Privacy Policy

Effective date: 2026-07-02 · Updated: 2026-08-14 · Version 1.2

Data Controller: Wanisa Yodsri (วณิษา ยอดศรี), operating as GlobMaps Climate Intelligence

Contact: privacy@globmaps.com | Postal address: in progress — email is the primary contact channel

The English version of this document is the legally authoritative version; translations are provided for convenience.

Introduction

This Privacy Policy explains how GlobMaps Climate Intelligence ("we," "us," "Operator") collects, uses, stores, and protects your personal information when you use our API, Dashboard, and related services ("Service"). This policy is issued in accordance with: • พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562 (Thai PDPA) • Malaysia Personal Data Protection Act 2010 (Act 709) • Vietnam Personal Data Protection Decree (Nghị định số 13/2023/NĐ-CP) • India Digital Personal Data Protection Act 2023 (DPDP Act) • General Data Protection Regulation (EU) 2016/679, to the extent applicable

1. Who We Are (Data Controller)

The Data Controller is Wanisa Yodsri (วณิษา ยอดศรี), an individual operating under the trade name "GlobMaps Climate Intelligence." For privacy-related inquiries or to exercise your rights, contact: privacy@globmaps.com

2. Personal Data We Collect

We collect only the data necessary to provide the Service. 2.1 Data you provide directly: • Email address — account creation, service notifications, password reset (required) • Full name — account personalization (optional) • Payment information — processed by Stripe; we never store full card numbers, we receive last 4 digits and expiry only (required for paid plans) • Country/region — verifying geographic eligibility; tax compliance (required) • Organization/affiliation — understanding use-case context (optional) 2.2 Data collected automatically: • API call logs (timestamp, endpoint, response code, IP address) — rate limiting, billing, debugging, abuse prevention (kept 12 months) • Browser/device type — service compatibility, security (12 months) • Login events (timestamp, IP) — security monitoring (12 months) • Usage analytics (features accessed, session duration) — service improvement (24 months; aggregated after 12 months) 2.3 Data we do NOT collect: • No precise geolocation beyond country-level. • No biometric data, health data, political opinions, religious beliefs, or other sensitive categories under PDPA Section 26. • No data about users' clients or end-users. • Our climate data (drought/flood risk indices) is served from pre-computed datasets — it does not contain any personal data of Service users.

3. Lawful Basis for Processing (Thai PDPA มาตรา 24)

• Account creation and management — Contract (necessary to provide the Service) — มาตรา 24(3) • Processing payments — Contract (necessary for billing) — มาตรา 24(3) • API access and rate limiting — Contract (necessary to deliver and enforce subscription terms) — มาตรา 24(3) • Service-related notifications — Contract (necessary to manage our service relationship) — มาตรา 24(3) • Service improvement and analytics — Legitimate Interests (improving service reliability and features) — มาตรา 24(5) • Marketing emails and product updates — Consent (you must opt in separately; you can withdraw at any time) — มาตรา 24(1) • Legal compliance (e.g., tax records) — Legal obligation — มาตรา 24(6) Important for B2C users: marketing communications require your explicit opt-in consent, which you provide by checking the optional marketing checkbox during signup or at any time in your account settings. This consent is separate from acceptance of the Terms. You may withdraw it at any time without affecting your access to the Service.

4. How We Share Your Data

We do not sell your personal data. We share data only as described below. 4.1 Service providers (data processors): • Stripe Inc. — payment processing — email, payment card details, billing address — USA (Standard Contractual Clauses for international transfer) • Server infrastructure — API hosting and database — account data, API logs — Europe/Singapore region (encrypted at rest) • Cloudflare R2 — climate data file storage — none: only pre-computed climate datasets, no personal data — Western Europe (WEUR) • Resend — transactional email — email address, name — USA (SCCs applicable) All service providers are contractually required to process data only on our instructions and to maintain appropriate security measures. Stripe's Data Processing Agreement is available at stripe.com/legal/dpa. 4.2 Legal requirements: we may disclose personal data when required by Thai law, court order, or lawful request from a government authority, or when necessary to protect our legal rights. 4.3 Business transfers: if the Service is transferred to another operator, your personal data may transfer as part of that transaction. We will notify you in advance and, where legally required, seek your consent.

