LEGAL & PRIVACY
Privacy Policy
How Thailand Navigator collects, uses, shares and protects personal information.
Effective 2 November 2026 Accounts for ages 18+
Effective date: 2 November 2026. Version: 2026-11-02.
1. Overview
This Privacy Policy explains how Thailand Navigator handles personal information when you browse the service, create an account, save content, plan trips, participate in community features, suggest a correction or contact us. It should be read with the Terms of Service.
Who controls your data?Antony Giles, based in the United Kingdom and operating Thailand Navigator, is responsible for the personal information described here. For privacy questions, account closure or a data-rights request, email thailandnavigatormail@gmail.com.
2. Information we collect
We collect information you provide, information created when you use account features, and limited technical information needed to operate and protect the service.
| Category | Examples in the current service | Why it is collected |
|---|---|---|
| Account information | Display name, email address, account identifiers, account status and creation/update dates. | Create and manage an account and provide requested account features. |
| Authentication data | Password hash, secure authentication and refresh-token records, session identifiers, sign-in dates and related IP addresses. | Authenticate users, maintain sessions and protect accounts. |
| External sign-in and policy acceptance | Provider account identifier, email and profile details supplied during external sign-in; accepted Terms and Privacy versions and acceptance timestamp. | Link and authenticate the account and record the notices presented during registration. |
| Saved content and trip plans | Saved places or guides; trip names, dates, traveller counts, destinations, custom items and notes. | Remember choices and provide planning features. |
| Property listings | Ownership or agency details, property descriptions, prices and terms, amenities, listing images, contact preferences, exact address or coordinates, and moderation history. Residential listings display only an approximate public location unless an exact location is expressly permitted. | Create, review, publish and maintain property listings while protecting private residential location details. |
| Property enquiries | Enquirer name, email address, optional phone number, message, listing reference, delivery status and timestamps. | Deliver an enquiry to the listing owner or agency, prevent abuse and keep a record of the request. |
| Community activity | Posts, replies, likes, accepted answers, reports, moderation status and timestamps. | Publish and operate community features, respond to reports and maintain safety. |
| Suggestions and enquiries | Name, email, contact reason, subject, message, page URL, proposed correction, source URL and optional attachment. | Respond to enquiries, assess suggestions and investigate corrections. |
| Partnership proposals | Organisation and representative details, website, location, proposal and commercial interests, supporting link, optional PDF, authority confirmation, receipt reference, review status and notification delivery state. | Store the proposal privately, assess suitability, perform due diligence and follow up. Proposals are available only through administrator review routes and are not published as directory content. |
| Private account documents | Uploaded documents and versions, title, notes, document type, expiry dates, file metadata, security-scan state and operation audit records. | Provide your private document library, secure downloads, version history and deletion. Do not upload another person's information without appropriate authority. |
| Personal dates and reminders | Dates, event descriptions and notes, recurrence, reminder rules, timezone and delivery preferences, and reminder delivery records. | Provide the personal calendar and requested reminders. |
| Property requests and agency workspaces | Housing preferences, distribution consent, agency memberships and roles, assigned enquiries, proposals, conversations, viewings and deal records. | Match housing requests, support authorised agency work and manage communications. Contact details and private workspace records are subject to access controls. |
| Newsletter subscription | Email address, signup source, consent-text version, confirmation and unsubscribe timestamps, subscription status, Brevo contact identifier and suppression events. | Operate the requested double-opt-in newsletter, keep consent evidence and honour unsubscribes, bounces and complaints. |
| Service emails | Email address and delivery content for verification, account, password-reset and contact-confirmation messages sent through Brevo. | Send requested or necessary service communications. |
| Anti-spam and security | Cloudflare Turnstile token, verification response and, where sent for verification, IP address; report and moderation signals. | Reduce spam, automated abuse, fraud and security threats. |
| Search and operational data | Search query and result count; request, error, security and diagnostic logs that may include timestamps, IP address or browser/request details. | Operate, secure, troubleshoot and improve service reliability. |
Only upload files you are entitled to share and keep private information out of public contributions. Do not send passwords, payment-card information or unnecessary sensitive information through contact, suggestion or community forms.
