Privacy Policy

This Privacy Policy explains how PointDee (“PointDee”, “we”, “us”) collects, uses, shares and protects personal data when you use the PointDee mobile app, our website and related services (together, the “Service”). By using the Service you confirm that you have read this policy. Where the law requires your consent, we ask for it separately (see section 7).

1. Who we are

PointDee is a rewards service for users in Thailand. You earn points by checking in daily, watching rewarded video ads and completing surveys or offers from partners, and you can exchange points for money paid to your PromptPay. For the purposes of the Thai Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and, where it applies, the EU/UK General Data Protection Regulation (“GDPR”), PointDee is the data controller of the data described below.

Jaturong Phaisansubtavorn, Bangkok, Thailand
Email: [email protected]

2. Data we collect

2.1 Data you give us

• Mobile phone number – used to create your account and sign in. We verify it with a one-time password (OTP) sent by SMS.
• PromptPay identifier – the mobile number or 13-digit national ID you enter when you request a withdrawal. We only use it to send your payment.
• Invite code (optional) – if you register with a referral or invite code.
• Messages to support – anything you send us via LINE or email, including screenshots.

2.2 Data created when you use the Service

• Account and points records – your point balance, check-in history and streaks, rewards earned, and the history and status of your withdrawal requests.
• Payment evidence – when we pay you, an administrator may attach a transfer slip or reference to the withdrawal record. The slip can show your PromptPay details and name as returned by the banking system. It is stored privately and shown only to our administrators.
• Offerwall and ad activity – which offerwalls you open, offers you complete, ads you watch, rewards credited or reversed, and related timestamps.
• Fraud-prevention data – a device identifier (on Android, the Android ID; on iOS, an app-specific identifier) so that one device can hold only one account. We also log technical events such as repeated OTP requests.

2.3 Data collected automatically

• Device and app information: device model, operating system version, app version, language, and time zone.
• Network information: IP address and approximate location derived from it.
• Advertising data collected by Google AdMob and our offerwall partners, as explained in section 5 and section 6. This can include your advertising ID (Google Advertising ID on Android, IDFA on iOS if you allow tracking) and ad interaction data.

We do not collect your precise GPS location, contacts, photos, microphone or camera data.

3. How we use your data

We do not sell your personal data. We do not use it for automated decisions that have legal effects on you, other than automated fraud checks (for example, refusing a second account on the same device) which you can ask us to review manually.

4. Points and PromptPay withdrawals

• Points are recorded on our servers. The app never decides how many points you receive; rewards are credited only after our server verifies them (for example, a signed confirmation from Google AdMob or from an offerwall partner).
• When you request a withdrawal, we store your PromptPay number or national ID, the amount, and the request status. A member of our team reviews the request and, if approved, transfers the money via PromptPay. We may contact you or reject a request if we suspect fraud or if the PromptPay details are invalid.
• Because payments are real money transfers, we must keep payment, accounting and tax records (see section 10).
• If an offerwall partner later cancels or reverses a reward (for example, a cancelled offer), we may deduct the corresponding points, as described in our Terms of Service.

5. Advertising and Google AdMob

PointDee uses Google AdMob (Google LLC / Google Ireland Limited) to show rewarded video ads. When an ad is requested, shown or clicked, AdMob and Google may collect and process, among other things:

• your advertising ID, IP address, device and operating-system information, and app identifiers;
• ad requests, impressions, clicks and viewing activity;
• for rewarded ads, a server-side verification (SSV) callback that carries your PointDee user ID and a one-time reward ticket, so that we can credit the reward safely.

Google may use this data to serve personalised or non-personalised ads, measure performance and prevent fraud. Learn more in How Google uses data from sites or apps that use its services and the Google Privacy Policy.

Your ad choices. On Android, open Settings → Google → Ads to reset your advertising ID or opt out of ads personalisation. On iOS, open Settings → Privacy & Security → Tracking. Opting out does not remove ads; it makes them less relevant.

