นโยบายความเป็นส่วนตัว · Privacy Policy

KLEAR EYES OPTICAL Co., Ltd. ("Klear", "we", "us", "our"), company registration no. 0105569147615, is the data controller for your personal data under the Personal Data Protection Act B.E. 2562 (PDPA).

Registered head office: 243/175 The Lofts Asoke Building, Room 2905, 29th Floor, Soi Sukhumvit 21, Sukhumvit Road, Khlong Toei Nuea, Watthana, Bangkok 10110

Privacy contact: privacy@kleareyes.com

We collect the following data when you use our services or place an order with Klear:

Data you provide directly

• First and last name
• Email address
• Phone number
• Shipping address
• Prescription data (SPH, CYL, Axis, ADD, PD for both eyes) — classified as sensitive personal data under PDPA Section 26
• LINE User ID (if you log in with LINE)

Data generated through your use of our service

• Order history
• Chosen payment method type (type only — card numbers never reach our servers)
• Device and browser data, and your activity on the site, such as pages visited, products viewed, items added to your cart and purchases (see Section 6)
• Only with your consent: the cookie identifiers of our analytics and advertising tools (see Section 6)

We process your personal data for the following purposes and on the following legal bases:

Important: Consent for prescription data is collected via a separate checkbox — it is never bundled with acceptance of our Terms of Service. You may withdraw consent at any time without affecting the lawfulness of any prior processing.

Prescription data is sensitive personal data. We protect it with the highest standards:

• AES-256 encryption via pgcrypto in our database
• Encryption keys held in Supabase Vault — never in source code or configuration files
• Access restricted to only the systems and personnel required to process your order
• Used to make your lenses in our own lab. We do not send your prescription to an outside lab
• Retained for 2 years from the date of creation, then deleted or anonymised

We do not sell your personal data. We share it only in the following circumstances:

Lens production

• We cut every pair of lenses in our own lab in Bangkok, so your prescription is not sent to an outside lab.
• If we later sell a lens type we cannot make ourselves, such as progressive lenses, that lens type will be made by an outside lab, which will receive only the prescription and frame specifications needed to make it. We will update this policy, and tell you before you order that lens type.

Service partners required for fulfilment

• Payment gateway (Opn Payments / Omise) — receives only the order amount and a tokenised payment reference; card numbers never touch Klear's servers
• LINE Corporation — for LINE Login and LINE OA messaging services, under LINE's own privacy policy

Infrastructure providers (Data Processors)

• Vercel (hosting), Railway (backend), Supabase (database, Singapore), Cloudflare R2 (image storage), Resend (transactional email), Shippop and its carriers (shipping & tracking), Sentry (error monitoring) — all under data processing agreements
• When you use the optional prescription-photo scan, the image is sent to a vision AI model for extraction only, via a zero-data-retention gateway, and is not stored

Analytics & advertising providers (only after you opt in)

• Google Analytics 4, Meta Pixel, TikTok Pixel and PostHog in cookie mode run only after you consent via the cookie banner. With your consent, our server also reports paid orders directly to Meta and TikTok (see Section 6).
• For the data they receive, Google, Meta and TikTok act as independent data controllers, or in some cases as joint controllers with us, and use the data under their own privacy policies: Google, Meta, TikTok

Cookieless measurement provider (no consent needed)

• PostHog, Inc. (processing in the United States), as our processor: counts usage without identifying you until you make a choice (see Section 6).

International transfers

• Some providers process data outside Thailand: database hosting in Singapore, and analytics, advertising, error-monitoring and AI providers in the United States or other countries, whose data protection standards may not be equivalent to Thailand's.
• For consent-based analytics and advertising tools, the transfer is based on your consent (Section 28). For processors, we rely on standard contractual clauses or other appropriate safeguards under Section 29.

Other circumstances

• When required by law or by a valid court order
• To protect the rights, property, or safety of Klear and our users

Our site uses cookies and measurement at three levels. You choose the non-essential level through our consent banner, and you can change your choice at any time via the "Cookie settings" button at the end of this page, or in the footer of our home and shop pages. Your browser keeps a record of your choice and the date and time you made it, and we keep a copy of every choice on our server: the choice, the version of the cookie banner and the time, under a random ID stored with the choice in your browser, without your name or account, so we can show whether consent was given.

