MewNam Dashboard: Privacy Policy

This Privacy Policy describes how the MewNam product, operated by Space Salmon Co., Ltd. (a company registered in Thailand, Tax ID 0-1055-69100-32-5), referred to in this policy as “MewNam”, “we”, “us”, or “our”, collects, uses, stores, and shares personal data when you, as a venue operator or staff member, register for, access, or use the MewNam Dashboard (the “Dashboard”) and the supporting platform services (collectively, the “Service”). It also describes how MewNam processes the personal data of your customers on your behalf when you use the Service.

This policy applies to the marketing site at mewnam.com, the MewNam Dashboard at app.mewnam.com, the customer-facing LINE LIFF booking app you operate for your venue, and the systems and infrastructure that support them. The booking app has a separate privacy policy aimed at end customers.

If you don’t provide required information. Some of the information described below is required for us to create your account, perform our contract with you, or comply with Thai law. If you refuse to provide it, we may not be able to create your account, accept an invitation, process a booking, or issue a receipt that depends on that information. Where specific information is required, we tell you at the point we ask for it.

1. Roles under the PDPA

For personal data about you and your team members (Operator account data), MewNam acts as the data controller.

For personal data about your customers (their name, phone, LINE identifier, bookings, payments, and slip images), MewNam acts as a data processor on your behalf, and you remain the data controller. You are responsible for providing your own privacy notice to your customers and for collecting any consents required by law.

2. Information we collect about Operators and staff

When you sign up, accept an invitation, or use the MewNam Dashboard we collect:

• Account information: your name, email address, your role, and a record of sign-ins used to detect abuse and protect account security.
• Verification codes: we use verification codes for password reset and email change flows.
• Audit information: actions you perform inside the MewNam Dashboard, with the actor’s name. This audit trail is necessary to give your team a reliable view of who did what.
• PromptPay ID: your PromptPay number, where you choose to accept PromptPay payments.
• Technical data: basic device and connection information needed to operate and secure the Service.

3. Information you submit about your venue and customers

When you operate your venue, you submit your customers’ personal data for the Service to process on your behalf, including:

• Customer records: the information you maintain about your customers.
• Bookings and payments: booking records and the payment information associated with them, including any payment-slip images uploaded by customers.

4. How we use personal data

We use the personal data described above to:

• Authenticate Operators and staff and enforce role-based access control.
• Operate the Service: create and update bookings, send LINE notifications, store and display payment slips, and produce activity logs.
• Send system emails necessary to operate the Service. We do not send marketing emails without your opt-in.
• Detect and prevent abuse and fraud.
• Provide customer support, debug issues you report to us, and improve the Service.
• Comply with legal obligations and respond to lawful requests from public authorities.

5. Legal bases for processing

Where the PDPA or another applicable law requires a legal basis, we rely on:

• Performance of a contract with you (the Terms of Service) for account, billing, and core platform processing.
• Legitimate interests for security, abuse prevention, and Service improvement, balanced against your reasonable expectations.
• Legal obligation for retention of financial records and responses to lawful requests.
• Consent, where consent is the appropriate basis (for example, optional analytics or marketing). You can withdraw consent at any time without affecting prior processing.

6. Cookies and similar technologies

The marketing site uses only strictly necessary cookies and does not use third-party advertising or analytics cookies. The MewNam Dashboard keeps you signed in during your session and clears that when you sign out.

7. Sub-processors and recipients

We use a limited set of carefully chosen third-party providers to operate the Service. Each is bound by a written agreement that requires a level of data protection no less protective than this policy.

• Stripe (Stripe Payments): an overseas payment processor that processes your subscription billing, including invoice generation, payment collection, subscription management, payment-method storage, and dispute handling. The data we share with Stripe is limited to your name, email address, and venue identifier, together with subscription and invoice state. Any billing address, tax ID, or payment-method details are entered by you directly on Stripe’s hosted billing pages and are collected and stored by Stripe. They do not pass through our servers.
• Other service providers: we also use other carefully selected third-party providers to operate the Service, including a cloud hosting and database provider, an object-storage provider, LINE messaging delivery, an SMS provider, and an email provider.

We share customer personal data with the venue operator for whom the data was collected. We do not sell personal data to third parties, and we do not aggregate or share customer data across venues for analytics, benchmarking, or any other purpose, except where required by law.

If we propose to add or change a third-party provider in a way that materially affects how your personal data is processed, we will notify you at least thirty (30) days before the change takes effect.

8. International transfers

The Service is primarily operated from data centres in the Asia-Pacific region. Our subscription payment processor, Stripe, processes billing data overseas (including in the United States) under a data-processing addendum and standard contractual clauses. Some other third-party providers may also process limited data outside Thailand under similar safeguards. Where cross-border transfers occur, we rely on data-protection mechanisms recognised by Thai law.

9. Retention

• Operator account data is retained while your account is active and for a reasonable period after closure, unless a longer period is required by law.
• Bookings, payments, and customer records are retained for at least thirty (30) days after termination so that you can export them, after which they are deleted or anonymised, except where Thai tax or accounting law requires longer retention.
• Authentication and login-attempt logs are retained for up to twelve (12) months for security investigations, which also satisfies our log-retention obligations as a Thai online-service provider.
• Payment slip images are retained for as long as the booking exists, plus any retention period required by law.

10. Security

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, and destruction. No system can be guaranteed to be perfectly secure, and you should report any suspected vulnerability to hello@mewnam.com.

Breach notification. Where required by Thai data-protection law, we will notify the Personal Data Protection Committee within seventy-two (72) hours of becoming aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, and we will notify the affected Operator without undue delay where the breach is likely to result in a high risk.

11. Your rights

Subject to the PDPA you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion or anonymisation, where applicable;
• restrict or object to processing in defined circumstances;
• request data portability for personal data you have provided to us;
• withdraw consent where processing is based on consent;
• file a complaint with the Office of the Personal Data Protection Committee.

To exercise any of these rights for Operator account data, contact us at hello@mewnam.com. To exercise rights with respect to customer data held for a venue, contact the venue operator that controls that data; we will assist that operator on request.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page reflects the latest version. Material changes will be notified to the registered email of the venue owner at least thirty (30) days before the change takes effect.

13. Contact

For privacy questions, including PDPA requests, please contact:

• Email: hello@mewnam.com
• Registered entity: Space Salmon Co., Ltd. (Thai company, Tax ID 0-1055-69100-32-5)
• Public contact details: see Contact us