Privacy Policy

Last updated: August 2026

Bangpot ("we", "us", "the platform") operates bangpot.events, a cannabis-friendly events and venue discovery platform serving Thailand. This Privacy Policy explains what information we collect, how we use it, and your rights under Thailand's Personal Data Protection Act (PDPA, B.E. 2562).

For any questions about this policy or your data, contact us at contact@bangpot.events.

What We Collect

Information you provide directly

When you claim or register a business profile, request support, or sign up for our newsletter, we may collect:

• Business name and business type
• Contact name
• Email address
• Phone number
• LINE ID
• Instagram handle
• Business address and location details
• Profile descriptions and business information
• Payment references (transaction hash or transfer confirmation)

We do not collect personal identification documents, credit card numbers, or banking credentials.

Event RSVPs

Some events on Bangpot carry a guest list run by Bangpot. When you sign up for one, we collect:

• Your name
• Your email address
• Your Instagram handle, which is optional
• The number of guests you are bringing, if the host allows guests

We do not ask for a phone number. Signing up for an event does not create an account: there is no password, no login and no credentials, and it does not register you on the platform in any other way.

Information collected automatically

When you visit bangpot.events, the following is collected automatically through third-party services that operate in your browser:

Umami Analytics: We use Umami, a privacy-focused analytics service, to understand how people use the platform. Umami does not use cookies, does not collect personal data, and does not track individual users across sessions. Only aggregate usage data (page views, referral sources, device types) is collected.

Google Maps: Venue pages display embedded Google Maps. When a map loads, Google may collect technical data such as your IP address and device information in accordance with Google's own privacy policy.

Cloudinary: All images on the platform (venue photos, logos, event banners) are served through Cloudinary's content delivery network. Cloudinary may log standard request data (IP address, browser type) as part of content delivery.

Google Fonts: The platform loads the Inter typeface from Google Fonts. Google may log standard request data when fonts are loaded.

Supabase: The platform makes client-side API requests to our Supabase database to load venue data, events, and other public content. These requests include standard technical data (IP address, browser type). Authentication tokens are used for logged-in entity dashboard users only.

How We Use Your Information

We use the information we collect for the following purposes:

• Operating and maintaining the platform and your listing or profile
• Communicating with you about your listing, account, or support requests
• Sending transactional emails (claim confirmations, tier activations, profile updates)
• Confirming an event RSVP, sending you a calendar file, and sending up to two reminders before the event
• Giving the host of an event the guest list for that event
• Sending our newsletter (only with your explicit consent, and you can unsubscribe at any time)
• Processing payments and verifying transactions
• Improving the platform based on aggregate usage patterns
• Preventing fraud and abuse

We do not sell, rent, or trade your personal information to any third party.

Who Has Access to Your Information

The host of an event you sign up for

If you sign up for an event, the host of that event receives your name and email address, and your Instagram handle if you gave one. This is necessary to run the event you asked to attend. It happens whether or not you choose to show your handle publicly, and the sign-up form names the host before you send anything.

Co-hosts listed on the same event can see the guest list but not the email addresses on it.

Your Instagram handle appears on the event's public RSVP page only if you turn that on yourself. It is off by default, and that page is not indexed by search engines. Everyone else on the list appears simply as a guest, with no name shown.

Hosts can export their guest list as a file. Once a host has exported a list, removing yourself on Bangpot cannot reach the exported copy.

Services that process data for us

Your information may be processed by the following services as part of platform operations:

Service	Purpose	Location
Supabase	Database and authentication	United States
Netlify	Hosting and serverless functions	United States
Cloudinary	Image hosting and delivery	Global CDN
Brevo	Transactional and newsletter emails	European Union
Umami	Privacy-focused analytics	Vercel (US)
Google Maps	Map display on venue pages	United States
Google Fonts	Typography	United States
Telegram Bot API	Internal operations notifications	Global

We select services that maintain appropriate security standards. By using the platform, you acknowledge that your data may be processed in countries outside Thailand as listed above.

Data Retention

• Venue and entity profiles: Retained as long as your listing is active on the platform. If you request removal, your data will be deleted within 30 days.
• Event RSVPs: your name, email address and Instagram handle are removed 30 days after the event. An anonymous record of the RSVP is kept for attendance statistics. Nothing in this feature deletes an RSVP outright.
• Support requests: kept while we work on them, and afterwards as a record of what was asked and what was done. Your name, email address and message are anonymised 12 months after the request is resolved: the record is kept, without your details. A request to be removed from a guest list is kept on the same basis after the removal has been carried out, because it is the record that you asked and that we acted.
• RSVP abuse prevention: when an event RSVP is submitted, we record the IP address it came from so the form cannot be flooded. It is stored separately from your RSVP, is not linked to it, and is not used to identify you. These records are not yet on a retention schedule.
• Newsletter subscribers: Retained until you unsubscribe. Unsubscribing stops all emails immediately. Your details are anonymised 30 days later: the record is kept, but without your name or email.
• Payment records: Retained for the duration required by applicable tax and accounting obligations.
• Analytics data: Umami retains only aggregate, non-personal data. No individual user data is stored.

Your Rights Under the PDPA

Under Thailand's Personal Data Protection Act, you have the right to:

• Access your personal data that we hold
• Correct inaccurate or incomplete data
• Delete your personal data (subject to any legal retention obligations)
• Withdraw consent for data processing where consent was the basis
• Object to certain types of data processing
• Request portability of your data in a commonly used format
• File a complaint with the Personal Data Protection Committee if you believe your rights have been violated

To exercise any of these rights, email us at contact@bangpot.events. We will respond to your request within 30 days.

Coming off an event guest list

There are three routes, and the first needs nothing from us:

• Before the event: every RSVP email contains a cancel link. One click removes you immediately, and the link does not expire.
• After the event: the cancel link no longer cancels an attendance that already happened, so it takes you to a removal request form instead. A person reads that request and acts on it, so this route is not instant.
• Automatically at 30 days: whether or not you ask, your name, email address and Instagram handle are removed from the record 30 days after the event.

If your Instagram handle appears on an event page and you never signed up for it, use the same removal request form. We can clear the handle on its own, without cancelling anybody's place at the event.

Two limitations we would rather state than leave you to discover. Removing your details from an RSVP cannot be undone, because those details are what identified the record. And a removal request is itself kept, anonymised on the schedule above, as the record that the request was made and honoured.

Cookies

Bangpot does not set any first-party cookies. Our analytics service (Umami) is fully cookieless.

Third-party services embedded on the platform (Google Maps, Google Fonts) may set their own cookies according to their respective privacy policies. These are not controlled by Bangpot.

Children

Bangpot is not directed at individuals under 20 years of age, consistent with Thailand's legal cannabis framework. We do not knowingly collect personal data from anyone under 20. If we become aware that we have collected data from someone under 20, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.