Legal
Privacy Notice
Last updated 5 November 2026
This notice explains what personal data we collect when you visit our websites, buy a course or product, or book a class — and what we do with it. It is written to meet Thailand’s Personal Data Protection Act B.E. 2562 (PDPA).
1. Who is responsible
The data controller is Parisa Fellone, trading as Make Up Is My Buddy, Bangkok, Thailand. For anything about your personal data, write to us through the contact page.
2. What we collect, and why
When you contact us or order a product (makeupismybuddy.com): your name, e-mail address, phone number, the country or city you are in, your message, and for product orders the product, amount and shipping address. The form sends this to our mailbox so we can reply, confirm and ship your order. If you send a payment slip by LINE or Instagram, that message is handled by LINE or Meta under their own privacy terms.
When you create a learner account (learn.makeupismybuddy.com): your name, e-mail address and password (stored only as a one-way hash — we cannot read it), your language choice, whether and when you confirmed your e-mail address, your personal recommend-a-friend code and, if you joined through a friend’s link, which account recommended you.
When you buy a course: the course and tier, the amount, the date and time, the payment method, our order number and the payment reference our payment provider gives us. If you pay by card or PromptPay through Beam Checkout, Beam handles the payment and tells us only that it succeeded or failed; your card number never reaches us. If you pay by bank transfer and upload a slip, we store the slip image (which shows your bank account details) on a private disk that is not reachable by URL, together with any note you add.
When you learn: for each lesson, the furthest point you have reached and the point you last stopped at, and whether you have completed it. We use this to show your progress, to let you continue where you left off, and to apply the two-lesson rule in our refund policy.
When you sign in: to limit an account to two devices, we store for each browser a device label (for example “iPhone · Safari”, read from the browser’s user-agent string), the IP address it last connected from, and when it was first and last used. The browser receives an encrypted, HTTP-only cookie holding a random token; only a hash of that token is stored on our side.
When you earn a recommend-a-friend reward: the recipient name, phone number and address you give us for shipping it.
Account events: we keep a short log of security-relevant events — a device added, blocked or returned, a slip uploaded, an order approved or rejected, an account deleted — with the time and the account concerned, so that we can help you if something goes wrong and can investigate misuse.
Technical data: like every website, our servers and our hosting provider’s content-delivery network record the IP address, browser type and pages requested in standard server logs, which are used for security and to keep the sites running.
We do not collect special-category data (such as health or ethnicity) and we do not ask for it. If you tell us about a skin condition or allergy before a private class, we use it only to choose suitable products for that class and do not store it afterwards.
3. Our lawful bases under the PDPA
- Performing a contract with you — creating your account, delivering courses and products, taking payment, giving refunds, shipping rewards.
- Legal obligations — keeping records of sales and payments for Thai tax and accounting law.
- Legitimate interests — keeping the sites secure, enforcing the two-device limit and the licence on our content, preventing fraud and chargebacks, and understanding how our websites are used. We have checked that these interests do not override your rights.
- Consent — for analytics cookies on makeupismybuddy.com (see section 6). You can withdraw consent at any time.
5. How long we keep data
- Account, progress and device data — for as long as your account exists. You can delete your account yourself from the Account page in the learner app; this permanently removes your account, progress, course access and orders.
- Payment records (order, amount, date, payment reference) — for the period Thai accounting and tax law requires, even after your account is deleted.
- Payment slips — until the order has been approved or rejected and any refund period has passed, then deleted.
- Contact and product-order e-mails — up to 2 years after our last exchange, so that we can answer follow-up questions, then deleted.
- Security log — 12 months.
- Server logs — kept by our hosting provider for a short rolling period for security.
6. Cookies
learn.makeupismybuddy.com uses only cookies that are needed for it to work: a session cookie (so you stay signed in), a security token that protects forms, and the device cookie described in section 2 (kept for up to 400 days). There is no analytics or advertising on the learner app.
makeupismybuddy.com uses Google Analytics to count visits and see which pages are read; this sets Google’s _ga cookies, which stay for up to 2 years. We use the data only in aggregate to improve the website. You can block these cookies in your browser settings or with Google’s opt-out add-on, and the website works exactly the same without them.
7. Your rights
Under the PDPA you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected — your name and language can be changed on the Account page; contact us for anything else;
- have your data deleted — use Delete my account on the Account page, or contact us; we keep only what the law requires us to keep (section 5);
- ask us to restrict or stop a particular use, or object to processing based on legitimate interests;
- receive the data you gave us in a machine-readable form;
- withdraw consent where we rely on it (analytics cookies);
- complain to the Personal Data Protection Committee (PDPC) of Thailand if you believe we have not handled your data lawfully — we would be grateful for the chance to put things right first.
To use any of these rights, send us a message through the contact page, giving the e-mail address on your account. We answer within 30 days.
8. How we protect data
Both websites are served only over HTTPS. Passwords are stored as one-way hashes. Session and device cookies are encrypted and HTTP-only. Payment slips are stored outside the web root and can be opened only by us when signed in as administrator. Card details are handled entirely by our payment provider. Access to the server and the admin area is limited to the people who run the business.
9. Children
Our courses and products are intended for adults. We do not knowingly collect personal data from anyone under 18. If you are under 20, a parent or guardian must agree to this notice on your behalf; if we learn that we hold data about a child without that agreement, we will delete it.
10. Changes to this notice
We may update this notice as our services or the law change. The date at the top shows when it was last updated; for a significant change we will tell account holders by e-mail.