CSMPrivacy Policy – CreatorSkyMarket (CSM)
Version 1.1 · Effective 1 December 2026 · updated 14 November 2026
1. Who we are
CreatorSkyMarket ("CSM", "we") is operated by Sky Universe Group Co., Ltd., company registration no. 0105567237081, 1575 New Phetchaburi Road, Makkasan, Ratchathewi, Bangkok 10400, Thailand. We are the data controller under the Thai Personal Data Protection Act B.E. 2562 (PDPA). Privacy contact: csm@sky-universe.com. Data Protection Officer: not appointed.
2. What we collect
| Data | From whom | Why |
|---|---|---|
| E-mail address or phone number, one-time login codes | all users | Sign-in, account security |
| Display name, short bio, province, social media handles | creators | Profile, matching campaigns to your region |
| Links to your posts, screenshots of view counts, reported views | creators | Checking campaign entries and calculating payouts |
| Payout account (PromptPay or bank account), account holder name, legal name, tax ID | creators who receive payouts | Paying you, tax obligations, fraud prevention |
| Photo of your ID (Thai ID card/passport) and a selfie, time and version of your consent | creators who receive payouts | Identity verification and fraud prevention (with your explicit consent) |
| Withholding tax records (name, ID number, amount, tax withheld, date – "50 Tawi") | creators who receive payouts | Thai tax law (withholding tax) |
| Country of your IP address at sign-up and when you submit an entry | all users / creators | Abuse prevention |
| Company name, brand name, tax ID, branch code, company documents, team members' e-mail addresses | brands | Verifying the company, invoicing, team access |
| Bank transfer slips (may show account name, bank and account number) and transfer references | brands | Checking that the campaign budget has been paid |
| Campaign briefs, budgets, uploaded brand material | brands | Running campaigns |
| Contact details and campaign details sent through the "Start a campaign" form | prospective brands | Answering your request (with your consent) |
| Support messages and basic device/app information you include | all users | Answering your request |
| IP address, browser/app type, time of access, security logs, audit logs of actions | all users | Security, fraud prevention, troubleshooting |
ID and selfie for payouts: For payouts we store a photo of your ID (Thai ID card/passport) and a selfie privately. Only our finance team sees them, solely for identity verification and fraud prevention; they are deleted when the legal retention period ends. You give your explicit consent before uploading (checkbox in the app; we store the time and the version of the text). To prevent abuse we also store the country of your IP address at sign-up and when you submit an entry.
We do not use advertising or analytics trackers and do not sell personal data. Apart from the ID photo and selfie described above, we do not collect sensitive data (PDPA section 26). Please do not include such data in screenshots or messages.
3. Legal bases (PDPA s.24, GDPR Art. 6)
- Contract: your account, campaigns, entries, payouts.
- Legal obligation: accounting and tax records, responses to authorities.
- Legitimate interest: security, fraud and fake-view prevention, improving the service. You may object (section 8).
- Consent: the "Start a campaign" form and any future marketing messages. You can withdraw consent at any time; this does not affect earlier processing.
4. Who receives your data
- Brands see a creator's display name, handles, entry links, verified views and ranking for their campaigns. They do not receive your e-mail, phone, payout or tax data.
- Other users see public campaign details and the public ranking (display names only).
- Service providers acting on our instructions: web and API hosting by Netlify, Inc., database and file storage by Supabase, Inc. (data centre in Ohio, USA), e-mail and SMS delivery by a messaging provider, our partner company Giant Impact Group Co., Ltd., which receives brand payments as payee, and our bank, which processes the transfers (payments are made outside the app by bank transfer; we do not use a payment provider).
- Authorities where required by law (e.g. Revenue Department).
5. Transfers outside Thailand
Some providers may store data outside Thailand (the United States, where Netlify and Supabase process your data, and the countries of our messaging provider). We only use providers that offer an adequate level of protection or appropriate safeguards (PDPA s.28–29), e.g. standard contractual clauses.
6. How long we keep data
| Data | Retention |
|---|---|
| One-time login codes | deleted 24 hours after expiry |
| Account and profile | until you delete your account |
| Payout, invoice and accounting records | at least 5 years (up to 7 years if the authorities require it) as required by Thai accounting and tax law, without your name after account deletion |
| View screenshots | 12 months after the campaign is final |
| Support messages | 24 months |
| "Start a campaign" requests without a contract | 12 months |
| Security and server logs | 90 days; audit logs 5 years |
7. Security
Payout account numbers, account holder names, legal names and tax IDs are stored encrypted and shown only masked. Only finance staff can see the full account details to make a transfer, and every such view is logged. Connections are encrypted (HTTPS). Access is limited to staff who need it, and staff actions are logged.
8. Your rights
You can: access and receive a copy of your data (in the app: export), correct it, delete your account (in the app or at https://csm.sky-universe.com/en/account-deletion), object to processing, restrict processing, withdraw consent, and complain to the Office of the Personal Data Protection Committee (PDPC), Thailand. Contact us at csm@sky-universe.com; we answer within 30 days.
9. Children
CSM is for users aged 18 and older who live in Thailand. We do not knowingly collect data of younger users.
10. Cookies
We only use cookies and local storage that are necessary for sign-in, security and your settings. See our Cookie Notice.
11. Users in the EU/EEA
If the GDPR applies to you, you also have the right to data portability and to complain to your local supervisory authority. EU representative: not appointed.
12. Changes
We will announce material changes in the app and on the website before they take effect.