Privacy Policy

TOBULAB CO., LTD., registered in Thailand (registration number 0405569004251), is the controller of the personal data described here.

178/90 Prachasamoson Road, Soi 20/1, Nai Mueang Subdistrict, Mueang Khon Kaen District, Khon Kaen 40000, Thailand

For any privacy request or question, email pasinto.js@gmail.com.

We handle personal data in line with the laws that apply to our users, including the EU and UK GDPR, California’s CCPA/CPRA and Thailand’s Personal Data Protection Act.

What you enter yourself

• Birth date, birth time, birthplace and gender.

Payment information

• Order reference, amount, currency and status.
• We never see or store your card number. It is entered on Stripe’s own page and never passes through our servers.
• Email address (only if you enter it) — used to send your receipt and access link, and to verify you when you need to recover access. You can remove it from your account page.

Cookies and measurement

We always use the cookie that is strictly necessary for the service to work (a signed session that ties your paid access to this browser). Analytics and advertising cookies (Google Analytics 4 and Meta Pixel) run only after you accept them on the banner. When active, they collect the pages you view, purchase events, cookie identifiers, your IP address and browser user agent; if you enter an email at checkout it is hashed before it is sent. This data is processed by Google and Meta, which operate servers outside your country, and the transfer relies on your consent. The consent cookie lasts 180 days. You can change your mind at any time with the “Cookie settings” button at the bottom of the page — if you decline or withdraw, collection stops immediately and the whole site keeps working.

What we do not store

• If you only look at your chart without buying, we save nothing to our database — the chart is calculated for that page view only.
• When you compare with a friend or partner, their birth details are calculated for that view and are not stored in our database. We have no contacts list and no directory of people.
• Request logs. Birth details travel in the page address, so they can appear in the logs of our hosting provider, Cloudflare: request logs, deleted automatically within 7 days, and sampled security and traffic records, kept for up to 31 days. They are not saved to our database or to any account. We use these logs only to keep the service running and to fix errors.

We use your birth details to infer personality traits, so we treat them — and the chart and report derived from them — as sensitive personal information, even though not every law classifies them that way. Thailand’s PDPA does, and we apply the same standard to everyone.

That is why checkout asks for two separate consents: one to store and use your personal data in general, and one specifically to process the sensitive information. They are not combined into a single tick box.

• Calculate your chart and assemble your report — your consent, given at checkout (GDPR Art. 6(1)(a)); explicit consent for the sensitive processing.
• Open your access and prevent double charges — necessary to perform the contract with you (Art. 6(1)(b)).
• Keep accounting and tax records — legal obligation (Art. 6(1)(c)).
• Keep the service secure and prevent abuse — our legitimate interest (Art. 6(1)(f)).
• Analytics and advertising measurement — your consent via the cookie banner.

We do not sell your data. If you accept analytics/advertising cookies, measurement data (including your IP address, browser identifier and a hashed email) is sent to Google and Meta to measure ad campaigns; decline them and nothing is shared.

Only what is needed to run the service:

• Cloudflare — hosting, network delivery, request logs and the database (Workers and D1).
• Stripe — payments. Stripe does not receive your birth details; the payment session may carry measurement data such as IP address and browser identifier in its metadata.
• Resend — sends transactional email (receipt, access link, verification code) to the address you entered.
• Google (Analytics) and Meta (Pixel / Conversions API) — advertising and analytics measurement, only if you accept the cookie banner.

Some of these providers process data outside your country, including in the United States. Where required, transfers rely on safeguards such as Standard Contractual Clauses or adequacy decisions put in place by those providers.

• Birth details and the calculated chart — kept while your access exists; deleted immediately when you ask.
• Payment records — kept as long as accounting and tax law require (generally five years in Thailand), even after you delete your data. Those rows contain no birth details.
• Access cookie — expires on its own after 30 days.
• Receipt access link — valid for 90 days from purchase.
• Consent cookie (analytics/advertising choice) — expires after 180 days, or is removed at once when you use “Cookie settings”.
• Request logs at Cloudflare (page addresses, which can include birth details) — request logs are deleted automatically within 7 days; sampled security and traffic records are kept for up to 31 days.

Depending on where you live (GDPR / UK GDPR, CCPA/CPRA, Thailand PDPA and similar laws), you can:

• access the data we hold about you and get a copy in a machine-readable format;
• correct data that is wrong;
• delete your data;
• withdraw consent at any time, without affecting what was done before;
• restrict or object to processing;
• opt out of the “sale” or “sharing” of personal information — we do not sell it, and advertising sharing happens only if you accept the cookie banner (use “Cookie settings” to turn it off);
• not be treated worse for using these rights.

You can delete your data yourself from the account page — no email needed. For access, export, correction or any other request, email pasinto.js@gmail.com; we respond within 30 days and may need to verify it is really you first.

Know before you delete: deleting your birth details also deletes the chart derived from them, and the report access you bought is lost without a refund. The system warns you again before you confirm.

The compare feature lets you enter another person’s birth date. It is used only to compute that comparison and is not saved to our database. Like your own details, it travels in the page address and can appear in the Cloudflare logs described in section 2.

Only enter someone’s details if they are comfortable with it — we have no way to ask them for consent on your behalf.

The element card image is generated on your own device and is not uploaded to us. It contains no birth date or name — only the element letter, element name and five-element bars.

• All connections use HTTPS.
• The access cookie is digitally signed, cannot be forged, and cannot be read by JavaScript.
• The database is reachable only from our server side, never directly from a browser.

If you think we have handled your data wrongly, please email pasinto.js@gmail.com first. You also have the right to complain to your local data-protection authority — for example the supervisory authority in your EU/EEA country, the UK ICO, the California Privacy Protection Agency, or Thailand’s Personal Data Protection Committee.