What I collect, and why

The contact form asks for the minimum I need to give you a useful first reply. Nothing on this site is mandatory beyond a way to contact you back.

• Your name, so I know who I am talking to.
• Your email address, so I can reply.
• The kind of work you need, picked from a short list of options.
• Your message: the few sentences you write describing the project.
• Basic delivery metadata your browser sends with any request (rough timestamp, the message reaching my inbox). I do not run trackers that build a profile of you.

Under Thailand's Personal Data Protection Act (PDPA), I have to be able to point to a lawful reason for holding your data. Mine are simple:

• To answer you and discuss your project. When you send the form, you are asking me to get in touch, so this rests on taking steps at your request before any agreement (and on your consent in sending it).
• To prepare a proposal or contract, if we move forward. This rests on the steps needed to enter into a contract with you.
• To keep a light record of who I have spoken to, so I do not lose your thread or contact you in error later. This rests on my legitimate interest in running the studio honestly, balanced against your privacy.

I use what you send to reply, to understand and scope the work, and to write you a proposal if it is a fit. I do not sell your data. I do not rent it. I do not add you to a marketing list. There is no newsletter you have to escape from.

I do not have a team, so no employee reads your message. A small number of trusted service providers (processors) handle the plumbing that gets your message to me and keeps the site running. They act on my instructions only.

• Email delivery, to carry the form submission to my inbox.
• Hosting and serverless infrastructure, to serve the site and process the form.
• Storage, to hold the short record described above.

These are named, and the cross-border note below explains where they sit.

Some of the providers I rely on are based in the United States or run their infrastructure outside Thailand. That means your data may be transferred and processed abroad. I keep the list of processors short and reputable, and I only use ones that commit to recognised data-protection safeguards.

• Email delivery: Resend (United States).
• Hosting and serverless functions: Vercel (United States).
• Storage: Upstash (operates outside Thailand).

If you would rather not have your data leave Thailand, message me on LINE instead of the form and we can keep the conversation there.

I hold what you send for twelve months from your last contact with me. After that it is purged automatically. The only exception is data tied to an active or completed engagement, which I keep as long as I am legally required to (for tax and accounting), and no longer.

You do not have to wait twelve months. Ask me to delete your data sooner and I will.

The PDPA gives you real, exercisable rights. To use any of them, email hi@prom.work. I will confirm who you are, then act within the timeframe the law sets (and usually a lot faster).

Access

Ask for a copy of what I hold about you.

Correction

Tell me to fix anything that is wrong or out of date.

Deletion

Ask me to erase your data, and I will, unless I am legally required to keep a specific record.

Withdraw consent

Change your mind at any time. Withdrawing consent does not undo anything already done lawfully before you withdrew it.

Object and restrict

Ask me to stop or pause a particular use of your data.

Portability

Ask for your data in a portable form where that applies.

Complain

If you think I have mishandled your data, you can complain to Thailand's Personal Data Protection Committee (PDPC). I would rather you tell me first so I can fix it.

This site is deliberately quiet. There are no advertising cookies, no third-party trackers, and no consent wall to click through, because there is nothing to consent to. Any analytics I run are cookieless and aggregate: I might see that a page was visited, never who visited it. The only state the site keeps is the language you chose, so the site does not ask you twice.

This is a service for businesses. It is not aimed at children, and I do not knowingly collect data from anyone under the age the PDPA protects. If you believe a minor has sent me data, email me and I will remove it.

If I change how I handle data, I will update this page and the date at the top. The current version always lives here.