Privacy Policy

Last updated 9 October 2026

Eatolist collects and uses your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019). This document explains what we collect, what we use it for, how long we keep it, and what you can ask us to do.

1. What we collect

• Account data — depends on how you sign in: LINE gives us your user ID, display name, profile photo and email (if you allow it on LINE's screen) · Google gives us your user ID, name, email and profile photo · Apple gives us your user ID and email (which may be an Apple hidden email). We store no passwords, because this system has no passwords.
• Contact number — requested when you first book, used by the Eatolist team to contact you about your bookings. It is not used to verify your identity and not used for advertising. Shops do not see it, except for deals that require a table reservation, which you consent to each time you reserve (see section 4).
• Preferences — the cuisines you picked when signing up.
• Location — your approximate coordinates when you open the app, used to sort nearby shops and rank the feed. We do not keep a history of where you travel.
• Content you create — clips, photos, captions, comments, shop ratings and reviews, saved lists.
• Usage — clips you watch, like and save, and people you follow, used to tailor the feed to you.
• Bookings and payments — your bookings, booking fee amounts, and the transfer slips you upload.
• Payout details (creators only) — bank name, account name and the full account number, kept so we can transfer your earnings to you, with a copy kept on each withdrawal request as a record of where that money was sent.
• Device — a token for sending notifications, and your device's operating system.

2. What we use it for

• Providing the core service — signing you in, showing the feed, finding shops, booking deals, and redeeming them at the shop.
• Ranking the feed and nearby shops to match your preferences and location.
• Calculating and paying the share owed to creators whose clips led you to book.
• Sending the notifications you have turned on in Settings.
• Reviewing reported content and preventing misuse.
• Complying with the law, such as keeping accounting records.
• We do not sell your personal data to anyone, and we do not use your data for third-party advertising.

3. Our legal bases

• Performance of a contract — account, booking and payment data are necessary to provide the service you ask for.
• Consent — location and notifications. You can withdraw it any time in your device settings or in the app.
• Legal obligation — accounting records the law requires us to keep.
• Legitimate interest — fraud prevention and reviewing reported content.

4. Who we share it with

• Shops you book with — see your booking only as far as needed to serve you (display name and booking details). Shops do not see your phone number.
• Shops you reserve a table with — if the deal requires a table reservation, the shop (its owner and shop managers) sees your display name, contact number, the reserved date and time and party size, only to contact you about that table. You consent each time you reserve. The shop can see your number only while the booking is still valid and for no more than a few hours after the reserved time; after that it is hidden from the shop. Shops must not use it for advertising or keep it for any other purpose (Merchant terms 7/1).
• Other users — see only what you post publicly: clips, photos, comments, reviews, display name, and lists you set to public.
• Service providers we use — our database and file storage (Supabase) and notification delivery (Expo), all processing only on our instructions.
• Sign-in providers — LINE and Apple will know you signed in to Eatolist, because you chose to link the account. We do not send your usage data back to them.
• Government authorities — when there is a warrant or lawful order.

5. How long we keep it

• While you use the service — kept for as long as your account exists.
• Contact number — deleted with your account when you request deletion. It is not among the records accounting law requires us to keep.
• When you request account deletion — we wait 30 days before actually deleting, and you can cancel during that time. After that we delete your phone number, name, photo, bio, preferences, viewing history, likes, saves, follows, reviews and notification tokens, along with the clip and photo files in storage.
• What we must keep even after you delete your account — bookings, amounts and transfer slips are accounting records that the Accounting Act B.E. 2543 (2000) requires us to keep for at least 5 years. We remove the link to you, so those records can no longer identify you.
• Clips and comments others refer to — we delete the content itself but keep the structure so other people's conversations don't break. Others will see “Comment deleted”.

6. Your rights

• Access and copy (Sections 30, 31) — request a file of your data from Settings. The system compiles it into a file that can be read and reused.
• Correction (Section 36) — edit your name, photo and bio yourself from Edit profile. Your contact number can be changed on your next booking.
• Erasure (Section 33) — request account deletion from Settings, with a 30-day grace period.
• Withdraw consent (Section 19) — turn off location in your device settings and notifications in the app. Withdrawing consent does not affect processing already lawfully carried out.
• Object or restrict processing (Sections 32, 34) — contact us using the details below.
• Complain — if you believe we have acted wrongly, you can complain to the Office of the Personal Data Protection Committee (PDPC).

7. Security

• Data travels encrypted, and can be accessed only as far as your account is permitted, through row-level access rules in the database.
• We store no passwords at all, because the system has none — you sign in with LINE, Google or Apple.
• Creators' bank account numbers are stored in full because transfers need them. They can be read only by the account owner, through row-level access rules, and by team members with admin rights only as needed when checking and making transfers. Regular screens show only the last 4 digits.

8. Children and minors

• This service is for people aged 20 or over. A minor who wants to use it needs consent from the person exercising parental authority, under Section 20.
• If we find an account belonging to a minor without that consent, we will suspend it and delete its data.

9. Contact us

• The data controller can be contacted at contact@eatolist.app
• If you want to exercise your rights under section 6 or have questions about this policy, contact us using the details above. We will respond within 30 days as the law requires.

This page lives at https://eatolist.app/en/privacy and matches the text shown in the app.