Privacy policy

1. Who is responsible for your data

This website is operated by PTYXO LLC (“PTYXO”, “I”, “me”), working from Koh Samui and Phuket, Thailand. PTYXO is a one-person business run by Rico Stapel, which means the person handling your data is the same person you are talking to.

For the purposes of the Thai Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and the EU General Data Protection Regulation (“GDPR”), PTYXO is the data controller for the personal data described in this policy.

Contact for any privacy question or request:
Email: [email protected]
Phone / WhatsApp: +66 86 690 0444

2. What I collect and why

2.1 The contact form

When you send me an enquiry I receive whatever you type into the form — typically your name, email address, and your message, along with any phone number or business details you choose to include.

Why: to answer you and, if we go ahead, to quote for and deliver the work.
Lawful basis (GDPR): steps taken at your request prior to entering a contract (Art. 6(1)(b)), and my legitimate interest in responding to enquiries about my own business (Art. 6(1)(f)).
Basis (PDPA): necessity for the performance of, or steps toward, a contract with you (s.24(3)).

2.2 The Website Prompt Generator

The generator itself runs entirely in your browser. The business details you type in are used on your own device to assemble your prompt, and nothing is transmitted to me unless you separately choose to have the prompt emailed to you.

If you tick the box and submit your email address, I receive that email address together with the business details you entered and the prompt that was generated, so that I can send you the promised email and understand the kind of business it was for.

Why: to send you the prompt and the accompanying checklist, and — only if you asked for it — to give you the free review you requested.
Lawful basis (GDPR): your consent (Art. 6(1)(a)).
Basis (PDPA): your consent (s.19).

You gave that consent by ticking a box, and you can withdraw it at any time using the unsubscribe link in any email I send you, or by emailing me. Withdrawing consent does not affect anything I did lawfully before you withdrew it.

2.3 Server logs

Like practically every web server, mine records requests: the IP address making the request, the time, the page requested, the referring page, and your browser's user-agent string. I do not use these logs to build a profile of you.

Why: to keep the site online, diagnose faults and detect abuse.
Lawful basis (GDPR): legitimate interests in the security and reliability of my own systems (Art. 6(1)(f)).

2.4 Clients

If you become a client I will also hold the business and billing information needed to run the engagement and meet my accounting obligations. That relationship is governed by our agreement in addition to this policy.

3. Cookies and tracking

This website sets no cookies of its own, and carries no advertising pixels, no remarketing tags, no session recording and no third-party analytics. That is why you are not being asked to dismiss a cookie banner.

Two things do reach outside the site:

• Google Fonts are loaded from Google's servers, which means Google receives the IP address making the request. If you would rather that did not happen, a content blocker will stop it without breaking the site.
• Outbound links — including the Hostinger referral link on the Prompt Generator page — take you to sites with their own privacy policies and their own cookies. Once you click, you are on their terms, not mine. I earn a commission if you buy through that link; it costs you nothing and, as noted on the page, you receive a discount.

If I ever add analytics, I will update this section before it goes live, and I will use a privacy-respecting tool that does not track you across other websites.

4. Who else sees your data

I do not sell your personal data, and I do not share it with anyone for their own marketing purposes. Ever.

A small number of service providers process data on my behalf, under instruction:

Provider	What it does	What it sees
Web hosting	Serves this website	Server logs, form submissions in transit
n8n (self-hosted by me)	Receives and routes form submissions	Everything you submit through a form
Email provider	Sends and stores my email	Your email address and our correspondence

The automation that handles form submissions runs on my own server rather than a third-party marketing platform, which means your enquiry is not passing through an advertising company on its way to me.

I may also disclose data where I am legally required to — for example to a court, a regulator, or a tax authority.

5. International transfers

I am based in Thailand and some of my providers are located elsewhere, so your data may be processed outside your own country. Where data originating in the European Economic Area or the United Kingdom is transferred, I rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or on your explicit consent where that is the applicable basis.

6. How long I keep it

• Enquiries that do not become work: up to 24 months, then deleted.
• Prompt Generator sign-ups: until you unsubscribe or ask me to delete them, and in any case reviewed every 24 months. If you never open anything I send, I remove you.
• Client records: for the length of the engagement and then as long as Thai accounting and tax law requires.
• Server logs: normally no more than 12 months.

7. Your rights

Under both the PDPA and the GDPR you can ask me to:

• Show you what personal data I hold about you, and give you a copy.
• Correct anything inaccurate or incomplete.
• Delete it, where I have no overriding legal reason to keep it.
• Restrict or object to how I use it, including any use based on legitimate interests.
• Port it — receive it in a common machine-readable format, or have me send it to someone else.
• Withdraw consent at any time, where consent is the basis I relied on.
• Unsubscribe from any email, using the link in that email.

Email [email protected] and I will respond within 30 days. There is no charge. I may need to confirm who you are first, so that I am not handing your data to somebody else.

8. If you are not happy with my answer

Tell me first — it is usually something I can fix the same day. If that does not resolve it, you have the right to complain to a regulator:

• Thailand: the Personal Data Protection Committee (PDPC).
• EEA: the data protection authority in the country where you live or work.
• UK: the Information Commissioner's Office (ICO).

9. Security

The site is served over HTTPS, form submissions are encrypted in transit, systems are kept patched, and access is limited to me. No system is perfectly secure, and I will not pretend otherwise — but if a breach ever affected your data and posed a real risk to you, I would tell you and notify the relevant authority as the law requires.

10. Children

This is a business-to-business service and is not directed at children. I do not knowingly collect data from anyone under 20 (the age of majority under Thai law). If you believe a child has sent me personal data, contact me and I will delete it.

11. Changes to this policy

If I change how I handle your data I will update this page and change the date at the top. Where a change is significant and I hold your email address, I will tell you directly rather than quietly editing the page.