Privacy Policy

This policy explains how a47 (the "Site"), operated by the a47 team ("we", the data controller), collects, uses and discloses your personal data under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

1. What we collect

When you watch without an account

• Technical request data: IP address, browser and device type, pages opened, time of access (in server logs and at our network providers)
• Your resume position, stored in your own browser (localStorage) and never sent to us
• Your language choice, stored in a cookie named lang
• Aggregate usage statistics (viewer counts, pages, countries, device types, player events) collected without cookies and without any identifier, summed per day, which cannot be traced back to you

When you have an account

• Email address, display name and password (stored as a one-way hash; we cannot read your password)
• A session cookie (httpOnly) to keep you signed in
• Watch history and resume positions, My List, ratings, comments and comment reports, notifications
• Sign-in records (time, IP address, browser) for account security

We do not collect payment data (the Site is free), sensitive data, or device permissions such as contacts, location or camera.

2. Why we use data and the legal basis

Purpose	Data	Legal basis
Deliver pages and video to your device	Technical request data	Legitimate interest / necessary to provide the service
Accounts, resume, lists, ratings, comments, notifications	Account and usage data	Necessary under the Terms of Use you agreed to
Security, abuse prevention, comment moderation	Sign-in records, comments, reports	Legitimate interest
Improving the Site and choosing what to publish	Anonymous aggregate statistics	Legitimate interest

We do not sell your data and do not use it for behavioural advertising.

3. Who sees your data (processors)

We rely on third-party providers to run the Site. They process data only on our instructions.

• Cloudflare (USA, with points of presence worldwide including Thailand): content delivery and attack protection; every request to the Site passes through Cloudflare
• Bunny.net (Slovenia, with points of presence in Asia): video delivery; sees viewers' IP addresses while streaming
• Server and storage providers in the European Union (Bulgaria, Moldova, Germany): host the member database and video files
• AI model providers (such as Anthropic or OpenAI): screen comment text after posting, if enabled; only the comment text is sent, never your email or name

Your data is therefore stored or processed outside Thailand. We choose providers with internationally recognised data-protection safeguards. We may also disclose data where required by law or by a competent authority.

4. Cookies and browser storage

The Site uses only strictly necessary cookies, so there is no consent banner.

• The member session cookie (keeps you signed in); removed when you sign out
• The lang cookie remembering your language
• localStorage holding the resume position for visitors who are not signed in (on your device; clear it via your browser settings)

There are no advertising or third-party tracking cookies.

5. Retention

• Account and usage data: until you delete your account (self-service on the Account page; linked data is deleted immediately)
• Watch history: you can remove entries or clear it all on the Account page
• Notifications: read ones for 30 days, unread ones for 90 days
• Sign-in records and security logs: up to 12 months
• Anonymous aggregate statistics: kept indefinitely, as they identify no one

6. Your rights

Under the PDPA you may request access, a copy, correction, deletion, restriction, objection to processing, and portability of your data.

• Change your name, password and watch history, and delete your account, on the Account page
• For anything else, contact [email protected]; we reply within 30 days
• If you believe we are breaking the law, you may complain to the Personal Data Protection Committee (PDPC) of Thailand

7. Security

All connections are encrypted with HTTPS, passwords are stored as hashes, servers are accessible only to authorised administrators, and every administrator action in the back office is logged.

8. Changes to this policy

We may update this policy; the date of the latest update is shown at the bottom of this page. Material changes are announced to members through in-site notifications.

9. Data controller and contact

the a47 team
Email: [email protected]