Privacy Policy

CAP*TURES is provided by Sixsheet Tech Co., Ltd. (บริษัท ซิกซ์ชีต เทค จำกัด). We are the data controller for the account, payment and website data described in this policy. Guest photos at events work differently: see section 3.

Address: 15 Room A124, Soi Pradipat 17, Pradipat Rd, Phaya Thai, Bangkok 10400, Thailand (registered address: เลขที่ 15 ห้องเลขที่ A124 ซอยประดิพัทธ์ 17 ถนนประดิพัทธ์ แขวงพญาไท เขตพญาไท กรุงเทพมหานคร 10400)

For anything about your personal data, write to [email protected].

• Account: email, display name, password (stored only as a one-way hash, never in readable form), country, time zone and, if you choose to give them, phone number and LINE ID. This includes staff logins you create under your account.
• Machines and usage: machine name, hostname, device identifier, operating system, app version, IP address and when the machine was last seen, plus session records such as event and frame names, photo and print counts, print results, coupon use and payment amounts at the booth.
• Payments: order number, plan, number of machines, amount, payment channel and status, the payment provider's references, and the email and IP address used at checkout. Card details are entered on the payment provider's own page. We do not receive or store your full card number or security code.
• Sales and support: the name, email, company, phone and message you send through the contact sales form, with your account ID, plan and IP address; issue reports from the booth app, with any log files or screenshots attached; and emails we exchange.
• Frame Studio: your projects, the artwork you upload, the creator name you choose, and a record of each time you confirm the sharing terms, with the date, time and IP address.
• Technical data: IP address, browser type and times of use, in server logs and security logs.
• Communications: which lifecycle emails we sent you, whether you unsubscribed, bounces or spam complaints reported by our email provider, and notes from follow-up calls.

An operator is a customer who runs a booth with CAP*TURES. Guests' photos, videos and GIFs, and anything a guest gives at the booth, such as an email address for a card payment or a membership ID, are handled for that operator. The operator decides what is collected and why, so it is responsible for its guests, including telling them how their data is used and getting any consent the law requires. The booth app includes a PDPA notice screen for this.

We process this data on the operator's behalf, only to provide the service to that operator.

By default, media shared by QR code is uploaded to cloud storage we provide, and an operator can connect its own storage instead. Anyone with a share link can open it. A link lasts as long as the operator sets, and if no limit is set it does not expire. The originals stay on the booth machine.

If you are a guest and want a photo removed, or have a question about one, please contact the operator who ran the booth. If you cannot reach them, write to us at [email protected] and we will help you reach them.

• Providing the service: running your account, connecting and licensing your machines, showing reports and galleries, and running Frame Studio.
• Support: answering questions, helping you set up and fixing problems.
• Billing: taking payment, issuing tax invoices and keeping accounting records.
• Security: protecting accounts, preventing abuse and looking into unusual activity.
• Lifecycle emails and follow-up calls: sending tips, renewal reminders and offers, following up on an unfinished payment, and contacting you by phone or LINE if you gave us those details.
• Improving the service: understanding how the website and product are used.

The PDPA requires a legal reason for each use of personal data. In plain language, ours are:

• Contract: we need the data to provide what you signed up for and bought.
• Legal duty: for example, keeping tax and accounting records.
• Legitimate interests: for example, security, support, improving the service, and lifecycle emails and follow-up calls to our customers. We weigh these against your rights, and you can object or opt out at any time.
• Consent: where the law requires it, we will ask for your consent, and you can withdraw it at any time.

We share data with service providers only as far as each one needs it to do its job:

• Resend: sending email.
• ChillPay: taking payment for plans, add-ons and Studio credits.
• DigitalOcean and Amazon Web Services: hosting, database and file storage.
• Google Analytics: website usage statistics.
• OpenAI: AI image generation in Frame Studio, once that feature is available. It receives the brief you type.
• Payment gateways an operator chooses for payments at its booth, such as ChillPay, Stripe, HitPay, Ksher and JDB, through the operator's own merchant account.

We do not sell your personal data. We may disclose data when the law or a public authority requires it.

Some providers store or process data outside Thailand, so your data may be transferred abroad. We handle those transfers as the PDPA requires.

We use a small number of cookies, and none for advertising:

• sx_access and sx_refresh keep you signed in, for up to 30 and 180 days. The dashboard needs them to work.
• booth_lang remembers your language for one year.
• Google Analytics cookies (names starting with _ga) count visits and show us how the site is used.

You can delete or block cookies in your browser settings. If you block the essential ones, you will not be able to sign in.

Every lifecycle email, such as tips, renewal reminders and offers, has an unsubscribe link at the bottom. Once you unsubscribe, we stop sending them and take you off our follow-up call list. You can resubscribe from the same page, or write to us at [email protected].

Essential account email, such as email verification and password resets, will still reach you.

We keep account data for as long as your account is open. When you ask us to close it, we delete the data or make it anonymous, except what we still need to keep for legal reasons or to handle a dispute.

Payment and tax records are kept for as long as tax and accounting law requires. Technical logs and support messages are kept for as long as they are needed for security and solving problems.

How long guest photos are kept depends on the operator's settings. When a time-limited share link expires, the cloud copy of that session is deleted.

Under the PDPA, you have the right to:

• see your data and get a copy of it
• have wrong or incomplete data corrected
• have your data deleted or made anonymous
• restrict how we use your data
• object to how we use your data, including for marketing
• get your data in a common format, or have it sent to another controller
• withdraw any consent you gave

You can change your phone number, LINE ID, country and password yourself on the account page in the dashboard. For anything else, write to [email protected]. We may need to confirm who you are first, and we will reply within the time the law requires. Some rights have limits, for example data the law requires us to keep.

If you are unhappy with how we use your data, please tell us first at [email protected] so we can put it right. You also have the right to complain to Thailand's Office of the Personal Data Protection Committee.

We may update this policy from time to time and will change the date at the top. If a change is significant, we will tell you by email or in the dashboard before it takes effect.

• Sixsheet Tech Co., Ltd. (บริษัท ซิกซ์ชีต เทค จำกัด)
• 15 Room A124, Soi Pradipat 17, Pradipat Rd, Phaya Thai, Bangkok 10400, Thailand (registered address: เลขที่ 15 ห้องเลขที่ A124 ซอยประดิพัทธ์ 17 ถนนประดิพัทธ์ แขวงพญาไท เขตพญาไท กรุงเทพมหานคร 10400)
• Email: [email protected]