Effective date: September 26, 2026
FORTAL ENTERTAINMENT COMPANY LIMITED ("Company", "we", "us"), as the data controller for the SiamShort app (the "Service"), respects your privacy. This policy explains what data we collect, why we use it, who we share it with, and your rights under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
1. Information We Collect
Account information
- If you sign in with Google or Apple: your name, email address, profile photo, and the account identifier that provider sends us. (If you choose Apple's Hide My Email, we receive a relay address instead.)
- If you sign in with email: your email address and a one-time verification code (kept only briefly to verify you).
- The display name shown in the app and in chat.
Device and connection information
- A device identifier generated by the app, device model, operating system, app version, and selected language.
- A push notification token.
- IP address and system logs, such as request times and the features used.
Usage information
- Watch history, playback position, saved titles, unlocked episodes, and in-app searches.
- Messages you send in episode chats.
Transaction information
- Credit balance, history of credits earned and spent, VIP status and billing period, and purchase confirmations from the App Store or Google Play.
- We do not receive or store your card number or payment details; those stay with Apple or Google.
Advertising information
- When you watch ads, ad providers such as Google AdMob may collect your device's advertising ID and ad interaction data. We keep records of rewarded ad views to grant rewards and prevent fraud.
Information you send us
- The content and contact details of emails or support requests you send us.
We do not intend to collect sensitive personal data (such as health, religious, or biometric data). Please do not share such information in chat.
2. How We Use Your Information and Our Legal Bases
- To provide the Service under our contract with you: create and manage your account, stream video, remember your history and playback position, unlock episodes, manage credits and VIP membership, restore purchases, and provide support (contract).
- To keep the Service safe and prevent fraud: verify identity, validate purchases and ad views, prevent misuse, and moderate chat (legitimate interests).
- To improve the Service: analyze overall usage, fix errors, and develop content and features (legitimate interests).
- To send service notifications, such as new episodes of titles you follow (legitimate interests; you can turn notifications off in your device settings), and to show personalized ads where you allow it (consent).
- To comply with the law: keep accounting and tax records and respond to requests from authorities with legal power to make them (legal obligation).
If you do not provide information needed for the Service, for example by not signing in, some features may not work or your entitlements may not be tied to your account.
3. How We Share Information
We do not sell your personal data. We share it only as needed with:
- Service providers that process data on our behalf: BytePlus (cloud hosting, database, and video delivery), Google (Google Sign-In, Firebase Cloud Messaging for notifications, Google AdMob for ads, and Google Play billing), Apple (Sign in with Apple and the App Store), and Resend (sending verification emails). These providers use data on our instructions, or under their own privacy policies where they act as data controllers.
- Other users: your display name and the messages you send in chat are visible to other viewers of the same episode.
- Partner Studios: aggregated viewing statistics that do not identify you.
- Government authorities or others where required by law, or to protect the rights, safety, and property of the Company and our users.
- A successor business in a merger or transfer, which must protect your data in line with this policy.
4. International Transfers
Our systems and some providers are located outside Thailand, for example BytePlus data centers in Singapore and services operated by Google and Apple. We follow the PDPA requirements for such transfers by choosing providers with adequate data protection standards and by using agreements or safeguards recognized by law.
5. How Long We Keep Information
- Account and usage data: for as long as your account is active, and deleted or anonymized within a reasonable time after you ask us to delete your account.
- Inactive guest data: may be deleted after a long period of inactivity.
- Email verification codes: kept for a few minutes until they expire.
- Transaction records: for the period required by accounting and tax laws (generally at least 5 years).
- System logs: only as long as needed for security and troubleshooting.
- Chat messages: until removed by a moderator or when your account is deleted.
6. Security
We use appropriate measures to protect your data against unauthorized access, use, alteration, or disclosure, including encryption in transit (HTTPS), encryption of stored secrets, access limited to those who need it, and network isolation of our databases. No system is completely secure, however. If a data breach poses a risk to you, we will notify you and the relevant authorities as required by law.
7. Your Rights
Under the PDPA you have the right to:
- access your personal data and receive a copy;
- have your data transferred to another controller where technically possible;
- have inaccurate or outdated data corrected;
- have your data deleted, destroyed, or anonymized;
- have the use of your data restricted;
- object to processing based on legitimate interests;
- withdraw your consent at any time, without affecting processing carried out before withdrawal;
- lodge a complaint with the Office of the Personal Data Protection Committee if you believe we have not complied with the law.
To exercise these rights, including requesting deletion of your account, contact us using the details in section 10. We may ask for information to verify your identity first, and we will respond within the period required by law (no later than 30 days after receiving your request). We may decline certain requests where the law allows, such as when we must keep data to meet a legal obligation, and we will tell you why.
8. Ad and Device Settings
You can limit the use of your advertising ID or turn off personalized ads in your device settings (iOS: Settings > Privacy & Security > Tracking and Apple Advertising; Android: Settings > Google > Ads), and you can turn off app notifications in your device's notification settings.
9. Minors
The Service is not directed to children under 13, and we do not knowingly collect data from children in that age group. Users under 20 should use the Service with the consent of a parent or guardian. If you are a parent and believe a child in your care has given us information without consent, please contact us so we can delete it.
10. Contact Us
If you have questions about this policy or wish to exercise your rights, contact:
FORTAL ENTERTAINMENT COMPANY LIMITED
Tax ID: 0105569063578
Address: 429/3 Sukhonthasawat Road, Lat Phrao Subdistrict, Lat Phrao District, Bangkok 10230
Email: support@siamshort.com
11. Changes to This Policy
We may update this policy from time to time. The current version will be available in the app with its effective date. If a change is significant, we will notify you through the app or another appropriate channel before it takes effect.