Privacy Notice, Payment Security & Commercial License Terms

01 Data Controller & Regulatory Scope

Peemkraft Studio (“Studio”, “we”, “our”) is the Data Controller responsible for personal data collected via https://peemkraft.com in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and international privacy standards.

We practice strict data minimization: we only collect data strictly necessary to authenticate your member account, issue your commercial software license, and verify payment settlement.

02 Personal Data Inventory & Purpose

The table below details every category of data processed by Peemkraft Studio, its legal basis under PDPA Section 24, and its retention period:

Strictly Necessary Cookies & Client Web Storage (Zero Tracking)

Under GDPR ePrivacy Directive Article 5(3) and Thailand PDPA guidelines, Peemkraft Studio uses only strictly necessary first-party cookies required for security and user-requested UI preferences. We deploy zero third-party advertising, analytics, or cross-site tracking cookies:

03 Payment Security & Stripe PCI-DSS Level 1

Peemkraft Studio never touches, processes, or stores your credit card numbers, CVV security codes, or bank account credentials on our servers. All live payment transactions are handled directly on Stripe's hosted checkout infrastructure.

• PCI-DSS Level 1 Certification: Stripe is certified to the highest global compliance standard in the payments industry.
• 3D Secure (OTP) & PromptPay Push Authentication: Card payments enforce bank OTP verification, and Thai PromptPay QR payments require PIN/biometric authorization inside your official mobile banking app.
• Stripe Radar AI Protection: Transactions are screened in real time against global card-testing botnets and identity spoofing.
• Statement Descriptor: Official charges appear on your bank or card statement as PEEMKRAFT STUDIO.

04 Zero-Leak Cloud Infrastructure & Verification

Our production platform runs on Google Cloud Run (asia-southeast1) backed by Cloud SQL PostgreSQL with strict isolation and Google Cloud Secret Manager. We use zero third-party ad trackers or invasive marketing pixels.

curl -sI https://peemkraft.com/privacy-notice.html | grep -E "strict-transport|x-frame|x-content|content-type"
# Expected Production Security Headers:
# strict-transport-security: max-age=31536000; includeSubDomains
# x-frame-options: DENY
# x-content-type-options: nosniff

Every Stripe webhook event is cryptographically verified using HMAC-SHA256 before any license or downloadable archive is unlocked:

event = stripe.Webhook.construct_event(
    payload=raw_body,
    sig_header=request.headers.get("Stripe-Signature", ""),
    secret=os.environ["STRIPE_WEBHOOK_SECRET"]
)
if event["type"] in ("checkout.session.completed", "checkout.session.async_payment_succeeded"):
    db_mark_order_paid(order_code, session_id, "Paid via Stripe")

Authorized Sub-Processors & Cross-Border Data Transfers (PDPA Sec. 28 / GDPR Art. 28)

To deliver high-availability cloud infrastructure and PCI-DSS payment settlement, we engage only tier-1 infrastructure sub-processors bound by Data Processing Addenda (DPA) and EU Standard Contractual Clauses (SCCs):

05 Commercial License & Digital Goods No-Refund Policy

What Your Commercial License Grants You

• Unlimited Internal & Client Projects: You may modify, rebrand, and deploy the purchased boilerplate across unlimited commercial projects for your own company or paying clients.
• No Redistribution as a Competing Template: You may not resell, redistribute, or publish the raw boilerplate archive itself on public repositories or competing template marketplaces.
• Pre-Purchase Inspection: Every kit on our storefront features an interactive “Inspect Code” modal showing the exact file tree and module preview prior to purchase.

06 Your Rights Under Thailand PDPA & EU GDPR

Under Thailand's Personal Data Protection Act B.E. 2562 (Sections 30–36) and the EU General Data Protection Regulation (Articles 15–22), you may exercise the following rights free of charge, either immediately via our Self-Service Member Portal or by contacting us:

• Instant Self-Service Data Portability (GET /api/account/export): Click 'Order History & Downloads' in the storefront footer and select 'Export My Data (JSON)' to immediately download a machine-readable JSON archive of your profile and order ledger.
• Instant Self-Service Account Erasure & PII Anonymization (POST /api/account/delete): You may permanently delete your member account at any time from the Member Portal. Unpaid records are deleted immediately, and personal identifiers (name & email) on historical paid tax invoices are permanently anonymized while preserving non-identifiable accounting totals required under the Thai Revenue Code (PDPA Sec. 24(6) / GDPR Art. 17(3)(b)).
• Right to Rectification & Objection: Request updates to your registered email address, name, or company tax invoice details at any time.
• Right to Lodge a Regulatory Complaint (PDPA Sec. 73 / GDPR Art. 77): You have the right to file a complaint with Thailand's Office of the Personal Data Protection Committee (PDPC / สคส.) or your local EU/UK Data Protection Supervisory Authority.

07 Contact & Data Protection Officer (DPO) Channel

For any privacy inquiries, PDPA data subject requests, or commercial licensing questions, please contact Peemkraft Studio directly: