Privacy Policy

Furimoe Co., Ltd., Thai company registration number 0665569000776, which provides Furipay ("the Company", "we" or "us"), is the data controller under Thailand's Personal Data Protection Act B.E. 2562 ("PDPA") for data collected through furipay.me, its sites and Furipay's widgets.

We have appointed a Data Protection Officer (DPO), reachable at privacy@furimoe.co.th.

Creators and agencies who receive supporter data through Furipay may also be data controllers for their own use of it, and must comply with the PDPA too.

This policy covers everyone who uses Furipay: site visitors, supporters sending tips, creators, agency members and managers, game top-up customers, and anyone who contacts us or files a complaint.

• From you, when you sign up, set things up, send tips, order or contact us.
• From sign-in providers (Furimoe, Streamlabs), as you authorise.
• From payment providers and banks (Stripe, slip-verification services, TrueMoney) about payment results.
• From creators or agencies, for example when an agency adds a creator.
• Automatically from the system, such as logs and cookies.

We process personal data only on a legal basis under the PDPA:

• Contract (section 24(3)): creating and running accounts, showing tip pages, taking and showing tips, verifying slips, sending alerts to OBS and Streamlabs, fulfilling top-up orders, managing credit, points, Premium and agency plans, and contacting you about your account.
• Legal obligation (section 24(6)): keeping accounting and tax records, anti-money-laundering obligations, and orders from authorities or courts.
• Legitimate interests (section 24(5)): security, preventing fraud and fake slips, limiting abuse, troubleshooting, improving the service, handling requests, and protecting the rights of the Company and users. We have assessed that this doesn't unduly affect your rights, and you can object.
• Consent (section 19): only where consent is needed, such as marketing messages, non-essential cookies (if we add any) or linking Streamlabs. You can withdraw consent at any time.

If you don't provide data needed for the contract, we may be unable to provide part of the service, for example taking Stripe payments without a connected Stripe account.

We don't aim to collect sensitive data under section 26 (such as religion, health or biometric data). Passkeys use your fingerprint or face on your own device only, and it is never sent to us. If you need to send an ID card copy to verify your identity (for a PDPA or DMCA request, for example), please mask your religion and any details we don't need.

• A creator's tip page is public, including name, pictures, bio, links and online status (if turned on).
• Supporters' names, messages and tip amounts may be shown on stream, in widgets, leaderboards and gacha history, and may be read aloud, so stream viewers can see them.
• Creators see the name, message, amount, method and time of the tips they receive.
• Agencies see tips and totals of the creators they manage.

We don't sell personal data. We share only what is needed with:

• Stripe: card and PromptPay payments, subscriptions and Stripe Connect accounts.
• Slip-verification providers and banks: checking transfers.
• TrueMoney: redeeming gift links into the recipient's wallet.
• Game top-up suppliers: player ID, server and package, to deliver the order.
• Streamlabs: tip name, message and amount, when a creator links it.
• Cloudflare: website hosting, CDN, file storage (R2), Turnstile and email routing.
• MongoDB Atlas and infrastructure providers: database and cache storage.
• Resend: sending notification emails and receipts.
• Telegram or Discord: internal staff alerts about items that need review.
• Creators and agencies, as described above.
• Authorities, courts or others with legal power, and our legal advisers and auditors.
• A buyer or successor of the business in a merger or transfer, who must protect the data under this policy.

Processors acting for us are bound by contract to use the data only on our instructions and to keep it secure.

Emails needed for the service, such as receipts, renewals, security alerts and agency review results, are always sent. News, promotions and marketing are sent only with your consent, and you can opt out any time through the link in the email or by contacting us.

Some providers have servers outside Thailand, such as in the United States, Singapore or the European Union. We transfer data only as sections 28 and 29 of the PDPA allow: for example where the destination has adequate protection, under standard contractual clauses or binding data protection policies, or where it's needed to perform our contract with you (such as payments through Stripe).

