Privacy notice

1. Who we are

Data controller: [COMPANY NAME], [COMPANY ADDRESS].

Contact for privacy questions and requests: privacy@braingains.app.

2. What we collect

• The MAP report you upload or email to us. It may include your child's name, school, grade, student ID and test scores.
• The scores we read from the report. We remove names and ID numbers from them.
• Your child's first name, read from the report (or typed in by you), so the explanation can use it. It is shown in your browser and included in any explanation email we send you. We don't store it with the scores or with practice-pack requests.
• If you ask for the 4-week practice pack: your email address, your LINE ID (optional), the scores (without names), the language you used and the advertising campaign that brought you to the site.
• If you email a report to us: your email address and the email itself.
• Technical data: your IP address (used in hashed form to prevent abuse) and, only if you accept cookies, advertising cookies from Google and Meta.

3. Why we use it, and our legal basis

• To read the report and show you the explanation you asked for. Legal basis: your request and consent as the child's parent or guardian (PDPA sections 19, 20 and 24(3)).
• To check and improve the accuracy of our explanations. We keep uploaded reports for up to 30 days for this. Legal basis: legitimate interest (section 24(5)).
• To prepare and send the 4-week practice pack and contact you about it, if you ask for it. Legal basis: consent (section 19).
• To protect the service from abuse and bots. Legal basis: legitimate interest (section 24(5)).
• To measure our advertising with Google and Meta, only if you accept cookies. Legal basis: consent (section 19).

4. Children's information

MAP reports are about children. We only process a report when a parent or guardian confirms they are the parent or guardian and asks us to explain it. We do not knowingly collect information directly from children.

5. Who processes it for us, and transfers outside Thailand

We use service providers that process data on our behalf under contract. Some are located outside Thailand, so your data may be transferred to the United States or Singapore, with contractual safeguards (such as standard data protection clauses) as required by PDPA section 28–29:

• Vercel (website hosting and private file storage).
• Anthropic (the AI model that reads the numbers in the report; its commercial API does not use this data to train models).
• Resend (sending and receiving email).
• Cloudflare (bot protection), if enabled.
• Google and Meta (advertising measurement), only if you accept cookies.

6. How long we keep it

• Uploaded and emailed reports, and the record of what we read: deleted automatically after 30 days.
• Practice-pack requests (email, LINE ID, scores): deleted automatically after 90 days, unless you become a customer.
• Your child's first name: never stored with the scores or practice-pack requests. It appears only in the report itself (deleted after 30 days) and in the explanation email we send you.

7. Your rights

You can ask to access or get a copy of your data, to correct it, to delete it, to restrict or object to its use, to move it to another provider, and to withdraw your consent at any time (this does not affect processing before withdrawal). You can also complain to the Office of the Personal Data Protection Committee (PDPC).

8. How to ask us to delete your data

Email privacy@braingains.app with the subject “Delete my data” and tell us the email address you used and roughly when you uploaded or sent the report. We will confirm and delete it within 30 days. You don't need to give a reason.

9. How we protect it

Reports are stored in private storage with random file names that contain no names, sent over encrypted connections, and only our team can access them.

10. Changes

If we change this notice, we will update the date at the top of this page.