3. Why we use information
Current product flows use personal information to:
Provide and secure accounts
Register users, sign them in, maintain sessions and respond to account-security events.
Save content and plans
Keep saved items and trip plans connected to the correct account.
Operate the community
Publish contributions, record reactions, review reports and moderate content.
Respond to enquiries
Route, answer and keep a record of contact requests, corrections and suggestions.
Send service emails
Deliver account, password-reset, confirmation and other requested operational emails.
Operate the newsletter
Confirm subscriptions, send requested newsletter content and maintain unsubscribe and suppression records.
Prevent abuse
Detect automated submissions, investigate misuse and protect users and systems.
Maintain reliability
Diagnose faults, measure search usefulness and improve application performance.
Meet legal duties
Preserve or disclose records when a valid legal obligation applies.
4. Lawful bases
Antony Giles operates Thailand Navigator from the United Kingdom. We use the following bases under UK data-protection law; other mandatory protections may also apply where you live.
| Basis | What we use it for |
|---|---|
| Contract and steps at your request | Create and manage your account, authenticate access, store the saved content, private plans and documents you request, provide account features and respond to a prospective business arrangement. |
| Legitimate interests | Protect accounts and service availability, prevent spam and fraud, investigate abuse, moderate public contributions, respond to ordinary enquiries, correct published information and maintain proportionate security and operational records. These interests are running a reliable service, protecting users and resolving problems; we consider their effect on individuals and your applicable right to object. |
| Consent | Send the optional newsletter and load optional Google Analytics measurement. Newsletter consent is separate from account registration. You can unsubscribe or withdraw analytics consent without losing your account. |
| Legal obligation | Keep or disclose information when required by a law that applies to us, a regulator or a valid court order, limited to what that duty requires. |
Agreeing to the Terms or acknowledging this policy is not blanket consent to advertising, newsletters or analytics. Optional trip interpretation runs only when you choose that feature. We do not make decisions with legal or similarly significant effects about you solely by automated processing.
5. Cookies and authentication
The current application uses first-party, HTTP-only cookies to authenticate signed-in users and refresh sessions. These cookies are set with SameSite protections and are marked secure in production.
| Cookie type | Purpose | Current configured duration |
|---|---|---|
| Application sign-in cookie | Maintain the signed-in application session. | Up to 14 days, with sliding expiry. |
| Access-token cookie | Authorise requests to signed-in service features. | Up to 14 days. |
| Refresh-token cookie | Obtain a new access token without requiring a fresh sign-in. | Up to 30 days. |
| Optional Google Analytics cookies (_ga and _ga_*) | Measure visits and engagement across public, account and admin pages after you accept analytics. | Up to 180 days. |
We do not use advertising or behavioural-marketing cookies in the current service. Cloudflare Turnstile on protected forms processes technical signals to help prevent automated abuse. External sign-in, embedded maps and other third-party services can use their own necessary storage and receive connection information when you use them.
With your consent, we use Google Analytics 4 to understand website usage. The analytics tag loads only after acceptance. Google receives page-view, engagement and device information and processes network information such as your IP address. Private account and admin pages are represented by generic page names, with no record identifiers, private titles, form contents, URL query strings or fragments sent by this integration. Advertising features and automatic form, search and outbound-link capture are disabled. See how Google uses information from sites that use its services.
Your analytics preference is stored in this browser’s local storage for 180 days. You can reject analytics without losing access to the service, or withdraw consent using Cookie preferences on this Privacy Policy page. Withdrawal stops future collection and removes the analytics cookies accessible to the website; it does not erase information already received by Google.
6. How information is shared
We do not sell personal information. We disclose it only as needed to run the service, protect users, comply with law or complete a transaction you request.
Brevo
Email address, message content, newsletter-list status and delivery data for account, password, contact and newsletter emails.
