Privacy policy

(to be provided), (to be provided), operator of the NitiBulk website. For anything about personal data, write to privacy@nitibulk.com.

• Your account email and password — the password is hashed by the authentication provider; we never see the real one.
• Saved searches, shortlists, and a record of the exports you have run.
• Payment details — handled entirely by Stripe. We keep only a customer ID and which plan is active. We never hold a card number.
• Hashes of IP addresses and of email addresses, used to rate-limit sign-in, sign-up and password-reset attempts. Those tables hold nothing that can be read back into an IP address or an email address.

• Running the service you signed up for — signing in, searching, exporting, saving searches: contractual basis.
• Taking payment and issuing receipts: contractual basis and legal obligation.
• Stopping password guessing and abuse: legitimate interest.
• Sending alert emails for searches you saved yourself: contractual basis, and you can stop them at any time from the link in the email.

We use outside providers only where running the service requires it: Vercel (hosting), Supabase (database and authentication), Stripe (payments), Resend (email) and the Google Maps Platform (resolving a company's place ID). Their servers sit outside Thailand, so using our service involves transferring data abroad. We pick providers whose data-protection standards match or exceed what Thai law requires.

We do not sell, trade or disclose your personal data to anyone for marketing.

Account data is kept while the account is in use and deleted within 90 days of closing it, except records that tax law requires us to keep longer. The hashes used for rate limiting expire on their own short cycle.

Under sections 30 to 36 you may request access, a copy, correction, erasure, suspension of use, objection to processing, portability, and withdrawal of consent. Send requests to privacy@nitibulk.com. We answer within 30 days. If you are not satisfied with the outcome, you may complain to the Office of the Personal Data Protection Committee.

The company registration data shown on this site belongs to legal entities, which section 6 of the Personal Data Protection Act does not treat as personal data, and it is a dataset the Department of Business Development already publishes. We hold no director names, no shareholder names, and no natural person connected to any company.

A business owner who wants their company's data removed can do so at the opt-out page, free of charge.

We use only the cookies the service needs to work: a session cookie that keeps you signed in. There are no advertising or cross-site tracking cookies.

If anything material changes, we email the address on your account before it takes effect.