Privacy policy

1. Who is responsible

Ngaan is the data controller for the data described here. The Thai operating company is being set up and will be named here. Contact: privacy@ngaan.co.

2. What we store

• Account: your name, email, LINE user ID and profile photo from the login you used.
• Creator profile: handle, province and district, languages, content niches, preferences and rate card. Your birth date is stored privately and used only to check age rules; it is never shown on any public page.
• Connected platforms: the public metrics the platform gives us after you sign in with it — followers, following, post counts, and per-post views, likes, comments, shares and saves. We take a snapshot every day so the history is real, and keep your 30 most recent posts (caption, thumbnail, link, metrics).
• Comments on Instagram and Lemon8 posts, used only to check whether engagement looks genuine.
• Audience demographics (age, city, country and gender breakdowns) only if you give separate consent. These are aggregates; we never receive your followers' identities from TikTok or Instagram.
• Activity on Ngaan: gigs, applications, check-ins (your location only at the moment you use location check-in), deliverables, chat messages and reviews.
• Security: hashed IP and device fingerprints, used only to detect fake reviews. They are never shown to anyone.

3. Why we use it

• To run the service you signed up for: your media kit, search for businesses, gigs and check-ins.
• To verify accounts and calculate scores (authenticity, performance, activity, reliability) — only after you consent to metrics storage. Without that consent we don't sync anything.
• To keep people safe and prevent fraud, and to apply legal rules such as minimum ages and alcohol advertising limits.

4. What is public

Your media kit shows your display name, handle, area, niches, verified metrics, recent posts, rates, scores, completed gigs, no-shows and published reviews.

Never public: your birth date, phone, email, login tokens and private messages.

5. Platform tokens

When you connect TikTok or Instagram we receive read-only tokens. They are encrypted in our database, are never sent to your browser or to businesses, and are deleted when you disconnect.

6. Who we share with

We never sell the dataset, and we don't give or rent it to anyone.

We use service providers that process data for us: Supabase (database and hosting), LINE (notifications), PostHog (product analytics), Anthropic (AI that suggests niches, spots generic comments and translates text) and Apify (reading public Lemon8 profiles). A business sees what's on your media kit and the details of gigs you do with it.

7. Your rights

• You can ask to see your data, correct it, withdraw consent, or take a copy.
• Right to erasure: when you ask us to delete your data, we delete your metric snapshots, posts and comments as well — not just your profile. Withdrawing metrics consent stops all syncing.
• You can also complain to the Personal Data Protection Committee (PDPC) of Thailand.

8. LINE notifications

If you turn on LINE notifications, we send gig updates, check-in reminders and account alerts to your LINE. You can turn them off in settings at any time.

9. Analytics and cookies

We use PostHog to understand which features people use. Events are linked to a pseudonymous account ID and never include your birth date, messages or contact details.

Cookies keep you signed in and remember your language.

10. How long we keep it

We keep your data while your account is active. When you close your account or ask for erasure, we delete it, except records we must keep by law.