Privacy Policy

SoiPass helps people discover local deals from venues in Thailand — we're currently launching in Pattaya, with more cities planned. If you have any question about this policy or your data, contact us at hello@soipass.com.

SoiPass is operated by Mindstone Labs Limited (Company Registration No. 80692217), a company incorporated in Hong Kong. Mindstone Labs Limited is the data controller responsible for personal data handled through SoiPass, and can also be reached at admin@mindstone-labs.com.

• Your email address, used for passwordless ("magic-link") sign-in.
• Profile details you choose to provide: display name, preferred city, interests, profile photo, and contact number.
• A membership number we generate for your account (used for the "My SoiPass" membership card — not derived from any other personal data).
• The deals and venues you save/favourite — used to show your Saved page (saved deals and saved venues are kept in separate lists) and to improve your experience.
• Details you submit through our List your venue application, if you apply as a business (see "Venue applications" below).
• Basic product analytics — page/screen views, searches, category and filter selections, saves/unsaves, venue application submissions, "Add to home screen" prompt interactions, and sign-up/sign-in events.
• An anonymous/session identifier (stored as a cookie) used for our first-party analytics — this identifies a browser session, not you personally.
• Basic technical data where tracked, such as device type, browser, and operating system.
• Approximate location — such as country, region, or city — derived from technical request data provided by our hosting/CDN provider, where available. This is city-level at best, not precise GPS positioning.
• UTM parameters, referrer, and landing page, where available, to understand how visitors find SoiPass.
• Interactions with our "Add SoiPass to your phone" prompts — such as whether the prompt was shown, clicked, or led to an install — so we can understand and improve that experience.
• Your language preference, stored on your device (cookie and/or local storage), so the app opens in your chosen language next time.

If you apply to list a venue through our List your venue application, we collect the details you submit so our team can review them. These can include:

• Venue name, categories, and a short description.
• City, area and address.
• A map link (Google, Apple, Waze, OpenStreetMap or other) if you add one, plus the venue location we derive from your venue search or dropped pin.
• Opening hours, including the structured day-by-day hours you set.
• Contact details — contact name, and any email, phone, LINE, Instagram or website you provide.
• Photos of your venue.
• Your offer/deal ideas, including each offer's details and photos.
• Any notes or comments you add for our team.

Applications are reviewed by the SoiPass team before anything goes live — submitting one doesn't create a public listing on its own.

Saving progress on your device. While you're completing a venue application, we may save your draft progress locally in your browser so you can continue later. This draft stays on your device — it isn't sent to our servers — and is cleared when you submit or discard the application. Photos you add are uploaded to our storage when you select them (so you get a preview); the local draft only keeps a reference to them, not the image files themselves.

• A profile photo/avatar, if you choose to add one to your account.
• Venue photos and offer/deal photos submitted through a venue application, or added by our team.
• Photos may be reviewed internally by our admins, and may be displayed publicly once the related venue or deal is approved and published.
• Please only upload images you have the right to share. You can ask us to update or remove photos you submitted — email hello@soipass.com.

• SoiPass uses your device location only when you choose it — by tapping "Use my current location" in the location selector. We never request your location automatically or on page load.
• When you grant access, your precise coordinates are stored only on your device (in your browser), to support nearby features. They are not sent to our servers, not saved in our database, and not placed in a cookie.
• Our analytics records only that a location request happened and a coarse accuracy range (for example "under 50m") — never your exact coordinates.
• You can use SoiPass fully without granting location access, and you can switch back to browsing Pattaya at any time. This precise device location is separate from the approximate, city-level location described elsewhere in this policy.

• No passwords — sign-in uses a one-time magic link instead.
• No payment data — SoiPass does not process payments today.
• No exact GPS on our servers — precise device location is used only if you choose "Use my current location", and then it stays on your device (see "Device location" above). Server-side, we use only approximate, city-level location derived from technical request data.
• No raw IP addresses stored by our current analytics — where we use IP data at all, we store only a one-way salted hash, never the address itself.
• No invasive device fingerprinting (canvas, font, or hardware probing).

• To provide and secure your account.
• To save and show your favourite deals.
• To improve recommendations and content over time.
• To understand how people use SoiPass and improve the product.
• To manage and review venue applications.
• To contact venues that apply to be listed.
• To keep the service secure and prevent abuse.
• To understand our audience and demand (e.g. device mix, approximate location, install behaviour) for product decisions and operational and investor reporting — never sold or shared with advertisers.

SoiPass aims to handle personal data responsibly in line with the spirit of Thailand's Personal Data Protection Act (PDPA). As an early-stage startup, we don't claim full formal legal compliance certification — but we take data handling seriously and will keep improving this as SoiPass grows. You can always contact us with privacy questions or requests.

• Supabase — hosting, authentication, and our database.
• Netlify — website hosting.
• Resend — sending transactional emails (e.g. magic links, venue application notifications).
• Google Maps / Google Places — where configured, a venue page may show a Google rating and review count, a Google Place identifier, or a link to Google Maps for directions. This is third-party information from Google; it is not a SoiPass review, and we don't import full Google review text or claim to own or verify Google data.
• Our analytics is first-party, stored in our own Supabase database — we don't use third-party trackers or ad networks.
• We do not sell personal data to advertisers.

• Account and profile data, including your saved deals and saved venues, is kept while your account is active.
• Venue application details, photos and offer ideas are retained as needed for admin review, to create and run any resulting listings, and for our business records. Applicants can contact us to update or remove their application details where appropriate.
• Some data may be kept longer where we have a legitimate admin, security, legal or product reason to do so.
• Analytics data is retained for product and operations purposes unless deleted or aggregated in the future.

You can ask us to access, correct, or delete your personal data, or object to/withdraw consent for certain uses where applicable. Email hello@soipass.com and we'll get back to you.

We may update this policy as SoiPass develops new features. We'll update the date at the top of this page when we do.