Privacy policy

Glamour Rental (“we”) provides a management system for rental shops.

• Data of shop owners and the staff who use the system: we are the data controller.
• Data of a shop’s customers (people who rent from a shop or send it a request, including people who fill in a form on the shop’s online storefront): that shop is the data controller, and we are the data processor, acting on the shop’s behalf. We use the data to provide the system to the shop; we don’t sell it or pass it to other shops.

To contact our Data Protection Officer (DPO): message the Glamour Rental LINE Official Account, or email hello@glamour-rental.shop.

2.1 Shop owners’ data (our customers):

• Full name · email · phone number · LINE ID
• Shop name · shop address · tax ID (if any)
• Usage data (login history, page views), to improve the system
• How you first found us when you signed up (for example a link in a Facebook post, a Google search or a link shared on LINE). We keep only the channel or the name of the site you came from, not your browsing history, to measure our own marketing.

2.2 Shops’ customers’ data (the shop is the data controller):

• Name · phone number · LINE ID · address, entered by the shop or typed by the customer when requesting a rental or a fitting on the shop’s online storefront (including a delivery map pin, a time that suits them and a note to the shop, if given)
• Date of birth (for a birthday message on LINE, if the shop owner turns it on)
• Rental history · loyalty points · VIP / blacklist status
• National ID number (stored as a hash, to prevent misuse)
• Documents the shop owner attaches (for example a photo of an ID card copy, or a rental agreement or signed pickup form), kept in private storage that only the shop owner and managers can open, through temporary links only, and all deleted when the customer uses the right to erasure
• Transfer slips a customer attaches to report a payment (on the booking page, and when requesting with pay-first), kept in private storage, opened through temporary links only, and deleted when the customer uses the right to erasure · for shops that turn on automatic slip checking, the system sends the slip image to a slip-checking provider (EasySlip) only to confirm it is genuine
• The account name and number a customer enters to receive a refund, used to send the refund; the booking page shows only the last 4 digits
• The name and number a customer last entered are remembered in the customer’s own browser, to fill them in next time. The “Not you? Clear” button in the form deletes them

Note: each shop is responsible for using its customers’ data lawfully, for example by telling customers what the data is used for and asking for consent where the law requires it (the request form on the online storefront already shows a notice under the phone field).

2.3 Visits to online storefronts (anonymous): when someone opens a shop’s online storefront, the system records what is done there anonymously, so the shop can see what customers are interested in and we can improve the storefront.

• Pages and outfits viewed · outfits added to the cart · search words (with anything that looks like a phone number removed) · filters chosen · pickup and return dates checked · requests sent
• How the visitor arrived, such as LINE, Instagram, Facebook or Google. Only the channel’s name is kept, not the link or the page they came from
• A random code for the browser tab, to group the events of one visit (it is gone when the tab is closed), and whether this browser has visited before (the time of the first visit stays in the visitor’s own browser and is not sent out)
• None of this is tied to anyone’s name or number, and it is deleted after 180 days

• To provide the shop management system as agreed
• To verify identity · to prevent misuse
• To send necessary notifications (pickup and return reminders, etc.)
• To show shops what customers are interested in on their storefront (from the anonymous data in 2.3)
• To improve the system and build new features
• To comply with the law (for example tax, and keeping receipts for 5 years)

We do not use your data to:

• Sell it to third parties
• Advertise to you without your consent
• Profile you to make automated decisions that affect your rights

We use infrastructure services from these providers:

• Supabase (Singapore region): database and authentication
• Cloudflare R2: storage for outfit photos and work photos
• Vercel: hosting and CDN
• LINE Messaging API: sending notifications through LINE Official Accounts
• Sentry: error monitoring (no personal data kept)
• Umami: cookie-free website statistics (counting visitors, pages opened and where visitors came from; it identifies no one and doesn’t track people across websites)
• EasySlip: checking that transfer slips are genuine (only for shops that turn on automatic slip checking; only the slip image is sent, no other customer data)
• Anthropic (Claude API): an AI provider, used in 2 places: (1) reading outfit photos to help fill in an outfit’s details (only for shops that use the quick AI outfit entry; only the outfit photos the shop picks are sent); (2) the “Buddy” how-to assistant: the questions a shop owner types are sent to write an answer, and the system automatically removes anything shaped like a customer’s identifying data (phone numbers · national ID numbers · bank account or card numbers · email addresses · LINE IDs) from the text before sending it (shop owners should avoid typing customers’ names into a question)

Each of these providers has its own privacy policy, in line with international standards (GDPR, SOC 2).

4.1 Transfers abroad (Section 28): some providers process data on servers outside Thailand (for example Supabase in Singapore · Anthropic, Vercel and Cloudflare in the United States or on global networks). We choose providers with international data protection standards (GDPR, SOC 2), so that data sent abroad has adequate protection under Section 28 of the PDPA.

We share data only:

• With your consent
• When ordered by a court or an authorised government agency
• When necessary to prevent unlawful acts

• Account data: for as long as you use the service, plus 90 days after you stop
• Financial data and receipts: 5 years (under the Accounting Act)
• Audit log: 1 year (to check for unusual use)
• Online storefront visits (2.3): 180 days
• Conversations with the AI assistant (Buddy): kept while you use the service, to improve it and to help you (customers’ identifying data is removed from the text before it is stored), and deleted when you delete your account or ask us to
• After that: permanently deleted from the database and backups within 30 days

Under the PDPA, you have these rights:

• Right of access: ask to see the data we hold about you
• Right to correction: ask us to correct data that is wrong
• Right to erasure: ask us to delete your data (within legal limits, such as receipts that must be kept for 5 years)
• Right to data portability: ask for an export of your data in a readable format (the system has an Excel export)
• Right to object: object to processing in some cases
• Right to withdraw consent: withdraw consent you gave, at any time
• Right to complain: complain to the Office of the Personal Data Protection Committee (PDPC) if you believe we have violated your rights

How to use your rights: send a request through our LINE Official Account or by email (see section 10). We will reply within 30 days.

Shops’ customers: contact the shop directly, as the shop looks after your data. If you can’t reach the shop, message us on our LINE Official Account or by email (see section 10) and we will pass your request on to the shop.

• Connections encrypted with HTTPS / TLS 1.3
• Passwords stored as hashes (bcrypt), so even we can’t see them
• National ID numbers hashed before they are stored
• Daily backups · kept for 7 days (Pro plan: 30 days)
• An audit log of every important action
• Database access limited to authorised admins

We use cookies for:

• Session cookie: keeps you logged in (necessary)
• Preference cookie: keeps display settings such as dark mode (necessary)

We don’t use: third-party tracking cookies or ad cookies

Besides cookies, our website notes how you first arrived (for example “came from Facebook”) in your own browser (local storage) for up to 90 days, to record it with your shop when you sign up. You can delete it by clearing this site’s data in your browser.

Online storefronts use no tracking cookies, but keep a few things in the visitor’s own browser, such as the cart, the name and number last entered (to fill them in next time), the tab’s random code and how the visitor arrived (2.3). You can delete them by clearing this site’s data in your browser.

We reserve the right to change this policy. We will announce important changes by email and in-app notification at least 30 days before they take effect.

For questions about personal data, or to use your rights under the PDPA, contact our team:

• LINE Official Account: Glamour Rental
• Email: hello@glamour-rental.shop
• Response time: within 30 days, as the law requires