Loading...
Please wait while we load the content.
Effective 6 October 2026 · GDPR · PDPA
In Plain Terms
What we do
We run PlatoonLabs, including our website, contact form, and user account system. This policy explains how we handle your personal data across all of it.
What we collect
Contact form details, account information (email, hashed password or third-party sign-in data, profile info), account activity (logins, IP, device), and analytics data via cookies. No billing data yet. that comes only if we launch paid plans.
What we don't do
We never sell your data. We don't share it beyond the few processors listed below (Cloudflare, Google, sign-in providers), and only as needed to run the service or comply with the law.
Your control
You can access, correct, export, or delete your data at any time, including closing your account, by contacting us. Non-essential cookies are opt-in only.
PlatoonLabs is a technology company based in Thailand. We act as your data controller under both GDPR and the Thai Personal Data Protection Act B.E. 2562 (PDPA).
Contact us at platoonlabs.com/contact.
Information you provide: name, email address, company (optional), and any messages sent through our contact form.
Account information: when you create an account, we collect your email address, password (stored as a salted hash, never in plain text), and profile details such as username and avatar. You may register or sign in using email and password, or via third-party sign-in providers (e.g. Google), in which case we receive your name, email address, and profile picture from that provider as authorized by you.
Account activity: login timestamps, IP address at login, device and browser information, session data, and general usage activity within your account (e.g. settings changes, feature usage).
Billing information: we do not currently process payments. If we introduce paid subscriptions in the future, billing details (such as payment method and transaction history) will be collected and processed by a PCI-DSS compliant third-party payment processor, and this policy will be updated accordingly before that feature is enabled.
Automatically collected: IP address, browser type, device info, pages visited, and usage data via Google Analytics 4 (GA4).
We use essential, analytics, and security cookies. Non-essential cookies require your consent under both GDPR and PDPA and can be managed via our cookie banner.
We process your data only where a lawful basis exists. Creating and maintaining your account, and providing the features you sign up for - contract (GDPR Art. 6(1)(b) · PDPA §24). Responding to inquiries - contract or legitimate interest. Account security and fraud prevention - legitimate interest. Analytics - consent. Legal compliance - legal obligation. Marketing - consent only.
This applies under GDPR Article 6 and PDPA Section 24.
Our service providers, including Google and Cloudflare, operate in the United States. Cross-border transfers are covered by Standard Contractual Clauses (EU data) and adequate protection standards under PDPA Section 28 (Thai data).
Contact form submissions are kept for 2 years. Account data is retained for as long as your account remains active. Upon account deletion, personal data is removed or anonymized within 30 days, except where retained data is required for legal, security, or fraud-prevention purposes, in which case it is kept only as long as necessary and no longer than 90 days. Analytics data (GA4) for 14 months. IP addresses and request statistics held in our reverse proxy's live traffic monitor are kept for no more than 24 hours. Server and security logs for 90 days. Cookie consent records for 1 year. After these periods, data is deleted or anonymized.
We do not sell your personal data. We share data only with Cloudflare (security, WAF, DNS - USA), Google GA4 (analytics - USA), authentication providers you choose to sign in with (e.g. Google, for account login), and legal authorities when required by law. Standard Contractual Clauses apply to all US transfers.
Passwords are stored using industry-standard salted hashing and are never accessible to us in plain text. We use TLS encryption for all data in transit and enforce access controls to protect account data at rest.
We monitor for suspicious login activity and may take protective action, such as requiring re-authentication, if unusual activity is detected. You are responsible for keeping your login credentials confidential and for notifying us immediately if you suspect unauthorized access to your account.
To close your account, please contact us at platoonlabs.com/contact. We will verify your request and process deletion in line with the retention periods described above.
Depending on your location you may: access your data (GDPR Art. 15 · PDPA §30), correct it (Art. 16 · §34), request deletion including full account closure (Art. 17 · §33), receive it in a portable format (Art. 20 · §31), object to processing (Art. 21 · §32), or withdraw consent at any time (Art. 7 · §19).
To exercise any of these rights, including deleting your account, contact us at platoonlabs.com/contact. We will respond to verified requests within 30 days.
EU residents may contact their local supervisory authority. Thai residents may contact the PDPC at pdpc.or.th.
Our services, including account registration, are not directed at anyone under 13, and account creation requires the user to confirm they meet this minimum age requirement. We do not knowingly collect data from minors. If you believe we have, contact us and we will delete it immediately.
We use TLS encryption, WAF protection via WebStryker, and strict access controls. No internet transmission is 100% secure. Report suspected breaches to us immediately.
Material changes will be posted on this page at least 30 days before taking effect. Continued use of our services after that date constitutes acceptance.
For all privacy matters, including account-related requests, contact us at platoonlabs.com/contact. We respond within 30 days.