Privacy Policy

Effective 5 August 2026

This policy explains how we collect, use, and disclose your personal data. It covers both our website restosheet.com and conversations with the RestoSheet Page on Facebook Messenger.

1. Data controller

RestoSheet is operated by PREPPY COMPANY LIMITED, a company registered in Thailand, acting as the data controller under the Thai Personal Data Protection Act B.E. 2562 (PDPA).

Privacy contact: restosheet@gmail.com

2. Data we collect

2.1 When you order through our website

• Name, email address, phone number, and restaurant name
• Proof of payment (bank transfer slip) used to verify the amount and issue a receipt
• Technical data such as IP address, browser type, and access logs

2.2 When you message our Page on Facebook Messenger

Our Page uses an automated reply system we built ourselves, connected to the Meta Messenger Platform. When you send us a message, we receive and process the following:

Data	Source	Purpose
Page-Scoped User ID (PSID)	Provided by Meta with each message	To send our reply back to you specifically, and to avoid repeating the welcome message within one hour
Message text you send	Submitted by you	To detect whether you are asking about a package, requesting a sample, asking how to order, or checking order status
Email address you type in chat	Voluntarily provided when you request order status	To look up your order and tell you whether the files have been delivered

We do not request access to your friend list, public profile, photos, or your conversations with other Pages. We do not store conversation transcripts in our own database. Message history remains within Meta's systems as part of normal Messenger operation.

3. How we use the data

• Answer questions about our product, pricing, and setup, through automated replies and our team
• Verify payments and deliver the purchased files to you by email
• Report order status when you ask for it
• Improve our service and the information we communicate
• Comply with legal obligations such as accounting and tax record keeping

We do not use Messenger data for personalized ad targeting, and we do not sell your data to third parties.

4. Service providers we share data with

• Meta Platforms operates Messenger and transmits messages between you and our Page
• Vercel hosts our website and the webhook that receives messages
• Google (Google Sheets and Apps Script) stores order records and delivers files
• A payment slip verification provider validates bank transfer slips

We share only what is necessary to deliver the service, and nothing beyond that unless required by law.

5. Retention

Order records are retained for the lifetime of the product to support after-sales service and to meet accounting requirements (tax documents are kept for five years under the Thai Revenue Code). The Page-Scoped ID used to prevent duplicate welcome messages is held temporarily in memory for no more than one hour and then discarded.

6. How to delete your data

You may request deletion of your personal data at any time using either method:

• Email restosheet@gmail.com with the subject "Delete my data", including the email address or phone number used at purchase
• Send the message "Delete my data" to the RestoSheet Page on Messenger

We will process the request within 30 days and confirm once completed, except for records we are legally required to retain, such as accounting and tax documents. To remove the conversation from the Facebook side, delete it from the inbox of your own Facebook account.

7. Your rights under the PDPA

• Access and obtain a copy of your personal data
• Correct inaccurate data
• Request erasure
• Restrict or object to processing
• Request data portability
• Withdraw consent previously given

Send requests to restosheet@gmail.com

8. Cookies and ad measurement

Our website uses the Meta Pixel to measure advertising performance in aggregate, such as how many people view the product page and complete a purchase. You can opt out through your browser settings or the ad preferences in your Facebook account.

9. Security

All connections are encrypted with HTTPS/TLS. Keys and tokens used to connect to external services are stored in our hosting provider's secret environment variables rather than in source code, and access to customer data is limited to team members who need it.

10. Changes to this policy

If we make material changes, we will update the effective date at the top of this page and notify you by email or through the channel you used to contact us.