GDPR Compliance

1. Introduction

The General Data Protection Regulation applies to us because we offer Phayan to people in the European Economic Area, whatever country we operate from. It gives you a set of rights over your own data, and it does not matter whether you pay us.

This page sets out those rights and what happens when you use one. It describes what the Service actually does today, including the places where it falls short. You will find one of those named plainly below, in section 7. For the full account of what we collect, see the Privacy Policy.

2. Data Controller

For the purposes of GDPR, the data controller is:

3. Your Rights Under GDPR

If you are located in the EEA, you have the following rights regarding your personal data:

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

5. International Data Transfers

Phayan is operated from the United States, so your data leaves the EEA. It is not a possibility to be described in the conditional: it is what happens, for everyone. The providers we use, Stripe, RevenueCat, Google, Apple, Sentry, Meta, PostHog, Resend, Cloudflare, MongoDB, and Railway, are United States companies.

A transfer out of the EEA needs a legal basis of its own: an adequacy decision, the European Commission's Standard Contractual Clauses, or one of the derogations in Article 49. Which one applies is a question about a particular recipient, not a sentence we can honestly write once for all of them.

Name a recipient in the table in section 12 and write to us, and we will tell you which mechanism covers the transfer to it and give you a copy of the relevant clauses. That is your right under Article 15(2) and Article 46(1), and asking for it costs you nothing.

6. Data Retention

We retain your personal data for as long as necessary to:

• Provide the Service to you
• Comply with legal obligations (e.g., tax records for 7 years)
• Resolve disputes and enforce agreements
• Prevent fraud and abuse

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: All data is transmitted over TLS (HTTPS)
• Password hashing: Passwords are hashed using bcrypt with a high cost factor and are never stored in plain text
• Authentication: Secure JWT tokens stored in httpOnly cookies with CSRF protection
• Access controls: Strict ownership validation ensures users can only access their own data
• Rate limiting: API rate limiting to prevent abuse
• Input validation: All user input is validated and sanitized to prevent injection attacks
• Error monitoring: Sentry, and the two halves of it are not configured alike. The code running on your device sends your user ID and nothing else that names you: no email address, no display name, no IP address. Our servers are configured to include personal data rather than strip it: a server-side report carries your IP address and, if you are signed in, your user ID and your email address. We remove share links from either report, because those are credentials, and nothing else.

We say that last one plainly because a page like this usually claims the opposite. The half that runs on your device was the half worth changing, because that is the one that reaches into your browser; the server half sees your IP address because every request you make arrives with one. Knowing who hit an error is part of being able to fix it, and where we still collect that, it is a choice we made rather than an absence of data; you are entitled to know which.

8. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware
• Notify affected individuals without undue delay if there is a high risk
• Provide information about the nature of the breach and remedial actions

9. Children's Data

Article 8 sets the age at which a child can consent to an online service on their own at 16, and lets each Member State lower it, but never below 13. In the EEA we follow whichever age your own country has set. Everywhere else we require 13. Below that age, an account needs a parent or guardian.

We do not ask your age and we do not verify it. There is no birth-date field at sign-up and no age check anywhere in the Service, so the requirement above rests on you and, where it applies, on your parent or guardian. Nothing in Phayan is designed for children, but a Thai-alphabet course can plainly interest one.

If you are a parent or guardian and an account belongs to a child below the age that applies where you live, tell us and we will delete it; you do not have to prove anything first, and the child does not have to be signed in. Deleting the account removes their learning data as described in section 6.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Any automated processing we perform is used only to improve the Service and does not result in decisions that affect your rights.

Examples of automated processing we use:

• Spaced-repetition scheduling: Your drill answers set the next review date for each letter and word (1/3/7/21-day ladder)
• Tone accuracy statistics: Aggregated tone-drill results shown back to you in the course index
• Progress sync: Per-round merge of your progress tree between your own devices

11. Learning Progress Processing

Phayan has no public profiles and no user-to-user content sharing. Your learning progress is processed only to run the Service for you:

• Progress storage: Completed rounds, drill answers, and tone statistics are stored on your account
• Review queue: Your spaced-repetition schedule determines which letters and words appear in your due queue
• Device sync: When you sign in, your progress tree merges with the version on our servers so your devices stay in step
• Transfer links: If you learned something before making an account, you can move it across with a link. That link is the key: whoever opens it claims the progress, so send it only to yourself. It works once and stops working after 72 hours, and we store only a hash of it, never the link itself.

This processing is necessary for the contract between you and us (GDPR Article 6(1)(b)) and never results in profiling or automated decisions with legal effects. Your progress is never shared with other users.

12. Third-Party Processors

These are the companies that handle your data on our behalf. There are no others. The third column is where the company itself is, which is why section 5 matters: everything on this list is a transfer out of the EEA.

We do not sell your data and we do not hand it to anyone not on this list. Each of these companies may use what it receives only to do the job described next to its name.

13. How to Exercise Your Rights

To exercise any of your GDPR rights:

For one of these rights you do not have to write to anyone: deleting your account is a button in your account settings, it does not open a ticket, and what section 6 says is deleted is deleted at that moment.

Where you write to us instead, we may need to be satisfied that the account is yours. That is a check on identity, not a hurdle: if you are signed in, being signed in is the check.

14. Updates to This Page

We may update this GDPR compliance page from time to time. We will notify you of significant changes by updating the "Last Updated" date and, where appropriate, sending you an email notification.