Privacy Policy

Who controls your data

The data controller is [COMPANY LEGAL NAME], registration number [REGISTRATION NO.], [REGISTERED ADDRESS].

For any privacy question or request, contact hello@morea-essential.com.

What we collect

Waitlist: your email address, your language, and which page you signed up from.

Contact form: your name, email address, the topic you chose, and your message.

Orders: your name, delivery address, phone number, email address, what you ordered, and a reference to your payment. We do not receive or store your full card number.

Chat widget: the messages you type into it, and the language of the page.

Automatically: your IP address, browser type, and pages viewed — through analytics, and only if you accept analytics cookies.

Why we use it, and on what basis

To fulfil your order, deliver it, and handle returns — necessary to perform our contract with you.

To answer a message you sent us — our legitimate interest in responding to enquiries.

To email you about launch and offers if you joined the waitlist — your consent, which you can withdraw at any time.

To keep accounting and tax records — to comply with a legal obligation.

To understand how the site is used and improve it — your consent, given through the cookie banner.

Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract:

Payment provider — to take payment and handle refunds. Your card details go to them directly, not to us.

Delivery carriers — your name, address and phone number, so they can deliver your order.

Resend (email delivery, United States) — to send order confirmations and waitlist emails.

Google Analytics (United States) — usage statistics, only if you accept analytics cookies.

Anthropic (United States) — the chat widget sends the messages you type to Anthropic's API to generate a reply. Please do not enter sensitive personal information into the chat.

Railway (hosting) — our website and database run on their infrastructure.

We may also disclose data where the law requires it.

Sending data outside Thailand

Some of the providers above are outside Thailand, mainly in the United States. Where we transfer your personal data abroad we do so on the safeguards permitted by the PDPA, including contractual protections with those providers.

If you would like details of the safeguards for a specific provider, ask us.

How long we keep it

Order and transaction records: kept as long as tax and accounting law requires, then deleted.

Waitlist entries: until you unsubscribe or ask us to delete them.

Contact form messages: up to two years after the matter is closed.

Chat conversations: retained only as long as needed to operate and improve the assistant.

Analytics: as configured in Google Analytics.

Your rights under the PDPA

You have the right to access your personal data and get a copy of it.

You have the right to have inaccurate data corrected.

You have the right to ask us to delete your data, and to object to or restrict how we use it.

You have the right to receive your data in a portable form.

Where we rely on your consent, you have the right to withdraw it at any time. Withdrawing consent does not affect anything done before you withdrew it.

To exercise any of these, email hello@morea-essential.com. We will respond within the time the PDPA allows. If you are not satisfied, you may complain to Thailand's Personal Data Protection Committee.

Cookies

Cookies that are needed for the site to work — remembering your cart, keeping you logged in to the admin area, remembering your cookie choice — are always on. They do not track you across other sites.

Analytics cookies are only set if you accept them in the banner. You can change your mind at any time by clearing your browser's site data for morea-essential.com.

Children

This site is not intended for children. We do not knowingly collect personal data from a child. If you believe a child has given us data, contact us and we will delete it.

Security

We use encrypted connections, restrict who on our team can access personal data, and keep payment card handling entirely with our payment provider.

No system is perfectly secure. If a breach affects your rights, we will notify you and the authorities as the PDPA requires.

Changes

We may update this policy. The date at the top shows when it last changed. If a change materially affects your rights, we will tell you directly.