Version 1.1.0 — in force from 15 September 2026. Reviewed and approved by counsel on 13 September 2026. The Thai version is the authoritative text. This English version is a translation; if the two differ, the Thai version governs.
1. What this document covers
UWU ID is UWU's central account system at id.uwu.co.th. You register once and use that single account across all UWU services. UWU ID also acts as a central store of personal data so that individual services don't each have to keep their own copy of the same information.
This policy explains what we collect, why, how long we keep it, who sees it, and what rights you have.
Data controller: Urban Wealth Union Company Limited 324/54 Pracha Rat 1 Road, Bang Sue Sub-district, Bang Sue District, Bangkok 10800, Thailand
Data protection contact: dpo@uwu.co.th Data Protection Officer: reachable at dpo@uwu.co.th or the address above. We have appointed a Data Protection Officer as required by law.
Our role for each kind of data
- For your account data (email, password, username, date of birth, sign-in devices), we are the data controller.
- For data that UWU services deposit with us for shared use (see section 2), we process it on behalf of that service. That service is the controller and decides the purpose.
- Each UWU service you use is its own controller for the data generated inside that service.
This policy covers only what happens at UWU ID.
2. What we collect
Information you give us directly
- Email address and password (we store only a one-way hashed value; nobody can read your password, including us)
- The username you choose, and a history of usernames you previously held
- Date of birth — stored encrypted, used only to check whether you meet the age requirement of each service
Information generated when you use the service
- Sign-in devices: IP address, browser/device type, sign-in time and last activity
- Number of failed password attempts and any security delay applied
- One-time codes (OTP) we email you, stored hashed and valid for 5 minutes
- A record of which version of the terms and policy you accepted, and when
- If email to you bounces, we record that address with the reason, so we stop sending and can ask you to change it
- A record of which UWU service you have authorised to access what, and the access credentials we issue to that service
Information from services you choose to connect
If you sign in with Google, Apple, Discord, Telegram or LINE, we receive your identifier at that service and your email address (except Telegram, which does not provide one) in order to link it to your UWU ID account. With LINE you choose whether to share your email at the consent screen, and LINE does not certify that the address has been verified — so we treat it as unverified until you verify it with us.
We also store identifying details of that account — its identifier at the provider, its display name (your Discord or Telegram username, the email address of your Google account) and the address of its profile picture — so that the "sign-in methods" page can tell you which account yours is linked to, which matters when you hold more than one account at the same provider.
These details are refreshed each time you sign in with that provider.
Profile pictures are served through our own servers rather than fetched by your browser from the provider — we retrieve the image on your behalf and hold it briefly so it need not be fetched again. The provider therefore does not learn when you opened your account page, and does not see your IP address or browser through this.
All of this is deleted as soon as you unlink or delete your account. Apple provides neither a name nor a picture, so we show only that the connection exists.
We also store the access credentials that provider issues us, to maintain the connection. These are deleted as soon as you disconnect the provider, and are deleted with your account when you delete it.
Information UWU services deposit with us
UWU services may deposit your information with UWU ID — a full name, for example — so it doesn't have to be stored in several places. This data is encrypted with a key unique to you, and only services holding the relevant permission can read it. The depositing service decides what is stored and why, under its own policy.
Passkeys: if you set up a passkey, we store only the public key, the name you give it, and the device type. We never receive or store your fingerprint, face, or device unlock code. Those stay on your device.
What we do not collect: profile photos, phone numbers, postal addresses, payment information, and sensitive data such as religion, ethnicity or health information. What we do not do: sell or rent your data, use it for targeted advertising, track your behaviour across websites, or make automated decisions with legal effects on you (an age check returns a yes/no against a threshold each service sets; it is not an assessment of you as a person).
3. Why we use your data, and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Let you register, sign in, and use UWU services with one account | Email, password, username, linked accounts, passkeys | Performance of a contract (s.24(3)) |
| Keep your account secure: detect unusual sign-ins, block bots and password guessing, alert you to important changes | IP address, device, failure counters | Legitimate interest (s.24(5)) |
| Store your date of birth so we know whether you are a minor, and to check the minimum age for opening an account | Date of birth (encrypted) | Performance of a contract (s.24(3)) — the minimum age is a condition of service under section 2 of the Terms |
| Tell a UWU service whether you meet its age requirement | The yes/no result of comparing your date of birth to that threshold | Performance of a contract (s.24(3)) |
| Hold data deposited by UWU services and release it only to authorised services | The deposited data | We act on that service's instructions as a processor; the legal basis belongs to that service as controller |
| Keep evidence of accepted documents and consents, to demonstrate our compliance with data protection law | Version accepted and timestamp | Legal obligation (s.24(6)) |
4. Who sees your data
The UWU services you use — when you sign in to a service, that service always receives a random identifier for you (not your email). Your email, age status, or other data goes only to services holding that specific permission. An age check returns only whether you meet the threshold; we never send your date of birth to any service.
Each service's permissions are set in advance according to what that service needs. If you no longer want a service to have access to your data, your options are to stop using that service or to delete your UWU ID account.
UWU system administrators — only designated staff can access your data, and only as necessary to operate the service and assist you. These operations currently run through internal tools restricted to the team; we are moving them to an administrative console that requires a second identity check and logs every action for audit.
Processors acting for us — Cloudflare (request processing, queues, email delivery, bot detection) and PlanetScale (database). Both act on our instructions under contract.
Services you connect — Google, Apple, Discord, Telegram and LINE will know that you used their account to sign in with us. Their use of data is governed by their own policies.
