PICKONE STUDIO
Sponsor Privacy Notice: Pickone Studio
Last updated: 2 November 2026.
Service provider: Pickone Studio is a trade name used by Ravit Chutivisuth, an individual based in Bangkok, Thailand. Pickone Studio is not a company or other legal entity and is not VAT-registered. Contact: pickone.stories@gmail.com.
1. Who we are
- The data controller is Ravit Chutivisuth, trading as Pickone Studio ("we", "us"), based in Bangkok, Thailand.
- Privacy contact: pickone.stories@gmail.com.
- This notice covers only the personal data we collect from brands about sponsorships on pickonestudio.com: the Stripe payment page linked from our Sponsor page, and our emails with you about a sponsorship. The full rules for sponsorships are in our Sponsorship Terms at /legal/sponsor-terms and our Refund Policy at /legal/refunds#sponsorships.
2. What we collect
When you pay on the Stripe payment page
- Your name, email address, billing address and card details, your brand name and your brand's website or link, and a confirmation about your brand and billing entity, all of which you enter on Stripe's own payment page.
- Your order: the package you bought, the amount and currency, the date, the payment and refund status, and Stripe's payment reference.
- Limited card details that Stripe shows us, such as the country of the card. We never see your full card number. Stripe collects and handles your payment-method details on its own payment page.
When you email us
- Your messages and the contact details you include.
- The brand name, logo, creative, landing page and other material you send us for review at pickone.stories@gmail.com.
- Your choice whether we list your brand as a past sponsor.
Technical data through Cloudflare
- Our site runs on Cloudflare (Workers hosting, D1 database, DNS and security). When you visit, Cloudflare processes technical data such as your IP address, browser and device details, the pages you request, the time of the request and the page you came from.
- Cloudflare may set strictly necessary security cookies, for example to tell people from bots.
- Our site uses Cloudflare's standard Network Error Logging. If a page fails to load, your browser may send Cloudflare a short error report. Cloudflare says it uses your IP address only to look up your network, country and metro area for that report, and does not store the IP address.
- We use no analytics tools, advertising cookies or tracking pixels, and our emails carry no open or click tracking. The Stripe payment page runs on Stripe's own site, and Stripe's own policies cover it.
We do not ask for sensitive data (such as health, religion or political views). Please do not send it to us.
You need to give us the payment page details to buy a sponsorship. Without them we cannot take your booking.
3. Why we use it and our legal basis
| What we do | Legal basis |
|---|---|
| Review your brand and creative, run your sponsorship, email you about it, and issue refunds (including the automatic full refund if we reject you or if your payment comes from a Thai billing entity) | Contract: needed to perform our agreement with you or to take steps you asked for before it |
| Keep payment, refund and tax records | Legal obligation: tax and accounting rules we must follow |
| Keep a record of what you agreed at payment, protect the site, and prevent fraud, abuse and payment misuse | Legitimate interests: keeping our site and payments secure and being able to show what was agreed. These interests do not override your rights |
- We send only service emails: Stripe receipts, and our replies and messages about your sponsorship. We send no marketing or promotional email.
- Every approve or reject decision on a sponsorship is made by a person.
4. Who we share it with
We share sponsor data only with these service providers, and only so they can do their job for us:
| Provider | What it does for us | Its privacy terms |
|---|---|---|
| Cloudflare | Website hosting (Workers), DNS and security, including Network Error Logging. Processes IP addresses and other technical data | Privacy Policy: https://www.cloudflare.com/privacypolicy/. Data Processing Addendum: https://www.cloudflare.com/cloudflare-customer-dpa/ |
| Stripe | The payment page, payments, receipts, refunds and fraud checks. Stripe handles your payment-method details; we never receive your full card number | Privacy Policy: https://stripe.com/privacy. Data Processing Agreement: https://stripe.com/legal/dpa |
| Google (Gmail) | Our email inbox, pickone.stories@gmail.com, where we receive your brand material and answer sponsor emails | Privacy Policy: https://policies.google.com/privacy. Our inbox is a standard Gmail account, so Google's Privacy Policy applies to it |
We may also share data:
- with our accountant or lawyer, under a duty of confidence, so they can advise us;
- with tax or other authorities when the law requires it, or to protect our legal rights;
- publicly, in a limited way: an approved sponsored post shows your brand, and if you opt in we list your brand name and logo as a past sponsor.
