This Privacy Policy explains how FITFAC Co., Ltd. ("FITFAC", "we", "us", or "our"), the operator of FITFAC Muay Thai Academy and its branches in Thailand, collects, uses, discloses, and protects your personal data when you use our websites, web applications, online booking and membership system, and our official messaging accounts on Facebook Messenger and LINE.

We process personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand ("PDPA") and the platform policies of Meta Platforms, Inc. and LINE Corporation.

1 Who We Are

• Data Controller: FITFAC Co., Ltd. (บริษัท ฟิตแฟค จำกัด)
• Tax ID: 0105556198305
• Business: Muay Thai fitness academy — group & private classes, memberships, and online booking, operating multiple branches in Bangkok, Thailand.
• Contact: visa@fitfacmuaythai.com · LINE Official Account: @fitfac

2 Information We Collect

2.1 Information you give us

• Account & membership details: name, nickname, email address, phone number, year of birth, home branch, and emergency/family contact for family accounts.
• Class & booking activity: bookings, check-ins, attendance history, session balances, and membership status.
• Optional fitness data: body weight and body metrics you choose to log.
• Payment records: transaction amount, payment method, and payment proof/slip images you upload to complete a purchase. We do not store full credit-card numbers — card payments are processed by our payment providers.

2.2 Information from Facebook & Messenger

When you message one of our Facebook Pages, we receive — through Meta's Messenger Platform and only with your interaction — the following:

• Your page-scoped ID (PSID) — an identifier unique to the conversation between you and our Page;
• Your public profile name and profile picture as provided by Facebook;
• The content of messages you send to us (text, and any images or files you attach), and the timestamps of those messages.

We use this strictly to read and reply to your enquiries through a unified staff inbox. We do not access your Facebook friends, posts, or any data beyond the conversation you start with us.

2.3 Information from LINE

When you connect through our LINE Official Account or LINE LIFF login, we receive your LINE user ID, display name, and profile picture, and the content of messages you send to our account. The LINE user ID is used to link your LINE identity to your FITFAC membership so you can log in and view your account.

2.4 Information collected automatically

• Basic device/browser information and, with your permission, approximate location (used only for the branch check-in geofence).
• A login session token and language preference stored locally on your device (localStorage) to keep you signed in.

3 How We Use Your Information

• To create and manage your membership and family account;
• To process class bookings, check-ins, and session/attendance tracking;
• To process purchases and keep payment records, and to issue receipts;
• To respond to your enquiries and provide customer support through Messenger and LINE;
• To send service messages such as booking confirmations, class reminders, and account notifications;
• To operate, secure, and improve our services and prevent fraud or abuse;
• To comply with our legal and tax obligations.

4 Use of Facebook / Meta Platform Data

Our use of information received from Meta's platforms follows Meta's Platform Terms and Developer Policies. Specifically:

• We use Messenger data only to provide and improve our customer-service replies to you.
• We do not sell, rent, or share Messenger data with data brokers or for advertising-targeting purposes.
• We do not use the data to make decisions about eligibility for employment, credit, housing, insurance, or similar.
• We retain Messenger data only as long as needed for the purposes above (see Section 7) and delete it on request (see Section 8).

5 How We Share Information

We do not sell your personal data. We share it only with:

• Service providers (data processors) who host and run our system on our behalf — including Supabase (database & storage hosting) and Vercel (web hosting). These providers process data only on our instructions.
• Messaging platforms — Meta Platforms, Inc. (Facebook/Messenger) and LINE Corporation — to the extent necessary to deliver and receive your messages.
• Payment and verification providers used to process and verify payments (e.g. bank-slip and card-payment verification services).
• Authorities where required by law, court order, or to protect our legal rights.

6 Security

We protect your data with access controls, row-level security on our database, encrypted connections (HTTPS), and role-based staff permissions. Payment-card details are handled by PCI-compliant payment providers and are not stored on our servers. No method of transmission or storage is 100% secure, but we take reasonable measures to safeguard your information.

7 Data Retention

We keep membership and transaction records for as long as your account is active and for the period required to meet our legal, accounting, and tax obligations. Messenger and LINE conversation data is retained only as long as needed to provide support and maintain a service history, and is deleted or anonymised when no longer required, or earlier upon your verified request.

8 Your Rights & How to Delete Your Data

Under the PDPA you have the right to access, correct, update, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent.

You may also withdraw your consent to receive service messages at any time using the same contact channels.

9 Children's Privacy

We offer Kids Muay Thai classes. Accounts and bookings for children are created and managed by a parent or legal guardian, who provides and consents to the processing of the child's data on the child's behalf. We do not knowingly collect data directly from children without parental consent.

10 Cookies & Local Storage

We use browser localStorage (not advertising cookies) to keep you signed in and to remember your language preference. We do not use third-party advertising trackers on our member pages.

11 Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be communicated through our website or messaging channels.

12 Contact Us