Privacy

Privacy Policy

Effective 3 August 2026

SOI.market (“we”) is a marketplace for second-hand goods in Bangkok, available on soi.market and the SOI app for iOS and Android. This page explains what data we collect, why, who we share it with, and your rights under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

1. What we collect

We collect only what each part of the service needs:

  • Account & sign-in — when you sign up or sign in with LINE, Google, Apple, or an emailed verification code, we collect the display name, profile photo, email, and user ID from that provider, plus your username (@handle), the Bangkok district you select, and your language setting.
  • Identity verification (optional) — if you want to receive payouts through SOI Pay or set up a payout account, we collect your phone number and hand you off to Didit, our identity-verification provider, to upload a government ID and complete a liveness/face check inside a session Didit hosts. The document check also runs an AML (anti-money laundering) screen. The original documents stay with Didit — never on our servers.
  • Transactions & payments — your purchases and sales, escrow state, amounts, and payment method (PromptPay or Thai mobile banking), processed by Omise (Opn Payments), our payment provider. If you sell, we keep your bank account details to pay you out.
  • Delivery — the shipping or pickup address you enter is shared with Shippop (which routes to courier networks such as Flash Express) or Lalamove, only as needed to fulfil your delivery.
  • Content you create — listing photos and video, titles and descriptions, chat messages with buyers/sellers (including attached images), and reviews. We automatically scan listing photos and text, and chat images, with AI to catch policy violations. If you use the AI listing assistant, the photo you upload is sent through OpenRouter to an AI model that drafts a title and description for you.
  • Analytics & diagnostics— we use PostHog (hosted in the US, reached through a soi.market proxy) to track clicks and form submissions only, with all form inputs masked and any value that looks like an email, phone number, national ID, or address stripped before it's recorded. We use Sentry to log crashes and performance issues without attaching your identity.
  • Push notifications & cookies — if you enable notifications in the mobile app, we store a push token via Expo to deliver them. On the web we use the soi_lang cookie to remember your language.

We do not collect precise GPS.The SOI mobile app never requests access to your location. Maps on a listing page show only an approximate area — listing coordinates are always randomly shifted by about 330 meters before they're displayed. The only location-related data we hold is the Bangkok district you select and any address you type in yourself.

2. How we use it

  • Run your account and the marketplace: listing, search, chat, and offers
  • Process payments, hold escrow, and pay out sellers
  • Arrange delivery through the courier you choose
  • Verify your identity when you opt into a higher-trust feature
  • Detect and prevent fraud, spam, and policy violations
  • Rank your home feed and recommendations to match your interests
  • Send the notifications you've enabled (new chats, order updates)
  • Improve the product, including AI-powered features
  • Meet legal obligations such as transaction record-keeping and AML

3. Legal basis

We rely on contractual necessity for the marketplace service, payments, and delivery you sign up for; consent for push notifications, marketing email, and identity verification; and legitimate interest for fraud prevention, AI content moderation, and analytics with data masked.

4. Who we share with

We don't sell your data. We share only what's needed with the following trusted processors:

  • Supabase — database, authentication, and photo storage
  • Vercel — hosting for soi.market
  • LINE (LINE Login / LINE Official Account) — login and messaging
  • Google — sign in with a Google account
  • Apple — Sign in with Apple (mobile app)
  • Omise (Opn Payments) — payment processing and seller payouts
  • Didit — identity verification and government ID checks
  • Shippop — delivery routing to courier partners such as Flash Express
  • Lalamove — on-demand delivery
  • OpenRouter — AI gateway for the listing assistant and content moderation
  • Mux — listing video hosting, for sellers who attach video
  • PostHog Cloud US — analytics with PII masked and stripped
  • Sentry — crash and performance logging
  • Expo — push notification delivery on the mobile app

5. Retention & account deletion

We keep your account data while your account is active, and retain transaction records (orders, payments) for as long as the law requires. Original identity documents stay with Didit, not on our servers, and your verification status expires and must be renewed every 12–24 months depending on the method. Personalization signals (see section 11) are deleted automatically after 180 days.

You can delete your account and data at any time from Me → Settings → Delete account, on the web (soi.market/me/settings/delete-account) and in the mobile app. If you have an open order or dispute, you'll need to resolve it first before the account can be deleted.

6. Your rights under Thai PDPA

  • Access and copy your data
  • Correction
  • Deletion (right to be forgotten)
  • Objection / restriction of processing
  • Withdraw consent at any time
  • Data portability
  • Complaint to the Personal Data Protection Committee (PDPC)

Exercise any right by emailing info@soi.marketwith subject “PDPA”.

7. Cookies

We use a small set of cookies for your language preference (soi_lang), auth session, and PostHog analytics, routed through a soi.market proxy. You can block cookies in your browser at any time.

8. International transfers

Some of our processors — PostHog, Sentry, OpenRouter, Mux, and Didit — may store or process data outside Thailand (for example the US or EU). We select providers with safeguards no lower than Thailand's, such as Standard Contractual Clauses.

9. Changes

If we update this policy we'll update the page and the effective date above. Material changes will be announced via LINE, email, or an in-app notification.

10. Contact our data officer

Email: info@soi.market(subject “PDPA”), or see other channels at soi.market/contact
Address: Royal Place 1, 22, Lumphini, Bangkok, Thailand

11. Personalization signals

We record what you view, search, favorite, dismiss, message about, and offer on to rank your home feed. This data is not shared outside SOI.market. You can pause or clear your entire history at Privacy settings. Signals are automatically deleted after 180 days.