Privacy notice

1. Who is responsible for your data

Vanilor, a family-owned vanilla farm and brand in Bangkok, Thailand, is responsible for the personal data described in this notice (the “data controller” under Thailand’s Personal Data Protection Act B.E. 2562 (2019), the PDPA).

You can reach us about anything in this notice at hello@vanilor.org.

2. What we collect

• If you join the waitlist: your email address, the language of the page you signed up from, that page’s address, and when you confirmed your sign-up.
• When you use the waitlist form: Cloudflare Turnstile processes technical signals from your browser and device, such as your IP address, to tell people from bots. We only receive a pass or fail result.
• If you rate a recipe: which recipe, how many stars, and a random code your browser makes the first time you rate, so a second rating from the same browser replaces the first instead of counting twice. The code is not linked to your name, email address or IP address. Cloudflare Turnstile checks the rating the same way as the waitlist form.
• If you write to us: your name, your email address and whatever you choose to put in your message.
• When you visit the site: our hosting provider processes technical data such as your IP address and browser type in order to deliver the pages and protect the site from abuse. Unless you accept analytics cookies, we set no cookies.
• If you accept analytics cookies: Google Analytics records the pages you view and what you do on them (such as scrolling, following a link or joining the waitlist, but never your email address), how you arrived (for example from a search engine or a link), your approximate location (country and city, worked out from your IP address, which Google Analytics does not store), and your device type, browser, language and screen size. It sets two cookies, _ga and _ga_<ID>, that last up to two years so it can recognise a returning browser. It does not tell us who you are. Google signals and advertising features are switched off.

We do not collect sensitive personal data, and we ask you not to send us any.

3. Why we use it, and on what legal basis

• Sending the one email that asks you to confirm your sign-up: to take the step you asked for with the form, and our legitimate interest in making sure nobody can sign up someone else.
• Sending the waitlist emails (Vanillin’s diary, new episodes, product news): your consent, which you give by clicking the link in the confirmation email and can withdraw at any time.
• Answering your messages and discussing a partnership: to take the steps you ask for before any agreement, and our legitimate interest in replying to you.
• Running and protecting the website: our legitimate interest in keeping the site available and secure.
• Showing recipe ratings: our legitimate interest in letting readers see what other cooks thought of a recipe.
• Measuring how the site is used, with Google Analytics: your consent, which you can withdraw at any time with “Cookie settings” at the bottom of every page.

We will not use your data for anything else without telling you first and, where the law requires it, asking for your consent.

4. Who we share it with

We use a small number of service providers. They may only use your data to provide their service to us, and must keep it secure:

• Cloudflare, Inc. (USA): hosts this website, protects it from attacks, runs the Turnstile check on the waitlist form and the recipe ratings, and stores the waitlist and the ratings in databases.
• Google (Google LLC, USA, and Google Ireland Limited): hosts the inbox where we receive your messages and waitlist sign-ups (Google Workspace), and provides Google Analytics, only if you accept analytics cookies. Google processes this data for us as our service provider.
• Resend, Inc. (USA): sends the confirmation email, keeps our newsletter list (your email address and language), sends our letters, and sends us an email about each confirmed waitlist sign-up. Every letter has an unsubscribe link.

We do not sell or rent personal data. We will disclose it to authorities only when the law requires us to.

5. Transfers outside Thailand

Cloudflare, Google and Resend may process data outside Thailand, including in the United States, the European Union and Japan. We rely on their data processing terms, which include safeguards for international transfers, so that the transfer meets the PDPA’s requirements.

6. How long we keep it

• Waitlist: until you unsubscribe or ask us to delete it. If you never click the confirmation link, it stops working after 48 hours and we delete your address within 30 days after that.
• Messages: up to two years after our last exchange. If we start working together, for as long as the law requires us to keep business records.
• Technical data held by Cloudflare: only as long as needed to deliver and protect the site. Our own logs of the waitlist form contain no email addresses and no IP addresses.
• Google Analytics: we keep event data for 14 months, then Google deletes it. The cookies expire after up to two years, or at once if you decline in Cookie settings.
• Recipe ratings: for as long as the recipe is on the site. To have your rating removed, send us the code your browser keeps for it (we can tell you how to find it).

7. Cookies and your choice

This site sets no cookies unless you accept analytics cookies in the bar at the bottom of the page. Until you do, Google Analytics does not load and nothing is sent to Google.

We store your answer in your browser (local storage, not a cookie) so we do not ask on every page. We ask again after a year.

If you rate a recipe, your browser also keeps your rating and the random code described above in local storage, so you can see and change your rating later. Nothing is stored before you rate, and clearing your browser’s site data removes both.

You can change your mind at any time with “Cookie settings” at the bottom of every page. If you decline, we delete the Google Analytics cookies from your browser.

8. Your rights

Under the PDPA you can:

• withdraw your consent at any time (every email has an unsubscribe link, and “Cookie settings” is at the bottom of every page);
• ask for access to your data and a copy of it;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data or make it anonymous;
• ask us to restrict how we use it;
• object to how we use it;
• ask for your data in a format you can take elsewhere.

Write to hello@vanilor.org. We will reply within 30 days. If you are not satisfied, you can complain to Thailand’s Personal Data Protection Committee (PDPC).

If you live in the European Union or Switzerland, you have similar rights under the GDPR or the Swiss Federal Act on Data Protection, and you can contact us in the same way.

9. Children

The series is for all ages, but the waitlist is for adults. If you are under 20, please ask a parent or guardian before signing up.

10. Keeping it safe

We collect as little as we can, limit who can see it, and use providers that protect data in transit and at rest. The site is only served over HTTPS with strict security headers, and the waitlist form has bot protection and rate limits.

11. Changes to this notice

When we add a new service that handles personal data, such as an online shop, we will update this notice and the date at the top. If a change affects how we use data you have already given us, we will tell you by email.