Draft, under legal review
Privacy Policy
Last updated 23 October 2026
This is a translation. If it differs from the Thai version, the Thai version prevails.
mongdoo.com (“mongdoo” or “we”) is an online classifieds marketplace. This policy explains what personal data we collect, what we use it for, who we share it with, how long we keep it and your rights under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
1. Data controller
Trin Borwornpatdharapanich, 216/51-52 Kanchanaphisek Road, Thap Chang, Saphan Sung, Bangkok 10250, Thailand, is the data controller for mongdoo.com. For anything about your personal data, contact privacy@mongdoo.com or use the Report a problem page. If we appoint a data protection officer (DPO), their contact details will be listed here.
2. What we collect
Data you give us
- Account: email, display name, profile photo and Google account identifier (if you log in with Google), and your password if you set one. Passwords are stored one-way hashed, so we never see them.
- Listings: photos, title, description, category, condition, price, the province the item is in, translations, and price settings such as your lowest acceptable price, which only you can see.
- Contact details (optional): the phone number and LINE ID you choose to show to buyers.
- Offers, and chat messages between buyers and sellers.
- Reports you send: details, attached screenshots, the page you were on, and browser or device information.
Data created when you use the service
- Technical usage data such as IP address, access times and browser details, logged by our hosting providers.
- Seller contact lookups: which account viewed the contact details of which listing on which day, so nobody can collect phone numbers in bulk.
- Automatic safety checks, such as messages or listings containing phone numbers, bank accounts or links on our watch list, and account status (warned, suspended or banned).
- If you use AI listing help (once offered): visitors who are not logged in are counted by a value derived from their IP address (a hash), not the address itself.
Data we receive from others
- Google: your name, email and profile photo, when you choose to log in with Google.
- LINE: your LINE user ID, name and profile photo, when you choose to log in with or link LINE.
- Other users: messages the other person in a chat sends you, and reports other users file about your listings or account.
Data that stays on your device
- An unsent listing draft, photos included, is kept in your browser for up to 24 hours so nothing is lost while you log in.
- Your current location, if you tap “Use my location”, is used on your device to find the province. We never receive or store the coordinates.
We don't intend to collect sensitive data such as religion, health or biometric data. Please don't put ID card photos, bank account numbers or other sensitive data in listings or chats.
3. What you must provide
- An email address (or Google account) is needed to create an account and log in. Without it you can't post, make offers, chat or send reports, but you can still browse and search.
- Photos, title, category, condition, price and province are needed to post a listing.
- Phone number, LINE ID, screenshots in reports and a password are optional. Without them buyers can still reach you by chat, and you can still log in with an email code or Google.
4. How we use data, and on what legal basis
- Providing the service you signed up for (contract): accounts, login, showing listings, search, offers, automatic offer acceptance and price drops as the seller set them, chat, and letting buyers contact sellers.
- Safety and fraud prevention (legitimate interest): checking messages and listings for reported details, warning users, rate limits, reviewing reports, and suspending or banning accounts that break the rules.
- Improving the service and fixing problems (legitimate interest): reviewing reported problems and technical usage data.
- Legal obligations: keeping usage data as required by the Computer Crime Act and answering lawful requests from authorities.
- Features you choose, such as AI listing help (contract): the photos you pick are sent for analysis to write the description and translations.
Automated decisions: when a phone number, bank account, email, LINE ID or link on our watch list appears, the system shows a warning, sends the case to the team, refuses that phone or LINE ID as a contact detail, and suspends accounts signing up with a listed email straight away. You can ask the team to review any of these through the Report a problem page.
We don't sell personal data and don't use your data for other companies' advertising. If we ever need consent for a new purpose, we'll ask first.
6. How long we keep data
- Account, listings, contact details, offers and chats: as long as you use your account. When you ask us to delete your account, we delete or anonymise your data within 30 days, except data we must keep as described below. Messages you already sent may remain in the other person's chat without your name.
- Listings hidden by the team, reports and their screenshots, reported chats, the watch list and the team's action log: kept as evidence for up to 2 years after a case is closed, or longer if needed for legal proceedings or requested by authorities.
- Login records (time and IP address) and computer traffic data: at least 90 days as required by the Computer Crime Act, and no more than 2 years unless an authority orders longer.
- Contact lookups and AI usage counters: deleted automatically after 7 days.
- Drafts on your device: deleted automatically after 24 hours or once the listing is posted.
7. Your rights
Under the PDPA you have the right to:
- access your personal data and get a copy
- receive your data, or have it sent to someone else, in a commonly used machine-readable format
- have inaccurate data corrected (you can edit most of it yourself in My account and My listings)
- have your data deleted or anonymised
- have the use of your data restricted
- object to uses based on legitimate interest
- withdraw consent you gave, without affecting what was done before
- complain to the Personal Data Protection Committee office (pdpc.or.th)
Send requests to privacy@mongdoo.com or through the Report a problem page, free of charge. We reply within 30 days and may first ask you to confirm your identity. Some requests can't be fully met where the law requires us to keep data. If we refuse a request, we'll tell you why and keep a record of the refusal.
8. Security
- Every page is served over HTTPS.
- The database enforces row-level permissions, so each user sees only what they should: the lowest price only to the seller, chats only to their two participants.
- Passwords are one-way hashed, and screenshots attached to reports are kept in private storage.
- The team only accesses what it needs, and every team action is logged.
If a personal data breach puts your rights and freedoms at risk, we will notify the PDPC office within 72 hours of becoming aware of it and tell you without delay as the law requires.
10. Minors
The service is meant for adults. Anyone under 20 needs a parent's or guardian's consent before using it. If we learn we hold a minor's data without the consent the law requires, we'll delete it.
11. Changes to this policy
We may update this policy as the service or the law changes. The date of the last update is shown at the top of this page. For significant changes we'll give notice on the site or by email before they take effect.