Government authorities — only where required by law or by a lawful order.
5. Data held outside Thailand
Our database is located in Singapore (PlanetScale). Your requests run on Cloudflare's network, which has points of presence in many countries and serves each request from the one closest to you at the time. Whenever your data has to be read or written, the request travels back to the database in Singapore. Your data is therefore stored in Singapore only, while processing along the way may take place in other countries.
These transfers rely on your consent under section 28(2) of the Personal Data Protection Act B.E. 2562. Before you give that consent we tell you that the destination countries may not have data protection standards equivalent to Thailand's; the details are in the document "Transferring your data outside Thailand" (/legal/cross-border), which you accept at sign-up together with the terms and this policy in a single tick, with each acceptance recorded separately, with its version and timestamp, as evidence.
The service cannot be provided without that consent, because both the storage of your data and the processing of your requests happen entirely on infrastructure outside Thailand. Anyone who does not consent cannot register or use a UWU ID account, and if you withdraw your consent later, we will have to stop providing the service and delete your account through the normal deletion process.
Both providers are bound to us by the standard data processing agreements incorporated into their terms of service, which require them to process data only on our instructions, prohibit use for their own purposes, and oblige them to notify us of any data breach.
6. How long we keep it
| Data | Retention |
|---|---|
| Active accounts | For as long as the account exists |
| Accounts you delete | Recoverable for 30 days; after that we destroy your decryption key, making your date of birth and any deposited data permanently unreadable |
| Released usernames | Locked for 90 days so nobody can take a name you recently changed |
| Evidence of terms acceptance | 10 years from account deletion, reduced to values that cannot identify you |
| Data deposited by UWU services | As set by that service, up to 10 years |
| Records of data access by UWU services | Up to 1 year |
| Account events used by UWU services to keep in step (creation, email change, consent withdrawal) | 90 days |
| Evidence that we acted on your deletion request (when it was made, carried out, reversed, and when your key was destroyed) | 10 years from account deletion, reduced to a reference that cannot identify you |
| Record of staff actions that touched your data (who did what, when, and why) | 10 years, holding only references and the stated reason — never your data itself |
| Identifying details of a linked account (identifier, display name, profile-picture address) | Deleted when you unlink, or with your account |
| Sign-in devices | Until expiry or sign-out; 90 days at the outside |
| Access credentials issued to UWU services | 30 days per issuance, renewed on use |
| Credentials from providers you connect | Deleted at once when you disconnect. On account deletion the connection is kept for as long as you can still restore the account, then deleted with it at final erasure — the connection is what lets you get back in to restore it |
| One-time codes (OTP) | 5 minutes |
| Bounced email records | 1 year |
If a UWU service has a legal obligation to retain particular records, we will not delete those records until that period ends, and we will show you the reason and the date in your account page.
7. How we protect your data
- All connections are encrypted in transit.
- Passwords are stored using one-way hashing designed to be irreversible.
- Your date of birth and any deposited data are encrypted with a key unique to you, itself wrapped by a master key held separately from the database.
- When an account is deleted, we destroy your key, so the encrypted data becomes permanently unreadable.
- Every time a UWU service requests your data, we log it for audit.
- Access to back-office systems is restricted to authorised team members.
- When you sign out at UWU ID, we terminate every session on every device and send a sign-out signal to the UWU services that support it.
8. Cookies
We use only cookies necessary for the service to work:
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you signed in | 7 days (30 days with "remember me"), 90 days maximum |
| Language preference | Remembers the language you chose | 1 year |
| OTP cooldown | Prevents repeated code requests | 60 seconds |
| Age-check result | Avoids re-checking while forwarding you to a service | Short (per session) |
| Cloudflare bot detection | Confirms you are human, not a bot | Set by the provider |
We do not use cookies for advertising or cross-site tracking.
9. Your rights
Under the Personal Data Protection Act you have the right to access and obtain a copy of your data, to have it corrected, to have it erased, to have processing restricted, to object to processing, to data portability, and to withdraw consent.
What you can do yourself in your account page: change your email, change your username, manage sign-in methods and devices, view the data we hold, and delete your account.
Date of birth cannot be changed by you, to prevent circumvention of age requirements. If it is wrong, please contact us.
For anything else, contact dpo@uwu.co.th. We will respond within 30 days of receiving your request and verifying your identity.
Verifying your identity — so that nobody else can obtain your data, we need to confirm the request is yours.
- If you can still access your account, we verify with a code sent to the email address linked to it.
- If you can no longer access your account, we may ask for government-issued identification. In that case, please mask the religion and blood type fields before sending. We do not want that information and will delete the document as soon as verification is complete.
Restriction and objection — because UWU ID is a central account system, restricting the processing of your account data means you cannot use any UWU service for the duration. Please contact us so we can consider your request case by case.
Withdrawing your acceptance of the terms means closing your account, since we cannot operate a central account without processing the data described above.
If your request concerns data deposited with us by a UWU service, we will forward it to that service as the responsible controller.
If you believe we are not complying with the law, you have the right to complain to the Office of the Personal Data Protection Committee.
10. Minors
This service is for people aged 15 and over on the date of registration. If an applicant is below that age, we do not create the account and immediately delete the data just recorded. Individual UWU services may set a higher minimum age.
11. Changes to this policy
When we make a material change, we will notify you and ask you to accept the new version before continuing. Every version ever in force stays readable on this page, with its version number and effective date.
Version 1.0.0 is the first version published as a complete document. Existing account holders will be asked to accept it at their next sign-in.