Privacy Policy Copy — /privacy-policy

Privacy Policy

Effective date: [DATE]

Last updated: [DATE]

Klear Vision Co., Ltd. ("Klear", "we", "us", "our") is the data controller for your personal data under the Personal Data Protection Act B.E. 2562 (PDPA).

Registered address: [ADDRESS TBD — pending company registration] Privacy contact: privacy@kleareyes.com

We collect the following data when you use our services or place an order with Klear:

Data you provide directly

• First and last name
• Email address
• Phone number
• Shipping address
• Prescription data (SPH, CYL, Axis, ADD, PD for both eyes) — classified as sensitive personal data under PDPA Section 26
• LINE User ID (if you log in with LINE)

Data generated through your use of our service

• Order history
• Chosen payment method type (type only — card numbers never reach our servers)
• Device and browser data, and — only with your consent — analytics and advertising cookies (see Section 6)

We process your personal data for the following purposes and on the following legal bases:

Important: Consent for prescription data is collected via a separate checkbox — it is never bundled with acceptance of our Terms of Service. You may withdraw consent at any time without affecting the lawfulness of any prior processing.

Prescription data is sensitive personal data. We protect it with the highest standards:

• AES-256 encryption via pgcrypto in our database
• Encryption keys held in Supabase Vault — never in source code or configuration files
• Access restricted to only the systems and personnel required to process your order
• Transmitted to the optical lab over a secure channel, for lens manufacturing purposes only
• Retained for 2 years from the date of creation, then deleted or anonymised

We do not sell your personal data. We share it only in the following circumstances:

Service partners required for fulfilment

• Optical lab partner — receives only the prescription data and frame specifications needed for lens production, nothing else
• Payment gateway (Opn Payments / Omise) — receives only the order amount and a tokenised payment reference; card numbers never touch Klear's servers
• LINE Corporation — for LINE Login and LINE OA messaging services, under LINE's own privacy policy

Infrastructure providers (Data Processors)

• Vercel (hosting), Railway (backend), Supabase (database, Singapore), Cloudflare R2 (image storage), Resend (transactional email), Shippop and its carriers (shipping & tracking), Sentry (error monitoring) — all under data processing agreements
• When you use the optional prescription-photo scan, the image is sent to a vision AI model for extraction only, via a zero-data-retention gateway, and is not stored

Analytics & advertising providers (only after you opt in)

• PostHog, Google Analytics 4, Meta Pixel, TikTok Pixel — see Section 6. These run only after you consent via the cookie banner.

International transfers

• Some providers process data outside Thailand (for example, database hosting in Singapore; analytics, advertising, error-monitoring, and AI providers may process data in the United States or elsewhere). Where data is transferred abroad, we rely on the provider's safeguards and the bases permitted under the PDPA.

Other circumstances

• When required by law or by a valid court order
• To protect the rights, property, or safety of Klear and our users

We use cookies and similar technologies in two categories. You control the non-essential category through our consent banner, and you can change your choice at any time via the "Cookie settings" link in the footer of every page. We also record the date and time you gave your consent.

1. Essential cookies (always on) Required for the site to work. They cannot be switched off and are never used for marketing — they cover your shopping cart, sign-in, and remembering your cookie choice. No data is shared with third parties.

2. Analytics and marketing cookies (off until you opt in) These do not run until you press "Accept" in the consent banner. The tools in this category are:

A note on PostHog: before you give consent, PostHog runs in a cookieless, anonymous mode — it counts anonymous visits, sets no cookies, and respects your browser's Do-Not-Track signal. It only begins using cookies and linking activity to your account once you opt in to the "Analytics and marketing" category.

We do not sell your personal data. The third-party tools above operate under their own providers' privacy policies.

As a data subject, you have the following rights:

To exercise any of these rights: email privacy@kleareyes.com stating which right you wish to exercise. We will respond within 30 days.

In the event of a personal data breach, Klear will notify the Office of the Personal Data Protection Committee (PDPC Thailand) within 72 hours, and will notify affected individuals without undue delay, in accordance with PDPA Section 37.

We may update this policy from time to time. Material changes will be notified to you via email or LINE OA, with a new effective date. Continued use of the service after notification constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Email: privacy@kleareyes.com LINE OA: @kleareyes