Privacy Policy for Flashlight

1. Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Application refers to Flashlight, the software program provided by the Company.
• Company / Data Controller (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Policy) refers to the Flashlight application team. Under the PDPA, We act as the Data Controller who determines the purposes and means of processing Your Personal Data.
• Data Processor / Service Provider means any natural or legal person who processes the data on behalf of the Data Controller, including third-party cloud hosting and analytics providers.
• Personal Data (or "Personal Information") is any information that relates to an identified or identifiable individual, directly or indirectly, as defined by the PDPA.
• Service refers to the Application.
• Usage Data refers to data collected automatically, generated by the use of the Service or from the Service infrastructure itself.
• You means the individual accessing or using the Service.

2. Collecting and Using Your Personal Data

Types of Data Collected

A. Identity and Contact Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information to create an Account or contact You. This includes:

• Email address
• First name and last name
• Profile picture (if connected via social login like Google or Apple)

B. Academic and User-Generated Content

Because Flashlight is an educational and study-tracking tool, We collect data You input to provide the core functionality of the Service. This may include:

• Your current school, academic year, study program/track (แผนการเรียน), and GPA
• Study logs and timers (duration of study sessions)
• Target universities, faculties, and subjects
• Mock exam scores, academic goals, and task lists

C. Usage Data and Tracking Technologies (Cookies)

Usage Data is collected automatically when using the Service. This may include Your Device's Internet Protocol (IP) address, browser/device type, the pages of our Service that You visit, time spent on those pages, and other diagnostic data. We may use cookies, SDKs, or similar tracking technologies to track activity on Our Service and hold certain information for app functionality and analytics.

D. Sensitive Personal Data

We do not intentionally collect Sensitive Personal Data as defined by Section 26 of the PDPA (e.g., race, religion, sexual orientation, health records, or criminal records). If You accidentally submit such data into open-text fields, We will process it only to the extent necessary to delete it.

Legal Basis for Processing (PDPA)

Under Section 24 of the Thai PDPA, We process Your Personal Data based on the following legal grounds:

• Contractual Necessity: To provide You with the Flashlight app's core features, create Your account, and save Your study progress.
• Legitimate Interest: To analyze app usage to fix bugs, improve features, and maintain the security of our Service, balancing our interests with Your privacy rights.
• Consent: When You explicitly agree to receive targeted advertising, or allow us to share Your data with educational partners. You can withdraw this consent at any time.
• Legal Obligation: To comply with applicable Thai laws, regulations, and lawful requests from authorities.

3. Purposes of Processing Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service: Including saving Your study progress and academic goals across devices.
• To manage Your Account: To manage Your registration and user profile.
• To contact You: By email or push notifications regarding app updates, security alerts, or important educational reminders.
• For analytics and improvements: To understand how students use Flashlight so we can build better features and optimize the user experience.
• To deliver targeted advertising: Subject to Your explicit consent, We may use Your personal, academic, and study data to curate and serve You relevant advertisements within the app.
• To provide promotional offers: Subject to Your explicit consent, We may provide You with news, special offers, and general information about goods, services, and educational events from Us or our partners.

4. Disclosure and Sharing of Your Personal Data

We do not sell Your Personal Data. We may share Your information only in the following situations:

• With Educational and Business Partners: Strictly with Your explicit consent, We may share Your personal and academic data with our trusted partners, such as tutoring institutes (สถาบันกวดวิชา) or educational publishers (สำนักพิมพ์หนังสือเรียน). This allows them to offer You curated educational products or courses.
• With Data Processors (Infrastructure): We use trusted third-party providers to host our databases, authenticate users, and analyze app performance (e.g., cloud providers like Firebase or AWS). These providers act on our behalf and are bound by strict confidentiality agreements.
• With other users: If You choose to participate in public leaderboards, study groups, or public sharing features, Your chosen display name and shared study stats may be visible to others.
• For legal reasons: If required to do so by law, to protect Our rights, or in response to valid requests by public authorities in Thailand.

5. Cross-Border Data Transfers

Your information, including Personal Data, may be transferred to and maintained on cloud servers located outside of Thailand. We ensure that any international transfers of Your Personal Data utilize secure cloud providers that maintain commercially reasonable data protection standards in compliance with the PDPA.

6. Retention of Your Personal Data

We will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy.

• Active Accounts: Your Academic and Identity Data is kept as long as Your account remains active so You can access your study history.
• Inactive Accounts: If Your account is inactive (no logins) for a period of 2 years, We will periodically review and take steps to anonymize or securely delete Your Personal Data.
• Upon Request: If You exercise Your right to delete Your account, We will aim to wipe Your data from our active servers within 30 days.
• Usage Data: Kept for up to 14 months for security and analytics purposes before being aggregated or deleted.

7. Your Privacy Rights under the PDPA

As a data subject in Thailand, You have the following statutory rights regarding Your data:

• Right to Access: You can request a copy of the Personal Data We hold about You.
• Right to Rectification: You can request that We correct any inaccurate or incomplete data.
• Right to Erasure: You can ask Us to delete or anonymize Your Account and associated Personal Data at any time.
• Right to Restrict Processing: You can ask Us to pause processing Your data under certain conditions.
• Right to Data Portability: You can request to receive Your study data in a structured, machine-readable format to transfer to another service.
• Right to Object: You can object to Our processing of Your data, especially for direct marketing or targeted advertising.
• Right to Withdraw Consent: If We rely on Your consent, You can withdraw it at any time via the app settings. This will not affect the legality of processing before the withdrawal.
• Right to Lodge a Complaint: You have the right to file a complaint with the Personal Data Protection Committee (PDPC) of Thailand if You believe Our processing violates the law.

To exercise any of these rights, please contact us using the details at the bottom of this policy. We will respond to Your request within 30 days.

8. Children's and Minors' Privacy (Age of Consent)

Because Flashlight is an educational tool designed for TCAS preparation, we anticipate that our primary users are high school students under the age of 20 (the age of legal majority in Thailand). We are committed to handling Your data responsibly and in accordance with the Thai PDPA.

Core Features: We process the data strictly necessary to provide our study-tracking tools. Because using an educational planner is suitable and reasonable for Your daily needs as a student, Thai law allows You to agree to these core educational terms independently.

Targeted Advertising & Data Sharing: To help keep Flashlight accessible and introduce You to relevant educational opportunities, we may display targeted advertising (such as ads for tutors or study materials) and share data with our educational partners. Under the PDPA, using a minor's data for these specific purposes requires consent from a parent or legal guardian. By opting into targeted advertising, creating an account, and accepting this Privacy Policy, You represent and warrant that You are either 20 years of age or older, OR that You have reviewed this policy with Your parent or legal guardian, and they have given their explicit consent for You to use the Service and receive personalized advertisements.

Parental Rights and Opt-Out: We respect the rights of parents and legal guardians. If You are a parent or guardian and wish to review, manage, restrict, or delete Your child's personal data, or if You wish to withdraw consent for targeted advertising on Your child's behalf, please contact us directly at support@flashlight.in.th. We will process Your request promptly.

9. Security of Your Personal Data

The security of Your Personal Data is important to Us. We strive to implement commercially reasonable technical and organizational security measures to protect Your data against unauthorized access or loss. However, remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. In the event of a high-risk data breach, We will notify You and the PDPC within 72 hours as required by law.

10. Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page. For material changes, We will notify You via email or a prominent notice in the app prior to the changes taking effect.

11. Contact Us

If you have any questions about this Privacy Policy, wish to exercise Your PDPA rights, or need to contact our team, You can reach out to us:

Data Controller: Flashlight App Team

By email: support@flashlight.in.th