We currently use only cookies and storage that the service needs to work, which don't require consent:

• Sign-in cookies (shared across Furipay's sites) to keep you securely signed in.
• A language cookie to remember your language.
• Cloudflare cookies (such as Turnstile) to stop bots and attacks.
• Browser storage (localStorage) for light/dark theme, a remembered name and display settings.

We don't use advertising cookies or third-party tracking cookies. If we add analytics or advertising cookies in the future, we will ask for consent first through a cookie banner. You can delete or block cookies in your browser settings, but blocking essential cookies may stop you signing in.

• Account and tip page data: while the account is active, then deleted or anonymised within 90 days of closing the account, except data the law requires us to keep.
• Tips, orders, payments, receipts and credit/points records: at least 5 and up to 10 years, under accounting, tax and anti-money-laundering laws.
• Sign-in history: 1 year.
• Server logs: up to 90 days, unless needed to investigate a security incident or required by law.
• Requests, complaints and DMCA notices: 3 years after the case is closed.
• Agency applications that weren't approved: 1 year.

After that, we delete, destroy or anonymise the data.

Under the PDPA you have the right to:

• be informed about how your data is collected, used and shared (section 23);
• access and get a copy of your data, and ask where data you didn't consent to came from (section 30);
• receive your data, or have it sent to another controller, in a machine-readable format (section 31);
• object to processing, including processing based on legitimate interests and direct marketing (section 32);
• have your data deleted, destroyed or anonymised (section 33);
• restrict the use of your data (section 34);
• have your data corrected, kept up to date and complete (section 35);
• withdraw consent at any time, without affecting lawful processing done before (section 19);
• complain to the Personal Data Protection Committee (PDPC) (section 73).

You can change most account and tip page data yourself in the dashboard. For other requests, email privacy@furimoe.co.th with your username or account email and what you need. We may ask you to verify your identity, and will respond within 30 days of a complete request, free of charge unless requests are repetitive or excessive.

We may refuse or partly fulfil a request where the law allows, for example when we must keep transaction records for tax law, and will tell you why.

Users in the European Union, the United Kingdom or California (USA) may have additional rights under their own laws, such as the GDPR or CCPA/CPRA. We handle those requests through the same channels. We don't sell personal data and don't share it for cross-context behavioural advertising.

If you're unhappy with how we handle your data, please contact our DPO at privacy@furimoe.co.th first so we can put it right. If it isn't resolved, you can complain to Thailand's Personal Data Protection Committee (PDPC) or the data protection authority in your country.

• HTTPS/TLS encryption in transit on every page.
• Sensitive data encrypted in the database, and sign-in tokens stored hashed.
• Staff access limited by role and need; the back office has layered authentication and logs administrators' actions.
• Protection against bots, card testing and reused slips.
• Backups and regular risk reviews.

If a personal data breach happens, we will notify the PDPC within 72 hours of becoming aware of it (unless there is no risk), and tell affected people without delay if there is a high risk to their rights and freedoms, together with steps to remedy it.

Slip verification, fraud prevention and abuse limits run automatically, for example rejecting a slip that fails verification or was already used. If you think a result is wrong, contact us and our staff will review it. We don't profile you for advertising.

The service isn't directed at children under 13. Users under 20 need a parent's or guardian's consent under section 20 of the PDPA where consent is the basis. If we learn we hold a child's data without the required consent, we will delete it. Parents can contact privacy@furimoe.co.th.

Tip pages may link to creators' websites or social media, and payment services open their providers' pages. This policy doesn't cover other sites; please read their own policies, such as https://stripe.com/privacy.

We may update this policy from time to time and show the effective date at the top. For material changes we will tell you in advance by email or a banner on the site, and ask for consent again where the law requires.

• Data Protection Officer (DPO): privacy@furimoe.co.th
• Security issues and vulnerabilities: security@furimoe.co.th
• General email: contact@furimoe.co.th
• LINE Official: @furimoe
• Data controller: Furimoe Co., Ltd., company registration number 0665569000776
• Complaints to the Personal Data Protection Committee (PDPC): https://www.pdpc.or.th