Privacy Policy · Last updated 9 October 2026
Privacy Policy
This policy explains what personal data Triple S AI ("we", "us") collects when you use the service, why, who else handles it, how long we keep it, and what you can ask us to do with it. We are the data controller: Suphakit Sasiwan, 168/336 Moo 6, Phanthai Norasing Subdistrict, Mueang Samut Sakhon District, Samut Sakhon 74000, Thailand. We follow Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and, for people in the European Union and the United Kingdom, the GDPR and the UK GDPR.
The short version
- We collect your email address, what you upload, what you render, and basic technical logs. Nothing else.
- We do not sell your data, show ads or use tracking cookies.
- Your images go to Black Forest Labs to be rendered, and they may use them to improve their models.
- Files are deleted after 30 days. You can ask us to delete your account at any time.
- We may use your images, privately, to improve our own service. You can opt out at any time.
1What we collect
| Data | Where it comes from | Why we need it |
|---|---|---|
| Email address; with Google sign-in, also the name and profile picture Google shares | You, when you sign up | To create your account, sign you in and contact you about it |
| Images you upload and the renders made from them | You | To make the renders you ask for and show you your work |
| Render records: date, tool, settings, notes you typed, credits used, result status | The service | To run and bill the service, return credits for failures, and fix problems |
| Credit balance and plan | The service | To run your account |
| Payments: what you bought, the amount, the date and your country. Your card number goes to the payment provider and never to us. | The payment provider, when you pay | To add the credits you bought, handle refunds and keep accounting records |
| Feedback you send, with your email address | You | To read it, reply and improve the service |
| Technical logs: IP address, browser, time of requests, errors | Your browser, recorded by our hosting providers | To keep the service secure and working |
We do not ask for, and ask you not to upload, sensitive personal data such as health, religion or biometric data. If a render includes people, they are generated figures, not real people.
2Our legal basis
We process your data on these grounds:
- To provide the service you signed up for (performance of a contract): your account, uploads, renders, credits and payments.
- Our legitimate interest in keeping the service secure, preventing abuse and improving it from your feedback.
- Our legitimate interest in improving the service: using your uploads and renders, privately, to test, tune and train the models and settings that run Triple S AI (Terms, section 4). You can object at any time by emailing us, and we then stop and delete the copies kept for it.
- A legal obligation: keeping payment and accounting records.
- Where the law requires consent, we will ask for it, and you can withdraw it at any time.
3Who else handles your data
We use these providers to run the service. Each receives only what it needs.
| Provider | What it does | What it receives |
|---|---|---|
| Black Forest Labs (Germany) | Makes the renders | Your uploaded image and the render instructions; returns the result. Under its terms it may keep and use these images to operate and improve its products, including training models. |
| Supabase | Accounts, database and file storage | Your account details, render records and files |
| Supabase | Sends sign-in and account emails | Your email address |
| Cloudflare | Hosts the website, and adds the watermark to renders on accounts that have never paid | Requests to the site, including IP addresses; those renders |
| Sign-in, only if you choose it | Confirms who you are; we receive your name, email and picture | |
| Stripe (United States) | Processes card payments, when checkout uses Stripe | Your email, card and billing details, and what you bought |
| Lemon Squeezy (United States) | Sells to you as merchant of record, when checkout uses Lemon Squeezy | Your email, card and billing details, and what you bought. It is a controller of this data under its own privacy policy. |
These providers process data outside Thailand, including in the European Union and the United States. For data from the European Union or the United Kingdom, these transfers rely on the providers' Standard Contractual Clauses (and the UK addendum) or another safeguard the GDPR allows. You can ask us for a copy of the safeguard that applies. We share data with authorities only when the law requires it.
4How long we keep it
- Uploads and renders: deleted automatically 30 days after they are created, or sooner if you delete them. Black Forest Labs keeps its own copies under its own terms.
- Copies kept to improve the service: stored privately until you opt out or we no longer need them.
- Render records (without the images): kept while your account exists and afterwards as long as accounting law requires.
- Payment records: kept as long as tax and accounting law requires, which in Thailand is at least five years.
- Account details: kept until you ask us to delete your account.
- Technical logs: kept by our hosting providers for their standard periods, usually days to weeks.
5Cookies and browser storage
The site keeps your sign-in session in your browser's local storage so you stay signed in, and remembers a few display choices. There are no advertising or analytics cookies, and nothing that tracks you across other sites.
6How we protect it
Your files are stored privately. Links to them are signed and expire after 24 hours, and one account cannot read another's files. Connections to the site are encrypted. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the PDPA requires.
7Your rights
Under the PDPA, and the GDPR or UK GDPR if you are in the European Union or the United Kingdom, you can ask us to:
- give you a copy of your personal data, or send it to another service;
- correct data that is wrong;
- delete your data or your account;
- stop or limit how we use it, or object to a use;
- withdraw consent you gave.
Email us at the address below and we will reply within 30 days. Some data we must keep by law, such as accounting records, and we will tell you if that applies. You can also complain to a data protection authority: in Thailand, the Office of the Personal Data Protection Committee (PDPC); in the European Union, the authority in the country where you live or work; in the United Kingdom, the Information Commissioner's Office (ICO).
We do not make decisions about you by automated means that have legal or similarly significant effects.
8Children
The service is for professionals and is not meant for children. We do not knowingly collect data from anyone under 18.
9Changes
If we change this policy, we will update the date at the top. If a change matters, we will show it on the site or email you first.
10Contact
Privacy questions and requests: triples.ailab@gmail.com
The rules for using the service are in our Terms of Service.