Cloudflare Turnstile
Tokens and technical signals used to verify protected forms and prevent automated abuse.
Cloudflare R2 and media delivery
Storage for uploaded private account documents, public media and database backups. Public media is delivered from the media domain; private document downloads use authenticated routes. Cloudflare operates internationally; see the international-processing section.
External sign-in providers
When you choose an available Google or Facebook sign-in option, the provider processes the sign-in request and supplies the identifier and authorised account details needed to authenticate or register you. Review that provider's privacy information before using it.
Google Analytics
If you accept analytics, Google receives the usage and device information described in the cookies section. You can reject or withdraw analytics without losing access to the service.
Optional trip interpretation
The optional describe-your-trip feature may send the text you enter to the configured AI provider, currently OpenAI, to extract travel preferences. Avoid entering names, contact details, document numbers or other unnecessary personal information. You can use the ordinary journey fields instead.
Infrastructure providers
Providers of the application servers, database, storage, monitoring, network and security services needed to operate Thailand Navigator. They receive information only for the relevant hosting, support, recovery or security purpose.
Map, location and routing services
Place queries and route coordinates may be sent to the configured location and routing providers, including OpenStreetMap-related services such as OSRM. Map tiles and embeds can also send your IP address and browser details to their provider. Confirm the meeting points for your actual bookings separately.
Authorities and advisers
Information may be disclosed where legally required or reasonably necessary to protect rights, safety and service integrity.
Business change
A future merger, financing or asset transfer may require a controlled disclosure, subject to applicable law and safeguards.
No sale of personal informationWe do not sell your personal information to advertisers or directory businesses. Public contributions and public listing details are visible by their nature; private account information is not made public merely because you register.
7. International processing
We operate from the United Kingdom and use service providers that operate internationally. Depending on the feature, information can be processed in the UK, the European Economic Area, the United States and other countries where a provider and its authorised subprocessors operate. A global provider’s support or network processing may occur outside the location of its primary storage.
Brevo states that its database hosting is in the European Union, including France, Germany and Belgium. Cloudflare provides storage, media delivery and security through an international network. Google, Meta and OpenAI may process information internationally when you choose their sign-in, analytics or optional trip-interpretation features. See Brevo’s storage information and Cloudflare’s data-processing terms.
Where UK law restricts a transfer that we arrange, it must be supported by an applicable adequacy arrangement or appropriate safeguards, such as contractual protections incorporating the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses. The mechanism depends on the provider and transfer. Contact us to ask which safeguards apply to your information or request a copy; we may redact unrelated confidential or personal information.
8. Retention and deletion
We keep personal information for the purpose for which it is needed, taking account of whether an account or enquiry remains active, an outstanding request or complaint, security risks, limitation periods and any legal duty. We do not apply one blanket retention period to every type of record.
Account closure and erasure requests: use Delete your account to request deletion. You can also email thailandnavigatormail@gmail.com from the account email where possible. Say whether you want to close the account, request deletion of personal information, or both. Requests are handled individually, with proportionate identity checks where needed. Account closure restricts access; it does not automatically erase every related record.
When an erasure request applies, we remove private account information, saved content, trip details and uploaded files for which there is no continuing lawful reason for retention. Public discussions may remain only where there is an appropriate basis, including genuine anonymisation: changing a display name alone is not enough if the text still identifies someone. We remove or edit identifying material, or remove a contribution where safe anonymisation is impractical.
