Privacy Policy

Pongpat Kasemsanrudee, at 35 Soi Srinagarindra 40, Nong Bon, Prawet, Bangkok 10250, Thailand, is the data controller for Plien Roob.

For anything about your personal data, reach us on LINE at @639sbxcm or by email at plienroob@gmail.com.

Account data — your email, the name you set, and a profile picture if you have one, held through the Clerk authentication service.

Usage data — your generation history, remaining credit balance, and every line of your credit ledger.

The images you upload and the images the system generates for you.

Payment data — held entirely by Stripe. We see only whether a payment succeeded, how much it was, and the receipt reference. We never see your card number.

Where you came from — if you arrive from an ad link we record the channel name, for example facebook, so we can tell which ads work. The channel name only; never who you are.

We do not store your IP address, and we do not store the words you searched before arriving — only the domain that sent you, such as google.com.

To perform our contract with you — without an account and a credit ledger the service cannot function.

To comply with the law — payment records and consent records must be kept for the period the law requires.

For legitimate business interests — understanding which channels bring customers, and preventing repeated bad-faith claims of free credits, and reviewing images to fix problems and improve the quality of the service.

For advertising — only if you accept the cookie banner. Decline and every part of the site still works the same.

Embedded file metadata is stripped from every upload, including the GPS coordinates phones add that people rarely know are there.

Files sit in private storage with no public address. Each view uses a link that expires in 15 minutes.

Your images are visible only within your own shop's library. Other users cannot reach them — except images you turn on "True to the photo" for, as described next.

"True to the photo": when you turn it on for an image, the system makes web-size copies of that AI image, the product photo used to create it, and any extra photos you choose (with hidden file data removed), and shows them at plienroob.com/v/… Anyone with the link or the QR code can open that page without signing in. It shows only the shop name you set — never your email or account name — and tells Google not to index it. For try-on, the photo of the person you uploaded as the base is never shown. When you turn it off, the page stops showing immediately and the copies are deleted; the images in your library are not touched.

We count how many times that page is opened so you can see it, without storing anything that identifies who opened it.

We do not use your images to train AI models, do not use them in advertising, and do not sell them to anyone.

To generate an image, the system must send your image to an AI processing provider located outside Thailand, which processes it on our instructions and uses it for nothing else.

An image showing someone's face is personal data that deserves extra care.

Before you upload an image of a person, the system requires you to confirm consent, and records the full statement you were shown along with a timestamp.

Every such image passes an automatic age check. Images that do not pass are quarantined and cannot be used.

You can download all of your consent records as a file from Settings.

We count visitors with a tool that uses no cookies at all, and holds nothing that identifies you.

Strictly necessary cookies — the sign-in session. Without it you cannot use the service.

Trial-credit cookie — when you open the app, we keep the ID of the first account that used this browser, in your browser, for 400 days, so free trial credits can be claimed once per browser.

Attribution cookie — if you arrive from an ad link, the channel name is kept in your browser for 30 days. If you sign up within that window, the channel name is saved with your account.

Advertising and analytics cookies from Meta, Google and TikTok — these are stored on your device only after you accept in the banner, and you can change your mind at any time by clearing site data in your browser. Before you accept, or if you decline, Google's measurement tag still sends cookieless signals (such as a page opening or a sign-up) that do not identify you, with ad-click identifiers removed. Meta and TikTok do not run at all until you accept.

When you accept, we tell Meta that a sign-up or purchase happened, sending only the click identifier Meta itself attached when you clicked the ad. We do not send Meta your email, phone number, name, or IP address.

We do not sell your data to anyone. Delivering the service does require these providers:

Clerk — authentication and account management.

Stripe — payment processing and receipts.

Cloudflare R2 — image file storage.

Vercel — website hosting, and the cookieless visitor counter.

Neon — the database.

Browser notification services (Google, Apple, Microsoft, Mozilla) — only if you turn notifications on yourself. We store the address used to reach that device. Notifications only say how your job went, never include your images, and can be turned off at any time in Settings.

An AI processing provider located overseas — image generation and the age check on images of people.

Meta — only if you accept advertising cookies.

Google — visitor analytics (Google Analytics) and ad measurement — cookies are stored only if you accept advertising cookies; if you decline, Google receives only cookieless signals that do not identify you.

TikTok — ad measurement, only if you accept advertising cookies.

The providers above are located outside Thailand, so your data is transferred to and stored abroad.

We use providers whose data protection standards meet or exceed what Thai law requires, under data processing agreements based on international standards.

Account data and the credit ledger are kept for as long as the account is active, because they are financial records that must remain auditable.

Images you delete disappear from your library immediately.

Images on a "True to the photo" page that is still on are not removed by automatic retention, so the QR code in your post never leads to an empty page. Once you turn the page off, those images fall back under the normal retention rules.

The image retention period defaults to 90 days, and becomes adjustable in Settings once automatic deletion is switched on — that system is currently off, so a file you delete remains in storage. We state this plainly rather than let you assume otherwise.

Consent records and payment documents are kept for the limitation period the law requires, even after an account is closed.

Our team may copy uploaded images (including ones the system rejected) and generated images to a team computer, solely to fix problems and improve the quality of the service. Images you have deleted are never copied, and these review copies are deleted within 7 days.

Ask what data we hold about you, and request a copy.

Ask us to correct anything that is wrong.

Ask us to delete your data, except what we must keep by law, such as payment records.

Ask us to restrict processing, or object to certain processing.

Withdraw consent you previously gave, at any time. Withdrawal does not undo what was already done beforehand.

Exercise any of these by messaging us on LINE at @639sbxcm. We respond within 30 days. If you are unsatisfied with our answer, you may complain to Thailand's Personal Data Protection Committee.

All connections are encrypted. Image files live in private storage and are viewable only through expiring links, except the quality-review copies our team keeps on a team computer for no more than 7 days, as described under how long we keep data.

Your password is held by the authentication provider. We never see it and do not store it ourselves.

No system is perfectly secure. If a breach occurs that affects you, we will tell you as soon as we can.

This service is not designed for anyone under 18.

If we find an account was created by a minor without a guardian's consent, we will close it and delete the data.

Whenever we change how we collect or use data, we change this page at the same time and update the date at the top.

For significant changes we will notify you by email or in the app first.