Privacy Policy
Last updated: 2026 · Preliminary — to be finalized before public launch.
Who we are
ThisIsWhite provides analytics and AI guidance for online sellers. For your account and usage data we are the data controller. For the buyer data inside files you upload or channels you connect, you are the controller and we act as your data processor, processing it only on your instructions.
What we collect
Account details (name, email), the sales and social data you connect or upload, and usage data to operate and improve the service. By default we strip direct personal identifiers (buyer name, phone, address, postcode, national ID) from uploaded order data at import — buyer personal information is not stored at rest unless you explicitly enable retention (see below).
Legal basis
We process your account data to perform our contract with you and for our legitimate interest in operating and securing the service. We process buyer data solely on your documented instruction as our Data Processing Agreement describes; you are responsible for having a lawful basis to share it.
How we use it
To provide the dashboards and AI insights you request, to operate and secure the service, and to communicate with you. We do not sell your data. Our AI features only ever process pre-computed, non-personal metrics — your buyers' personal data is never sent to any AI provider.
Optional buyer-data retention
Retention of buyer personal data is off by default. You may choose to enable it, per category (contact details, address), to unlock advanced features. National identification numbers are never stored. Retained data is encrypted and access-restricted. You can turn retention off at any time, which permanently deletes the buyer data we held; enabling it applies only to future imports.
Who processes data for us
We use trusted sub-processors to run the service: Supabase (database and hosting), Vercel (application hosting), and Google (AI processing of non-personal metrics only). They are bound by agreements consistent with the PDPA. A current list is available on request.
International transfers
Some sub-processors operate infrastructure outside Thailand. Where data is transferred abroad we rely on safeguards consistent with the PDPA.
Data isolation & retention
Each customer's data is isolated at the database level. We retain data per your plan's retention window, roll it up to aggregates, then delete the detailed records. We warn you before data ages out.
Your rights
You can access, correct, export, object to, or delete your data, and withdraw consent. Requests to delete are carried out as a real deletion, not just archiving. Under Thailand's PDPA and the EU GDPR you have additional rights; contact us to exercise them. You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.
Security & breaches
We protect data with database-level isolation, encryption, and access controls and logging. If a personal-data breach occurs, we will notify affected controllers without undue delay, within 72 hours where required.
Contact
Privacy questions and data requests: privacy@thisiswhite.com. The competent authority is the Personal Data Protection Committee (PDPC), Thailand.