| Information | Retention period or criteria |
|---|---|
| Account and authentication records | While needed to provide an active account. Following closure or an erasure request, any continued retention is limited to an identified legal, dispute, fraud or security purpose. Session/token expiry is described above; closing access and deleting personal records are separate steps. |
| Saved content and private trip plans | While you use the relevant account feature, until you remove the item or an applicable erasure request is completed, subject to necessary retained records and backups. |
| Public listings, community posts and moderation records | While published and useful for their stated purpose; review history may remain where needed for accuracy, reports, abuse prevention, disputes or legal duties. Erasure and anonymisation are assessed individually. |
| Enquiries, suggestions, partnership proposals and attachments | For the enquiry, assessment, follow-up and any resulting relationship, then only as needed to evidence the outcome, resolve a complaint or meet a legal duty. Closing a review does not itself delete its records. |
| Private account documents | While retained in your document workspace or until an applicable erasure request is completed. Files you remove are cleaned up asynchronously; document operational audit records expire after 90 days. |
| Personal dates, reminders and property workspace records | While needed for the account feature or until removal/an applicable erasure request, with limited operational history where needed for a dispute, security or legal duty. |
| Newsletter records | While subscribed. After unsubscribe, bounce or complaint, we retain the minimum suppression and consent evidence needed to avoid unwanted contact and demonstrate how the request was handled. |
| Email delivery and operational/security records | Only for the relevant delivery investigation, troubleshooting, abuse prevention, complaint or legal purpose; access and continued retention must be proportionate to that purpose. |
| Backup copies | For recovery and continuity while the recovery copy is needed. Individual deleted records may remain in a backup until that copy is overwritten or removed; removal from the live service is not instant removal from every backup. Copies retained for recovery are not a source for ordinary account use. |
We explain the outcome of an erasure request and any information that must be retained, with its reason and applicable period or criteria. Where a backup is restored, applicable deletion requests must be reapplied before restored information is returned to ordinary use. We cannot control copies that other people or search engines have independently retained from public pages.
9. Your rights
Depending on where you live and the lawful basis used, you may have rights over your personal information. These can include access, correction, deletion, restriction, objection, portability, withdrawal of consent and a complaint to the relevant regulator.
Access
Ask whether we process your information and request a copy where the law provides.
Correction
Ask us to correct inaccurate or incomplete personal information.
Deletion
Ask for deletion where there is no overriding reason to keep the information.
Restrict or object
Ask us to pause certain use or object where the applicable law gives that right.
Portability
Request eligible information in a portable format where the right applies.
Withdraw consent
Withdraw consent for optional processing without affecting earlier lawful use.
How to make a requestEmail thailandnavigatormail@gmail.com or use the contact page and select “Privacy request”. We may need proportionate information to verify identity. We aim to respond without undue delay and within one calendar month; if a lawful extension or another statutory timing rule applies, we will explain it. You can complain to the UK Information Commissioner’s Office, and any other supervisory authority available to you under applicable law.
10. Children
Thailand Navigator’s launch policy is that accounts and account-based features are for people aged 18 or over. Public guides and destination information can be read without an account. We do not offer an under-18 account or parental-consent registration route.
If you believe a child has an account or has provided personal information that needs attention, contact thailandnavigatormail@gmail.com. We will review the report, take appropriate steps to restrict the account and consider deletion with any necessary safeguards.
Public information and account eligibilityPublic visitors may include children. New account holders must confirm they are 18 or over; this is a declaration, not identity-based age verification. Contact us if an account appears to breach the age rule. We do not use this declaration to claim that children cannot access public pages.
11. Security
We use safeguards intended to reduce unauthorised access and abuse, including encrypted website connections, password hashing, HTTP-only authentication cookies, protected private-document downloads, role-based administration, form verification and rate limits. Access to private information is limited to the relevant account functions and authorised operational work.
No method of transmission or storage is completely secure. Tell us promptly if you suspect an account or data-security problem, without sending passwords or unnecessary identity documents. Where an incident triggers a legal notification duty, we notify the appropriate authority and affected individuals as required.
12. Changes to this policy
We may update this policy when the service, providers or legal requirements change. We show the effective date and version on this page. For a material change, we provide an appropriate notice through the website or relevant account communication. A change requiring fresh consent is not covered merely by an earlier account registration.
Current version2026-11-02, effective 2 November 2026.
13. Contact
For privacy questions, account closure or a data-rights request, contact Antony Giles, United Kingdom, at thailandnavigatormail@gmail.com, or use the contact page and choose “Privacy request”. Please describe what you need and the account or information involved, without sending a password or unnecessary identity documents.