Legal
Privacy Policy
Last updated: 23 September 2026
PetScent ("we", "our", "us") takes your privacy seriously. This policy explains what data we collect when you use thepetscent.com, why we collect it, who we share it with, and the rights you have under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and equivalent laws.
1. Who we are
PetScent is operated from Bangkok, Thailand. For any data-related question you can reach us at admin@thepetscent.com.
2. What data we collect
We only collect what we need to sell you pet care products and run our business properly.
- Account information — your name, email address, phone number, and a hashed password (we never see your real password).
- Order information — shipping address, billing address, items ordered, order total.
- Payment information — handled entirely by Stripe. We see only the last 4 digits of your card and the payment status; we do not store full card numbers, CVCs, or PromptPay PINs on our servers.
- Communications — anything you send us by email or LINE.
- Technical data — IP address, browser type, device info, pages viewed, time spent. Collected automatically via Vercel and Supabase logs to keep the site working and detect abuse.
- Analytics data — which pages were opened, in what order, and whether a visit ended in an order. Collected only after you accept analytics cookies, and never tied to your name or address. See §8.
- Cookies — small text files used for your login session, your language, your cookie choice, and — only with your consent — analytics and advertising. See §8 for the full list.
- Advertising data — only if you switch on advertising cookies: which pages you viewed, what you added to the cart, and whether you bought, sent to Meta so we can measure our ads. For an order, your email and phone number go to Meta as a one-way SHA-256 hash, never in clear. See §4 and §8.
3. Why we use your data (legal basis)
- Fulfilling your order — necessary to perform our contract with you.
- Account management — necessary to provide the service you signed up for.
- Customer support — to answer your questions.
- Order updates and security notifications — legitimate business interest.
- Marketing emails or LINE messages — only with your explicit consent. You can unsubscribe at any time.
- Fraud prevention and security — legitimate interest to protect customers and our business.
- Legal compliance — tax records, accounting, response to lawful requests.
4. Who we share data with
We share your data only with processors who help us run the service. Each is bound by their own privacy commitments:
- Stripe, Inc. — payment processing (United States, PCI-DSS Level 1 certified)
- Supabase, Inc. — database and authentication hosting (United States, with EU data centers available)
- Vercel Inc. — website hosting and CDN (United States)
- Resend, Inc. — transactional email delivery (United States)
- Google LLC (Google Analytics 4) — website analytics (United States). Loaded only after you accept analytics cookies; until then it runs in Google Consent Mode v2 with
analytics_storagedenied and no tag is fetched at all. - Vercel Inc. (Vercel Web Analytics) — page and traffic analytics, cookieless (United States). Loaded only after you accept analytics cookies.
- Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API) — advertising measurement on Facebook and Instagram (Ireland and the United States;
connect.facebook.net,facebook.com,graph.facebook.com). Loaded only after you switch on advertising cookies; until then no Meta script is fetched and Google Consent Mode keepsad_storage,ad_user_dataandad_personalizationdenied. A purchase made with advertising cookies on is also reported by our server, with your email and phone hashed. - Google Fonts — font delivery (caches a record of your visit)
- Thai shipping carriers — for delivery of your physical orders
- Government authorities — only when required by Thai law
We do not sell your data to anyone. Ever.
5. How long we keep your data
| Orders and tax documents | 7 years — Thai accounting and revenue rules can require a sale to be evidenced for that long. |
|---|---|
| Account data | Until you ask us to delete it, or 3 years of inactivity. |
| Analytics events (first-party) | 24 months at the outside. In practice the database prunes them automatically at 400 days. |
| Google Analytics data | Held by Google under the retention setting on our GA4 property. |
| Meta advertising data | Held by Meta under its own retention rules for Pixel and Conversions API data. |
| Newsletter subscription | Until you unsubscribe. |
| Consent records | Kept as the proof that consent was given or refused, with the version of this policy it was given against. |
| Communications | 2 years from last contact. |
6. Your rights under PDPA
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your data (subject to legal retention requirements)
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent for marketing or other consent-based uses
- File a complaint with the Personal Data Protection Committee of Thailand
To exercise any of these rights, email admin@thepetscent.com. We answer every request within 30 days. We may ask you to confirm the email address an order was placed with before we send data back, so that we do not hand your order history to someone else.
PetScent has not appointed a Data Protection Officer. We are a small shop: we do not monitor personal data on a large scale and we do not process sensitive data as a core activity, so sections 41–42 of the PDPA do not require one. The address above reaches the founder directly.
7. How we protect your data
- All connections to the site use HTTPS (TLS 1.3)
- Passwords stored with bcrypt hashing — never in plain text
- Database access controlled by Row Level Security policies
- Card data never touches our servers (handled by Stripe)
- Strict access controls — only the founder and authorized staff can view customer data
- Regular security headers (CSP, HSTS, X-Frame-Options) on every page
8. Cookies
Essential cookies run the shop and need no consent — without them you cannot stay logged in or hold a choice. Analytics and advertising cookies are two separate switches on the bar at the bottom of the page, both off until you turn them on; "Accept all" turns on both. Press "Essential only" and no analytics or advertising script is loaded at all: not Google's, not Vercel's, not Meta's, not our own.
petscent_consent | Essential · 12 months · your answer to the cookie bar, so we stop asking. |
|---|---|
sb-* (Supabase) | Essential · length of the session · keeps you logged in. |
NEXT_LOCALE | Essential · session · the language you chose. |
tps_vid | Analytics · 12 months · a random id that lets us count a returning visitor as one person. Set only after you accept. |
_ga, _ga_* | Analytics · 24 months · Google Analytics 4. Set only after you accept. |
| Vercel Web Analytics | Analytics · no cookie · counts page views without storing anything in your browser. Loaded only after you accept. |
_fbp | Advertising · 90 days · Meta Pixel browser id. Set only after you switch on advertising cookies. |
_fbc | Advertising · 90 days · which Facebook or Instagram ad click brought you here. Set only after you switch on advertising cookies. |
Your shopping cart is not a cookie at all — it is kept in your browser's local storage and never sent to us until you check out. Advertising cookies are Meta's only, and only with your yes. To change your answer at any time, use Cookie settings at the bottom of any page: it forgets your choice, clears the analytics and advertising cookies, and brings the bar back.
9. Children's privacy
Our site is intended for adults purchasing pet care products. We do not knowingly collect data from anyone under 20. If you believe a minor has provided us data, contact us and we will delete it.
10. International data transfers
Some of our service providers are located outside Thailand (primarily the United States). When we transfer your data to them, we rely on the providers' own PDPA, GDPR, or equivalent compliance frameworks to ensure adequate protection.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will tell you when. For significant changes, we'll email registered customers in advance. This is version 2026-09-23; every consent we record is stamped with the version in force when it was given.
12. Contact us
For any privacy question, request, or complaint:
Email: admin@thepetscent.com
LINE: @thepetscent