6. Offerwalls and survey partners

The Earn section links to third-party offerwalls and survey providers, which may include CPX Research, AdGem, Lootably, Pollfish, Torox and similar partners that we add from time to time. When you open an offerwall:

• we pass a pseudonymous user ID (your PointDee account ID – not your phone number or PromptPay details) so the partner can tell us which user completed an offer;
• the partner’s page loads inside the app, and the partner may collect device data, IP address, advertising ID, your answers and your offer or survey activity under its own privacy policy and as an independent controller;
• the partner sends our server a signed notification (a “postback”) when you complete or reverse an offer, which we use to credit or deduct points.

Surveys can ask for sensitive information. You decide what to answer, and you can skip any question or leave at any time. We do not receive your individual survey answers; we only receive the result and reward amount. Please read the partner’s privacy policy before taking part.

7. Consent: UMP and ATT

• Google User Messaging Platform (UMP). Where the law requires consent for advertising and similar technologies (for example, users in the European Economic Area, the United Kingdom and Switzerland), we show a consent form powered by Google’s UMP before ads are loaded. You can accept, reject or manage your choices, and you can change them at any time in the app’s privacy settings. If you do not consent, we show only ads that do not rely on personal data, where available.
• Apple App Tracking Transparency (ATT). On iOS, we ask for your permission before accessing the IDFA for tracking across other companies’ apps and websites. If you choose “Ask App Not to Track”, your IDFA is not shared, and you will see non-personalised ads.
• Thailand (PDPA). Where consent is our legal basis under the PDPA, you can withdraw it at any time without affecting processing that took place before the withdrawal. Withdrawing consent for ads personalisation does not stop you from using the Service, but some features that depend on advertising may become unavailable.

8. Who we share data with

We require our service providers to protect your data and use it only for the services they provide to us. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, and we will tell you if your data becomes subject to a different policy.

9. International transfers

Some of our providers (including Supabase, Google and offerwall partners) process data outside Thailand, for example in Singapore, the United States or Europe. When we transfer personal data abroad, we take steps required by the PDPA and other applicable law, such as relying on adequate data-protection standards or contractual safeguards.

10. Retention

• Account data – kept while your account is active and for a reasonable period afterwards to handle disputes.
• Withdrawal, payment and accounting records – kept for at least 5 years (and up to 10 years where Thai law requires) for accounting and tax purposes.
• Fraud-prevention logs – kept as long as needed to prevent abuse, normally no more than 24 months.
• Support messages – kept for up to 24 months after the case is closed.

When data is no longer needed, we delete or anonymise it. Some records may remain in encrypted backups for a limited time before being overwritten.

11. Security

We use technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), access control and row-level security on our database, private storage for payment slips, server-side verification of all rewards, and restricted administrator access. No system is perfectly secure; please keep your phone and OTP codes private and tell us at once if you suspect misuse of your account.

12. Your rights

Subject to applicable law (including the PDPA and, where relevant, the GDPR), you may:

• access your personal data and receive a copy;
• correct inaccurate data;
• delete your data or ask us to anonymise it, and delete your account (see below);
• object to or restrict certain processing;
• withdraw consent at any time;
• request data portability;
• complain to a regulator, such as the Thai Personal Data Protection Committee (PDPC), or your local data-protection authority.

How to exercise your rights or delete your account: email [email protected] from or mentioning your registered phone number, or message us on LINE. We may ask you to verify your identity first and will answer within 30 days. Before deleting an account we may need to keep payment and accounting records required by law. Unspent points have no cash value once an account is deleted.

13. Children

PointDee is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered, contact us and we will delete the account.

14. Changes to this policy

We may update this policy from time to time. If changes are important, we will tell you in the app or on this page before they take effect. The “last updated” date above shows the current version.

15. Contact us

Questions about this policy or your data? Contact us at [email protected] or through our Support page.