Privacy Policy
1. Introduction
This Privacy Policy ("Policy") describes how Metta People Ltd (Thailand) ("Metta People," "we," "us," or "our") collects, uses, discloses, and protects personal data in connection with our ecosystem of digital services, including:
- MettaUniverse: Our online marketplace (www.mettapeople.com).
- Metta Living Flow: Our community application (metta-living-flow.base44.app).
Metta People acts as the Data Controller under the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand and, where applicable, the GDPR and CCPA. By using our Services, you agree to the practices described in this Policy.
2. Scope and Applicability
This Policy applies to all platform users and sellers. We do not knowingly collect data from individuals under the age of 18.
3. Categories of Personal Data Collected
- Identity & Contact: Full name, email, phone number, address.
- Account & Profile: Usernames, passwords, and preferences synced across both MettaUniverse and Metta Living Flow.
- Financial Data: Payment/payout records processed via 2C2P and Stripe. We do not store raw credit card numbers.
- Technical & Usage: IP address, device identifiers, and browsing behavior via Google Analytics.
- Content Data: Messages, forum posts, and offerings created by you.
4. Legal Bases for Processing
We process data based on: Performance of Contract (managing accounts/bookings), Consent (marketing), Legitimate Interests (security/fraud prevention), and Legal Obligation (Thai tax and ETDA compliance).
5. Purpose of Data Processing
To provide a unified experience across our marketplace and utility apps; to facilitate payments; to conduct KYC (Know Your Customer) checks; and to ensure community safety.
6. Data Retention
| Account Data | Duration of account + 24 months |
| Financial Records | 10 years (as required by the Revenue Department of Thailand) |
| Activity Logs | 12 months |
7. Disclosure to Third Parties (Sub-Processors)
We share data with trusted partners to operate our platform:
- 2C2P / Stripe: Payment gateway services.
- Peak Account: Thai tax and accounting automation.
- Sharetribe / Base44: Application infrastructure and hosting.
- OpenAI: Automated content moderation and toxicity filtering.
8. International Data Transfers
Your data may be processed on servers outside Thailand (e.g., AWS/Google Cloud). We ensure these transfers comply with PDPA standards through Standard Contractual Clauses.
9. Data Subject Rights
You have the right to Access, Rectify, Erase, or Port your data, and to Withdraw Consent. Contact info@mettapeople.com to exercise these rights.
10. Rights of California Residents (CCPA/CPRA)
We do not sell your personal data. California residents may request a report of data categories collected.
11. Cookies
We use a "Consent First" cookie banner. You may "Accept All" or "Reject All" with equal ease.
12. Content Moderation & Notice-and-Takedown (2026 ETDA Compliance)
As a Digital Platform Service provider under the Royal Decree B.E. 2565, Metta People implements a "Notice and Takedown" procedure.
Monitoring
We use AI-based screening (OpenAI) to flag illegal or "un-metta" content before it is published.
Reporting
Users or rights holders may report content that is illegal, fraudulent, or violates our Terms by emailing abuse@mettapeople.com.
Action
Upon receiving a valid notice, we will investigate and, if necessary, remove or suspend the content within 24–72 hours to maintain platform safety and legal compliance.
13. Data Security
We use SSL encryption and secure database protocols. In the event of a breach, we will notify affected users and the PDPC within 72 hours.
14. Amendments
We may update this policy. Material changes will be sent via email or dashboard notification.