Privacy Policy

We only collect what we need to teach you Thai. This page explains what that is, why we collect it, how long we keep it, and what rights you have over it under the EU GDPR and Thailand's Personal Data Protection Act (PDPA).

Effective date: May 20, 2026

1. Who we are (data controller)

"Learn Thai With Ron" is operated by Patanapasa, based in Chiang Mai, Thailand. For any privacy-related question or to exercise the rights listed in section 8 below, contact us at contact@patanapasa.com. We are the data controller for the personal data you submit through this website.

2. What we collect

When you fill in the signup form, we collect:

• Your email address — so we can send you class info and reminders.
• Your course interest — whether you chose the 10-Week Group Class or Private Lessons.
• A referral code if you arrived via a tracked link (e.g. ?ref=yts).

When you simply load the page (no form submission), we collect:

• Your IP address — for fraud and bot protection, basic traffic counts, and security logs.
• Your browser's user-agent string — so we can tell humans from bots and debug rendering issues.

If you go on to pay for a course, our payment processor (Stripe) collects the billing info you give it. We never see or store your card details ourselves — Stripe handles all that under its own privacy terms.

3. Why we collect it (lawful basis)

Under the GDPR and PDPA, we need a lawful basis to process your data. Ours are:

• Consent — when you submit the email form, you are giving us consent to email you about our courses. You can withdraw this consent at any time (section 8).
• Performance of a contract — once you enroll and pay, we process your data to actually deliver the course (send Zoom links, course materials, replays).
• Legitimate interest — IP address and user-agent are processed for security, fraud detection, and basic site analytics. We have weighed our interest in operating a functional, non-spammed site against your privacy interests, and we use this data narrowly for those purposes only.
• Legal obligation — we may process and retain data where required by Thai law (e.g. tax records for paid enrollments).

4. Who we share data with (third-party processors)

We use a small number of trusted service providers to actually run the site and deliver the course. Each only sees what they need:

• Vultr (Singapore) — hosts the website and the database where your email is stored.
• Cloudflare (United States) — provides invisible bot protection on our signup forms via Cloudflare Turnstile. Cloudflare processes minimal signals (typically your IP address, user-agent, and TLS fingerprint) to tell humans apart from automated traffic; the data is not used for advertising and is described in the Cloudflare Turnstile Privacy Addendum. By submitting a form on this site, you consent to this processing.
• Resend (United States) — delivers the emails we send you. They see your email address and the message content. Resend's privacy policy.
• Anthropic (United States) — we use Claude AI to draft personalized emails to you. Anthropic processes the prompt context (your interest tier, refcode, and our message template) but does not retain your data for training. Anthropic's privacy policy.
• Stripe (United States / Ireland) — processes payments if you enroll. Stripe sees the data you enter into its checkout form. Stripe's privacy policy.
• Zoom (United States) — hosts the live class video. If you join a class, Zoom collects what its own terms describe. Zoom's privacy policy.
• Google Workspace (United States) — Patanapasa's business email (Gmail) is hosted by Google. Replies you send to us live in Gmail.
• Meta (Facebook/Instagram) (United States) — when you visit this site, the Meta Pixel sends Meta a record of your page view and any signup events, so we can measure the performance of our advertising and reach people who may be interested in our courses. Meta processes your IP address, browser user-agent, and the page URL. Meta's privacy policy.
• TikTok (United States / Singapore) — the TikTok Pixel sends TikTok similar page-view and signup events, used to measure ad performance and reach interested audiences on TikTok. TikTok's privacy policy.
• Google (Ads & Analytics) (United States) — we use Google Ads conversion tracking and Google Analytics 4 to measure ad performance and understand in aggregate how visitors use the site. Both products send Google a record of your page views and signup conversions, including your IP address and browser. Google's privacy policy.

We do not sell your data, rent it, or share it with advertisers.

5. International data transfers

Several of the providers above are located in the United States. When data is transferred from Thailand or the EU/EEA to the US, we rely on the providers' own appropriate safeguards (typically Standard Contractual Clauses with EU customers, and for Thailand users, your consent given through this policy plus the providers' SCC frameworks). You acknowledge and consent to these transfers by using the site.

6. How long we keep your data

• Email leads (not enrolled): 24 months from your last interaction, then deleted.
• Enrolled students: retained for the duration of the course plus 5 years afterward, for tax records and course history.
• Server logs (IP, user-agent): 90 days, then automatically rotated.
• Class recordings: retained as long as the cohort it relates to is active, plus 12 months for replay access by paid students.

If you ask us to delete you sooner (section 8), we will, except where Thai tax law requires us to keep enrollment records longer.

7. Cookies and analytics

This site uses cookies and similar technologies for two distinct purposes:

• Essential cookies. A session cookie called LTWR_ADMIN is set only when an administrator logs into the admin panel. It is not used for visitors.
• Marketing and analytics. We use the Meta Pixel, TikTok Pixel, Google Ads conversion tag, and Google Analytics 4 to measure how our paid advertising performs and to understand visitor behavior in aggregate. These services set their own cookies and may use them to serve you relevant advertising on other sites you visit. Section 4 lists each provider and links to their privacy policy.

If you do not want this tracking, you can block third-party cookies in your browser settings, use a tracking-blocker extension, or opt out of personalized ads directly with each platform: Meta, TikTok, and Google. Blocking these does not affect your ability to use the site or sign up for a course.

8. Your rights

Under both GDPR and the Thai PDPA you have the following rights over the personal data we hold about you. To exercise any of them, email contact@patanapasa.com. We will respond within 30 days (often much sooner).

• Right of access — ask for a copy of all the data we hold about you.
• Right to rectification — ask us to correct anything that's wrong.
• Right to erasure ("right to be forgotten") — ask us to delete your data. We will do so unless we are legally required to retain it (e.g. tax records on a paid enrollment).
• Right to restrict processing — ask us to pause processing your data while a question is being resolved.
• Right to data portability — ask for your data in a portable, machine-readable format.
• Right to object — object to processing based on our legitimate interest.
• Right to withdraw consent — withdraw consent for marketing emails at any time. Every email we send will contain an unsubscribe link. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
• Right to lodge a complaint — if you believe we have mishandled your data, you may lodge a complaint with the relevant authority. In Thailand: the Personal Data Protection Committee (PDPC). In the EU/EEA: your local Data Protection Authority.

9. Children

This service is intended for adults learning Thai. We do not knowingly collect data from anyone under 16. If you are a parent or guardian and believe your child has submitted data to us, please contact us and we will delete it.

10. Session recording and class consent

Live Zoom classes may be recorded for the benefit of enrolled students who missed the live session. By joining a class, you consent to being recorded. If any portion is later used in public-facing content (e.g. course samples, social media), participants' faces and voices will be redacted, blurred, or otherwise altered before publication.

11. Security

The site runs over HTTPS. Our database is on a private server. Admin access is password-protected and rate-limited. We follow reasonable industry practices for a small business, but no internet-connected system can guarantee absolute security. If a breach affecting your data ever occurs, we will notify the relevant authority within 72 hours and notify you without undue delay, as required by law.

12. Changes to this policy

We may update this policy from time to time. The effective date at the top of the page will reflect the latest revision. Material changes will be announced via email to active subscribers. Your continued use of the service after a change indicates acceptance of the revised policy.

13. Contact

Questions, requests, or complaints about this policy: contact@patanapasa.com.