Privacy policy

1. Data controller

FindBack is operated by Agathit Domrongwatanagoon as an individual. For anything about your personal data, email [email protected] or use the "Contact the team" button at the bottom of every page.

2. Data we collect

• Account: display name, email, profile picture and user ID from Google or LINE when you sign in (we never store passwords).
• Posts: photos, text, category, identifiers (such as plate numbers), pin location, dates, where an item was left, and the phone number/LINE ID you choose to add.
• Contacts: when you press the contact button on a listing, we record which account contacted which listing, when, and the answer to whether the item was returned
• Listings our team imports from public posts (such as public Facebook groups where people post about lost or found licence plates): plate number, province, where the item is kept, a photo of the plate, and the phone/LINE the poster published for contact, with a link to the original post
• Other people's data that appears in posts, such as the name on a found document or an owner's plate number.
• Usage: IP address, device/browser type and time of use, for security and spam prevention.
• Feedback, reports of inappropriate posts, and searches you choose to follow.
• Cookies and on-device storage: only what sign-in needs, plus your choices (language, the welcome card, your last contact details). No advertising or cross-site tracking cookies. Visitor statistics (Cloudflare Web Analytics) use no cookies and do not identify you.

3. Why we use it and the legal basis

• To provide the service you use: posting, searching, matching posts, and notifications about your posts on the site, LINE and email (performance of our terms; you can switch off LINE/email in your profile).
• To show an owner's details in a post, such as a plate number or the name on a document, so the item can get back to them (legitimate interest).
• To keep the service safe, stop spam and scams, and review reported posts (legitimate interest).
• Tell the poster that someone is getting in touch, ask both sides whether the item was returned so finished listings can be closed and counted, and investigate scam complaints (legitimate interest)
• Republish public lost-and-found posts as listings for the same purpose the poster published them, to help items get back to their owners (legitimate interest). The original poster can ask for removal at any time with the report button
• To keep computer traffic data as required by Thailand's Computer Crime Act and comply with orders from authorities (legal obligation).
• We never use your data for advertising or marketing, or sell it.

4. Who can see your data

• Posts are public: photos, text, category, pin location and public identifiers (such as plates) are visible to everyone and may appear in Google search.
• Phone numbers and LINE IDs are shown only when a signed-in user presses the contact button on a listing, and are never in pages Google stores
• Your email and profile picture are not shown to other users. Your display name is shared with a poster only when you contact their listing. Secret numbers (such as IMEI) are used for exact-match search only and never shown
• Service providers we need: Google and LINE (sign-in), email and LINE messaging providers (notifications), hosting, and Cloudflare (attack protection, page delivery and visitor statistics), only as needed to run the service.
• Google (the paid Gemini service) helps read the photos and text of posts our team imports, as a processor on our behalf. Google does not use this data to train its models
• We never sell or rent your personal data.

5. International transfers

Some providers (such as Google, LINE, Cloudflare, hosting and email services) may store data outside Thailand. These transfers are necessary to provide the service you use, and we choose providers with internationally recognised safeguards.

6. How long we keep data

• Posts: expire after 90 days (renewable). Photos and details of posts that have been closed, expired or returned for over 1 year are deleted automatically.
• Account: kept until you delete it. Deleting your account immediately deletes the photos and details of all your posts.
• Activity logs (such as IP address and sign-in time) and notifications: kept for at least 90 days as required by law and no longer than 1 year, then deleted automatically.
• Contact records and answers about whether an item was returned: kept for no more than 1 year, then deleted automatically

7. Your rights

• Access your data and get a copy.
• Correct your data (you can edit your profile and posts yourself).
• Delete your account and personal data (tap "Delete account" in your profile).
• Withdraw consent, for example by turning off LINE/email notifications.
• Object to or restrict processing, and request data portability.
• Complain to Thailand's Personal Data Protection Committee (PDPC) if you believe we have broken the law.
• Use your rights by emailing [email protected] or via "Contact the team". We reply within 30 days.

8. Security

We use encrypted connections (HTTPS), never store passwords, strip GPS data from photos before publishing, limit moderator access by role, and log important actions.

If a personal data breach occurs, we will notify Thailand's PDPC within 72 hours of becoming aware of it, and notify you promptly if it poses a high risk to your rights.

9. Minors

Children under 10 must have a parent or guardian use the service for them. Users aged 10–20 should have a parent or guardian's consent before posting contact details.

10. If you don't provide data

You can browse and search without giving any data. Posting and viewing contact details require signing in. Photos, location, phone number and LINE ID are optional, but without them the other side may not be able to find the item or reach you.

11. Changes

We may update this policy when the service or law changes. The effective date is shown at the top of this page.