Who we are
ARAIA Studio is operated by Chin Wattanapoka (ชิน วัฒนะโภคา) (Surat Thani, Thailand), the data controller for the personal data described here.
Questions or requests about your data: orders@araiastudio.com or Line @araia.
What we collect
- Identity & contact — name, email, phone.
- Shipping address — so we can deliver your order.
- Order details — items, amount, status.
- Payment reference only — we never see or store your card number; Omise handles it.
- If you start but don't finish checkout — we keep the contact details you entered so we can follow up.
- Site usage — anonymous, cookieless analytics and first-party page-flow signals.
Why we use it
To fulfil and ship your order, send receipts, provide support, prevent fraud, and — only if you opt in — tell you about new drops. We do not sell your data. The basis for each: order, delivery and support data because we cannot do what you paid us for without it; fraud prevention and keeping the shop working because we have a legitimate interest in both; drop news only on your consent, which you can withdraw at any time. Giving us any of it is your choice — but without delivery details there is no order for us to send.
Who we share with
We share only what is necessary, with these providers:
- Omise (Opn Payments) — Payment processing. Card data goes directly to Omise; we never store card numbers — only a charge reference.
- Resend — Sending order receipts and sign-in links.
- Google (Sheets / Apps Script) — Order, customer, and inventory records (our back office).
- Cloudflare — Website hosting, cookieless analytics, and the AI model that reads chat messages — see below.
- LINE — Customer support and order notifications.
All of these process data outside Thailand, on their own global infrastructure — most commonly Singapore, Japan and the United States. Each is bound by its own contract to use what we send only for the job we send it for, none of them is given your data to sell, and their own privacy policies cover what they hold.
AI in our replies
When you message us on LINE or in the chat on this site, an AI model running on Cloudflare’s network reads what you wrote to work out what you are asking about — a price, stock, a restock, a custom piece — so a useful answer comes back in seconds instead of hours. It reads the message to route it; it decides nothing about you, and under Cloudflare’s terms your messages are not used to train the model. A real person takes over whenever the answer needs one, and you can ask for one at any point. Photos are different: if you send a picture — a payment slip, a piece you want us to look at — it is not passed to any AI. It stays in the conversation and we read it ourselves.
Cookies & tracking
We set five first-party cookies, all of them necessary or functional: a signed one keeps you signed in, one holds the name shown on your account button, one ties a chat thread to this browser, one remembers the language you picked, and one short-lived one lets LINE Login recover if it fails. Your browser also stores your bag, wishlist, recently-viewed items, language and — when you check out as a guest — the details you last entered; that stays on your device and clearing your browser data removes it. We set no advertising or third-party tracking cookies, our analytics (Cloudflare) is cookieless, and our page-flow signals are first-party and not used to track you across other sites — so we don't show a cookie banner.
How we protect it
Card numbers never reach our servers; Omise takes them directly. Sign-in is passwordless, and the session cookie is signed and readable only by the browser that holds it. Back-office pages sit behind a separate access layer. Order records are reachable only by the people who pack and ship them. No system is perfect: if personal data is ever leaked, lost, or reached by someone who should not have it, we act on it immediately, notify Thailand’s data protection authority within 72 hours where the law requires it, and tell you directly when the risk to you is high.
How long we keep it
Order records are kept for as long as needed for accounting and after-sales support (generally up to 5 years, per Thai tax and accounting practice). Marketing contacts are kept until you unsubscribe. Abandoned-checkout details are kept short-term for follow-up.
Under 20
We do not knowingly collect personal data from children. If you are under 20, order with a parent or guardian’s consent. If you believe a child has given us their data, tell us and we will delete it.
Your rights
Under Thailand's PDPA you can access, correct, delete, object to, or restrict our use of your data, withdraw consent, and request a copy to take elsewhere. Write to orders@araiastudio.com — it is free, and we answer within 30 days. We check that you are who you say you are first, usually with the order number and the email you used at checkout: handing an order history to the wrong person is its own kind of breach. A few things we cannot delete on request — a paid order has to stay in the books for tax — and wherever we have to refuse, we tell you why. If our answer does not satisfy you, you can complain to Thailand's Personal Data Protection Committee.
Changes
We may update this policy; the date at the top reflects the latest version. If we ever want to use what we already hold for something new, we tell you before we start — and ask your consent where consent is what makes it lawful.
See also Terms and Shipping & Returns.