1. Essential cookies (always on) Required for the site to work. They cannot be switched off and are never used for marketing. They cover your shopping cart, sign-in, and remembering your cookie choice. No data is shared with third parties.

2. Measurement that does not identify you (cookieless) Until you make a choice, we use PostHog to count usage without identifying you, so we can see where visitors come from and at which step of an order they stop.

What is counted:

• Pages visited, and where the visit came from (the referring website and any campaign utm parameters)
• The steps of an order: viewing a product; saving or removing a favourite; choosing lenses (with prices); the steps of the prescription form (whether a vision type was chosen, never which one; how the prescription is given; the photo-scan result; and, if you leave part-way, the field reached, never the values you entered); adding to or removing from the cart; starting checkout; a lens upgrade; whether a promo code worked (never the code); saving the delivery address (the total only); choosing a payment method; pressing pay; a failed payment and the stage it failed at; the QR code being shown or the hand-off to a bank or wallet; the payment result; and completing a purchase, with its value in baht
• Clicks through to our LINE account (with the page it was clicked on), signing in by email, and submitting a sign-up (that it happened, and whether you had ordered as a guest before; never what you entered)
• General device information, such as your browser and its version (user agent), operating system, device type, screen size, language and time zone
• PostHog receives your IP address, as any website connection does, uses it to estimate your country and city, and stores it with the usage data

What we never collect:

• No cookies are set, and nothing is linked to your name, email or account
• No prescription data
• Order numbers and other parameters are removed from page addresses before they are sent, and ad click ids are masked

The id used for counting lives only in the memory of the browser tab and changes on every page reload or new tab, so it cannot follow you from one visit to the next. Your browser keeps only a marker that an order has already been counted, so it is not counted twice.

When you choose "Only essential", or withdraw consent, we stop all counting in your browser, including this cookieless counting (the anonymous order statistics below continue); this is the immediate way to exercise your right to object (see Section 7). If your browser sends a Do-Not-Track signal, nothing is counted at this level either.

Anonymous order statistics: our server counts some order events as statistics: a prescription being submitted (whether it was accepted, and a broad lens-strength range), lens upgrades, cancellations and refund requests. These run whatever your cookie choice. Each is sent on its own, with no account, order or device identifier, and we do not link it to you or to any other event.

3. Analytics and marketing cookies (off until you opt in) These do not run until you press "Accept all", or switch on "Analytics & marketing" in your cookie settings. The tools in this category are:

What Google, Meta and TikTok receive when you opt in

• From your browser: the full address of the pages you visit; products you view or add to your cart (product code, frame name and price); starting checkout; and the value of your order. Your browser also sends them the technical data it normally sends, such as your IP address, device and browser type, and their own cookies.
• From our server, once your payment is confirmed (Meta and TikTok): the order value in baht, an event reference, that platform's own cookie and ad-click identifiers, and your browser type (user agent). This means an order is counted even when you pay by PromptPay or a banking app and never return to our site. The platforms use the event reference to count the same order only once.
• To do this, when you press pay we store the Meta and TikTok cookie identifiers (and Google's, which is not currently used for reporting) and your browser type with your cart, and delete them as soon as the report is sent, and in any case within 8 days.
• We do not pass your name, email, phone number, address or prescription to these platforms, and nothing is reported from our server if you have not opted in.

Withdrawing consent: when you switch off "Analytics & marketing", these tools stop running on our site and we delete the cookies they set that our site can reach. We also delete the cookie identifiers stored with the carts you pressed pay for on this device and do not report those orders, unless it was already reported before you withdrew. Data already sent is governed by each provider's own policy.

We do not sell your personal data.

As a data subject, you have the following rights:

To exercise any of these rights: email privacy@kleareyes.com stating which right you wish to exercise. We will respond within 30 days.

In the event of a personal data breach, Klear will notify the Office of the Personal Data Protection Committee (PDPC Thailand) within 72 hours, and will notify affected individuals without undue delay, in accordance with PDPA Section 37.

We may update this policy from time to time. Material changes will be notified to you via email or LINE OA, with a new effective date. Continued use of the service after notification constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Email: privacy@kleareyes.com LINE OA: @kleareyes