Privacy Policy

1. Who We Are

This Privacy Policy is issued by Actualizentral Co., Ltd. ("Actual Life", "we", "us"), a company registered in Thailand and the operator of the Actual Life game, Keeper coaching service, book, and related products.

Registered address: 998/28 Thonglor Road, Klongton Neau, Wattana, Bangkok 10110, Thailand

Privacy contact: ask.actuallife@gmail.com

We are the "data controller" for personal data we collect through actuallife.me, actuallifegame.com, our Netlify-hosted web apps, and related channels.

2. What Data We Collect

Information you give us

• Waitlist / contact forms: name, email address, phone number, and any message you send.
• Board game orders: shipping address, billing address, and order details.
• Keeper subscription (coming soon): your aspirations, goals, and personal context you choose to share for coaching.
• Community map (optional): your country or region, if you choose to put yourself on the map.

Information collected automatically

• Game progress (local only): your in-game state — cards drawn, decisions made, stats — is stored in your browser's localStorage on your own device. It never leaves your device unless you explicitly sign into an account (feature planned for later release).
• Language preference: we store whether you chose English or Thai in localStorage so we remember for next time.
• Basic server logs: our host (Netlify) keeps standard web server logs — IP address, browser type, pages visited, timestamps — for up to 30 days for security and performance.

What we DO NOT collect

• Payment card details. Stripe processes all payments. We only receive confirmation that a transaction succeeded. We never see your card number, CVV, or expiry date.
• Sensitive personal data (health, religion, political views, biometrics, etc.) unless you volunteer it in Keeper and explicitly consent.
• Third-party tracking. We do not use Google Analytics, Facebook Pixel, or any advertising trackers at launch.

3. Why We Collect Your Data

We use your personal data only for purposes you would expect:

• Deliver the product or service you requested (board game shipment, Keeper coaching, book purchase confirmation).
• Notify you when the board game is back in stock, if you joined the waitlist.
• Respond to your messages and customer support requests.
• Improve the game and service (based on aggregated, non-identifying patterns).
• Send occasional product updates if you opted in. You can unsubscribe any time.
• Comply with Thai law (tax records for purchases, etc.).

We will never use your data for purposes you did not consent to.

4. Legal Basis (Thailand PDPA)

Under Thailand's Personal Data Protection Act B.E. 2562 (2019), we process your data under the following legal bases:

• Consent (มาตรา 19): when you fill in a form, opt into a newsletter, or share context in Keeper.
• Contract (มาตรา 24(3)): when you buy the book or board game, we need your data to fulfill the order.
• Legitimate interest (มาตรา 24(5)): for fraud prevention, security logs, and basic product improvement.
• Legal obligation (มาตรา 24(6)): tax records, accounting law, and lawful government requests.

5. Who We Share Data With

We do not sell your personal data. We share the minimum necessary with trusted service providers:

• Netlify, Inc. (USA) — website hosting and waitlist forms.
• Stripe, Inc. (USA) — payment processing. Stripe is certified PCI-DSS Level 1.
• Amazon Kindle Direct Publishing — for book purchases via Amazon. Your purchase data is governed by Amazon's Privacy Notice.
• Shipping carriers (Thailand Post, Kerry Express, etc.) — address and recipient name for board game delivery.
• Accountants and tax authorities — as required by Thai accounting and tax law.
• Law enforcement — only when compelled by valid Thai legal process.

6. International Data Transfers

Some of our service providers (Netlify, Stripe, Amazon) are based outside Thailand. Your data may be processed in the United States or other countries. When we transfer data outside Thailand, we ensure the destination country has adequate data protection standards, or we use contractual safeguards consistent with PDPA Chapter 3.

7. How Long We Keep Your Data

• Waitlist / marketing: until you unsubscribe, or 2 years of no activity — whichever comes first.
• Order records: 10 years, as required by Thai Revenue Code.
• Keeper account data: while your account is active, plus 90 days after closure to allow recovery.
• Server logs: 30 days (Netlify default).

8. Your Rights Under PDPA

You have the following rights concerning your personal data. We will respond within 30 days:

• Right to access (มาตรา 30): request a copy of the data we hold about you.
• Right to rectification (มาตรา 35): ask us to correct inaccurate data.
• Right to erasure (มาตรา 33): ask us to delete your data when no longer necessary.
• Right to restrict (มาตรา 34): ask us to pause processing in certain cases.
• Right to data portability (มาตรา 31): receive your data in a machine-readable format.
• Right to object (มาตรา 32): object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent (มาตรา 19): withdraw consent at any time. We stop processing immediately.
• Right to complain: lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe we have violated PDPA.

To exercise any of these rights, email us at ask.actuallife@gmail.com with the subject line "PDPA Request".

9. How We Keep Your Data Safe

• Encryption in transit: all pages served over HTTPS (TLS 1.2+).
• Encryption at rest: databases and form submissions are encrypted on disk by our service providers.
• Access controls: only authorized Actual Life staff can access personal data, and only when necessary.
• Payment security: Stripe, not Actual Life, handles all card data. Stripe is PCI-DSS Level 1 certified.
• Breach notification: in the unlikely event of a data breach, we will notify the PDPC within 72 hours and affected users as soon as practicable, as required by PDPA Section 37.

No online service can guarantee 100% security. We use reasonable and appropriate measures to protect your data.

10. Children's Privacy

Actual Life is designed for users aged 18 and above. We do not knowingly collect personal data from children under 18 without parental consent. If you are under 20 (the age of majority in Thailand), you should have your parent or guardian review and agree to this policy before using our services. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

11. Cookies and Local Storage

We use a very small number of browser storage items, all strictly necessary:

• Language preference (localStorage) — remembers your EN/TH choice.
• Game progress (localStorage) — your in-game state on your own device. Never sent to our servers.
• Netlify anti-spam cookies — used on form submissions to prevent bot abuse.

We do not use advertising, analytics, or third-party tracking cookies at launch. You can clear browser storage any time via your browser settings.

12. Changes to This Policy

We may update this Privacy Policy as our services evolve. If we make material changes, we will notify users by email (for those who opted in) and post a notice on the website at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent version.

13. Contact Us

Questions, concerns, or PDPA requests? Reach us here:

Actualizentral Co., Ltd.
998/28 Thonglor Road, Klongton Neau, Wattana
Bangkok 10110, Thailand
Email: ask.actuallife@gmail.com

To contact the Thailand Personal Data Protection Committee (PDPC), visit www.pdpc.or.th.