Privacy &
Data

Ossuary Atelier is a secondhand clothing brand based in Phuket, Thailand. We act as the data controller for the personal data described in this notice. It applies to everything we do: this website, the guide, and purchases arranged through our Instagram direct messages.

We handle your data under Thailand’s Personal Data Protection Act (PDPA) and apply good-practice standards consistent with the EU’s GDPR for visitors from the European Economic Area and the United Kingdom.

Comments on the guide and field notes. The comment boxes on our blog and guide pages collect your name, email address, and the message you write. The forms are processed for us by Formspree, a third-party provider. We use this information only to respond or to publish a note with your name — never to market to you, and your email address is not published.

Purchases and enquiries through Instagram DM. When you buy a piece you share contact, shipping, and payment details with us over Instagram direct message. That conversation and the data in it is handled through Instagram (Meta) and is subject to Meta’s privacy policy. It is not stored on this website.

Technical information. Our hosting provider (GitHub Pages, served through the Fastly CDN) and the content-delivery services we rely on for a few small libraries (unpkg, jsDelivr, cdnjs) receive routine connection data — IP address, browser and device type, and the pages you request. This is standard site operation, used only to serve and secure the pages.

Map page location. The interactive Phuket map loads its base tiles from CARTO, which receives the map area you are viewing — an approximate location, not precise GPS.

On your device. When you skip the opening splash, a small flag is kept in your browser’s session storage. It lives only on your device, clears when the tab closes, is not a cookie, and is never sent anywhere.

Glossary progress. The Thai slang glossary remembers which terms you have already marked as “I know this one.” That list is stored in your browser’s local storage under the key oa_glossary_known. It never leaves your device, is not a cookie, and is not sent to us or to any third party. Clearing your browser data for this site removes it.

We do not set cookies and we do not use advertising, cross-site tracking, or fingerprinting anywhere on this site. For visitor counting we use a cookie-free, privacy-first analytics setup that records only aggregate page counts, page-load performance, and simple anonymous interaction counts — never personal data. The small notice that appears in the corner of each page is transparent information, not a consent wall — because there is nothing to consent to.

We process data on the following grounds: consent when you submit a comment; contract when you make a purchase; and our legitimate interests in operating, securing, and improving the site.

Our processors are mostly based in the United States and the European Union: Formspree (comment forms), GitHub and Fastly (hosting and CDN), unpkg, jsDelivr and cdnjs (script libraries), CARTO (map tiles), and Meta/Instagram (direct-message purchases). International transfers rely on the standard contractual clauses or other appropriate safeguards maintained by those providers.

Comment submissions are kept until you ask us to remove them. Purchase and payment records connected to a sale are kept as long as required by Thai commercial and tax law, and no longer than reasonably necessary for resolving a question about an order.

Under the PDPA (and, where applicable, the GDPR) you can request access, correction, deletion, or restriction of your data, object to processing, ask for a portable copy, or withdraw any consent you have given — without affecting the lawfulness of processing that happened before. Send any request to [email protected] — Instagram DMs work too. We respond within 30 days. If you are in Thailand you may also lodge a complaint with the Personal Data Protection Committee (PDPC).

We do not knowingly collect personal data from anyone under 16 without a parent or guardian’s consent. If you believe we have, contact us and we will delete it.

The site is served over HTTPS, keeps no account database, and collects the minimum needed for its pages and purchases to work. If anything in this notice ever changes, we will update the date below.