPS, two-factor authentication is available for every account, and staff access is limited by role and recorded in an audit log.
8. Contact
Data protection questions: support@dspcreator.com.