Privacy notice
Privacy notice | ZertraOne
Registration payment records
After approved activation, records include integer satang amounts, status, review history and a keyed voucher fingerprint tied to Discord ID. Voucher links and sender names are not stored. Payment records and entitlement survive website profile deletion to prevent duplicate charging. The operator must define the applicable financial legal basis and retention period before accepting money: [required].
Data controller
Pre-launch review draft, 20 October 2026. Controller name and address: [required]. Privacy contact: [required]. Review against Thai PDPA and actual operating practices before launch.
Information processed
Accounts store Discord ID, username, display name, avatar reference and creation time. Sessions store hashes and expiry. Community records include eligibility, invitations, membership and moderation evidence. Support stores name, email, subject, message and consent time.
Purposes and legal bases
Account data supports the service you request. Support information is processed with consent. Security records support legitimate interests in abuse prevention. The operator must validate these legal bases and the necessary assessments. No advertising tracking is installed.
Providers and international transfers
Cloudflare provides hosting, D1 and Turnstile. Discord provides identity and community services. Processing may occur outside Thailand. The operator must document the actual recipients, countries and transfer safeguards before launch. Discord access and refresh tokens are not persisted.
Retention
Sessions last up to seven days, OAuth state ten minutes, support submissions ninety days, login audit records thirty days, access audit records ninety days and completed invitation records thirty days. Authorization and ban records remain while necessary for community administration and require periodic review. Raw IP addresses are not stored in D1; daily HMAC values support rate limiting.
Your rights
Subject to applicable law, request access, correction, deletion, restriction, objection, consent withdrawal or portability through the controller’s privacy contact. Delete your website profile in Account. Moderation records may remain to prevent access-control evasion. You may complain to the relevant authority. Withdrawal does not invalidate earlier lawful processing.