Who we are
Hikaro Studio Company Limited, a company registered in Thailand under number 0205569039102, whose registered office is at 1/111 Moo 9, Pong Subdistrict, Bang Lamung District, Chon Buri 20150, Thailand, is responsible for the personal data described here.
Contact for any question about your data: laurent@hikaro-studio.com.
Our representative in the European Union, under Article 27 of the GDPR: Laurent Pochon, 31 rue Prunier, 33300 Bordeaux, France.
What this policy covers
This policy covers this website, our client portal (the Front Desk), and our dealings with our clients.
When we work on a client’s code, any personal data we come across in it belongs to that client: we process it only on their instructions, under the data processing agreement we sign with them. That data is covered by the client’s own privacy policy, not this one.
On this website
- No cookies, no advertising. The site sets no cookie and shows no advertising; even its fonts are served by us.
- Visit counts, without cookies. We count visits with Cloudflare Web Analytics, which sets no cookie and doesn’t follow you from one site to another. It tells us, in aggregate, which pages are read, from which countries, and which sites visitors come from.
- Connection logs. Our host, Cloudflare, processes technical data for each visit (IP address, time, page, browser) to deliver the site and protect it. We keep no connection logs ourselves.
- The request form. When you describe your app, we receive your description and your email address. They are sent to our sales mailbox through Amazon Web Services, with the language of the page and, when the link you followed carries one, the campaign that brought you (an advertisement, for example). We use them only to answer you, prepare an estimate, and know which of our pages and campaigns work. If they don’t lead to a contract, we delete them after 12 months.
In the client portal
- Your account. Your name, your email address and your company. Sign-in is handled by WorkOS.
- Your team. The people you invite, by name and email address. An invitation link is valid for 14 days.
- Your projects. Your requests, the tickets, your approvals and their delivery notes.
- Billing. Your billing details and invoices, handled by Stripe. We never see or store your card number.
- One cookie. A session cookie that keeps you signed in, for 30 days at most. It is strictly necessary, so it needs no consent.
We send you the emails the service needs: invitations, reports on your projects, receipts and invoices.
Why, and on what basis
| What we do | Legal basis |
|---|---|
| Answering a request sent from the website | The steps you asked for before a contract, and our legitimate interest in answering |
| Running the client portal and delivering the service | Performance of our contract with your company |
| Billing and keeping accounting records | Our legal obligations |
| Keeping our systems secure | Our legitimate interest |
How long we keep it
- Requests from the website: 12 months, unless they lead to a contract.
- Portal accounts: for as long as your company is a client, then 12 months, then deleted.
- Invoices and accounting records: 5 years, as Thai law requires.
- System logs: 30 days.
- Database backups: 7 days.
- Records of the work on your projects: 24 months after delivery.
Who receives it
Only the companies that help us run the service, each for its own task: they are listed on our sub-processors page. We never sell personal data, and we disclose it to an authority only when the law requires us to.
Transfers outside your country
We are based in Thailand, and our main providers are in the United States. Transfers of personal data from the European Economic Area rely on the European Commission’s standard contractual clauses, or, for a company certified under it, on the EU–US Data Privacy Framework.
Security
We protect personal data with measures suited to the risk, including encrypted connections and access limited to the people who need it.
Your rights
You can ask to access your data, correct it, delete it, restrict or object to its use, or receive it in a portable format. Write to laurent@hikaro-studio.com; we reply within one month.
You can also complain to a supervisory authority: the data protection authority of your country in the European Union, or Thailand’s Personal Data Protection Committee.
Changes
If this policy changes, the new version is published here with its date. Changes that affect our clients are also sent to them by email.