5. International Data Transfers

The Operator is based in Thailand. Your data is hosted on servers in the Europe/Singapore region. When data is transferred to countries outside Thailand (e.g., to US-based Stripe, Resend), we rely on: • Standard Contractual Clauses (SCCs) approved by the European Commission • Stripe's standard DPA (stripe.com/legal/dpa) • Resend's standard DPA India users (DPDP Act 2023 — s.16): data stored in Singapore is covered under DPDP whitelist provisions. No India data localization requirement applies to climate API usage data.

6. Data Retention

• Account data (email, name) — duration of active account + 3 years after closure (for legal/tax records) • Payment records — 5 years (Thai accounting law — พรบ. การบัญชี พ.ศ. 2543) • API usage logs — 12 months rolling • Marketing consent records — duration of account + 3 years • Data subject request records — 3 years from date of request • Aggregated analytics — indefinitely (anonymized — not personal data) After the applicable retention period, personal data is deleted or irreversibly anonymized.

7. Your Rights as a Data Subject

Under Thai PDPA (มาตรา 30–36), Malaysia PDPA, Vietnam PDPL, and India DPDP Act, you have the following rights: • Right to Access — request a copy of the personal data we hold about you — email privacy@globmaps.com • Right to Rectification — request correction of inaccurate or incomplete data — email or account settings • Right to Erasure — request deletion of your personal data (subject to legal retention obligations) — email privacy@globmaps.com • Right to Restrict Processing — request that we temporarily halt processing while a dispute is resolved — email privacy@globmaps.com • Right to Data Portability — receive your data in a structured, machine-readable format (JSON/CSV) — email privacy@globmaps.com • Right to Object — object to processing based on Legitimate Interests — email privacy@globmaps.com • Right to Withdraw Consent — withdraw marketing consent at any time — unsubscribe link in emails OR account settings India users: under DPDP Act 2023, you also have the right to nominate a representative and the right to grieve. Contact: privacy@globmaps.com (SLA: 48 hours acknowledgement, 30 days resolution). How to submit a request: email privacy@globmaps.com with subject line "Data Subject Request — [your request type]". We will respond within 30 days. We may request identity verification before fulfilling the request. Complaints — you may lodge a complaint with: • Thailand: สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล (PDPC Thailand) — pdpc.or.th • Malaysia: Personal Data Protection Commissioner — pdp.gov.my • Vietnam: Ministry of Public Security — bca.gov.vn • India: Data Protection Board of India (when constituted) • EU/EEA: your local Data Protection Authority

Rights of Indian Data Principals (DPDP Act 2023)

If you are located in India, the Digital Personal Data Protection Act, 2023 ("DPDP Act") grants you the following rights regarding your personal data: • Right to Information: You may request information about the personal data we process about you. • Right to Correction & Erasure: You may request correction of inaccurate data or erasure of data no longer needed for the stated purpose. • Right to Grievance Redressal: You may raise a grievance with our designated contact (below). We will acknowledge within 48 hours and resolve within 30 days. • Right to Nominate: You may nominate another individual to exercise these rights on your behalf in the event of death or incapacity. Grievance Contact Email: privacy@globmaps.com Subject line: "DPDP Grievance — [Your Name]" Response SLA: Acknowledgement within 48 hours; Resolution within 30 days. Data Transfers Outside India Your data is processed on servers in Singapore (AWS ap-southeast-1). Under DPDP Act Section 16, we may transfer your data outside India to countries not restricted by Government notification. No such restriction currently applies to Singapore. Children Our services are available only to persons aged 18 years or above. If you are under 18, please do not use our services.

8. Security

We implement technical and organizational security measures appropriate to the sensitivity and volume of personal data we process, including: • HTTPS encryption for all data in transit • Encrypted storage for sensitive data at rest • Access controls limiting access to personal data • Regular security monitoring of API logs In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (PDPC Thailand) within 72 hours of becoming aware of the breach.

9. Cookies and Tracking

We use minimal cookies necessary to operate the Service (session cookies, authentication). We do not use third-party advertising cookies. Analytics: we use privacy-respecting analytics to understand aggregate usage patterns. These analytics do not track you across other websites and do not collect personal data beyond aggregate counts.

10. Children's Privacy

The Service is not directed to persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact privacy@globmaps.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent notice in the Service at least 14 days before they take effect. The updated policy will be available at climate.globmaps.com/privacy with the new effective date.

12. Contact

For any privacy-related questions, data subject requests, or complaints: Wanisa Yodsri (วณิษา ยอดศรี) GlobMaps Climate Intelligence Postal address: in progress — please contact by email Email: privacy@globmaps.com Response time: within 30 days