5. International transfers
- We are in Thailand. Cloudflare, Stripe and Google process data in the United States and other countries, so your data leaves the country where you are.
- For data from the EU or UK, data protection law (GDPR Chapter V) allows a transfer outside the EU or UK only to a country with adequate protection or with safeguards such as standard contractual clauses. Cloudflare and Stripe state in their terms that they use the EU standard contractual clauses and the EU-U.S. Data Privacy Framework.
- Thailand's Personal Data Protection Act (PDPA sections 28 and 29) allows transfers abroad where the destination has adequate protection, where suitable safeguards are in place, or in listed cases such as when the transfer is needed to perform a contract with you.
- Email us if you want more detail on the safeguards our providers use.
6. How long we keep it
- Former sponsor waitlist: we have closed it and no longer collect sign-ups or send emails to it. If you signed up, your email, consent record and any hashed IP record are deleted automatically once they are 30 days old, or sooner if you ask. Resend, which sent the signup confirmations, keeps its own delivery records under its own terms.
- Payment, refund and tax records (your Stripe order record, the details from the payment page and receipts): 5 years after we file the tax return for the year of the payment, then deleted.
- Logos, creative and emails about your sponsorship: deleted within 90 days after a refund, or within 90 days after the 30-day period after your part airs. We keep your logo longer only while you choose to be listed as a past sponsor.
- Technical data: handled under Cloudflare's own retention rules.
- Cloudflare, Stripe and Google keep some data under their own terms and legal duties.
7. Your rights
Sponsor contacts are mostly people acting for a business. We give you the rights below anyway.
Everyone
- Email pickone.stories@gmail.com to ask for a copy of your data, or to correct it, delete it, limit how we use it, object to how we use it, or receive it in a portable format.
- We answer within 30 days. It is free.
- To protect you, we may ask you to write from the email address you used to sign up or pay.
- We cannot delete records the law makes us keep (such as tax records). If that applies, we tell you which records and why.
EU and UK (GDPR)
- You have the right to access, correct and erase your data, to restrict or object to its use, to data portability, and to withdraw consent at any time.
- You can complain to the data protection authority where you live or work. In the UK, you can complain to us first and then to the UK data protection regulator.
California (CCPA, as amended by the CPRA)
- You have the right to know what personal information we collect and how we use and share it, and to delete it and correct it.
- You have the right to opt out of the sale or sharing of your personal information. We do neither.
- You have the right to limit the use of sensitive personal information. We use personal information only to run your sponsorship, as described above.
- We will not treat you differently for using these rights. You may use an authorised agent; we may ask you to confirm you gave the agent permission.
- The CCPA applies only to businesses above certain size thresholds. We may not meet them, but we give these rights anyway.
Thailand (PDPA)
- You have the right to withdraw consent, to access and get a copy of your data, to receive it in a portable format, to object, to ask for deletion or anonymisation, to restrict its use, and to ask us to keep it correct.
- You can complain to the Personal Data Protection Committee (PDPC): https://www.pdpc.or.th/
8. Security
- Payments happen on Stripe's hosted payment page, so card data never reaches our systems.
- The site uses HTTPS and Cloudflare's security services.
- Only people who need sponsor data to run your sponsorship can see it.
- No system is perfect. If a data breach puts your data at risk, we tell the authorities and you as the law requires. Under the Thai PDPA we must notify the regulator within 72 hours where feasible, and you without delay if the risk to you is high.
9. No sale, no sharing for ads
We do not sell your personal information. We do not share it for cross-context behavioural advertising, and we use no analytics tools, advertising cookies or tracking pixels on our site.
10. Not for children
Sponsorships are for businesses. You must be 18 or over and have authority to act for your business. We do not knowingly collect data from children. If we learn we have, we delete it.
11. Changes
We post changes here with a new "Last updated" date. If a change affects a booking you have with us, we email you.
12. Contact
Ravit Chutivisuth, trading as Pickone Studio, Bangkok, Thailand. Email: pickone.stories@gmail.com.