Privacy policy.
What this site collects, why, and what it never does with your data.
Last updated 10 October 2026
OGtraplord · Legal
Sheet L-01 · Privacy Policy
OGtraplord (“we”, “us”) is an independent web studio in Bangkok that runs ogtraplord.com: the template gallery, the AI chat assistant, the Prompt Shop, the member downloads, and custom client work. This policy explains what information the site touches, why, and what you can do about it.
The short version: we collect the minimum the studio needs to work, we never sell it, and there are no advertising trackers anywhere on the site. If anything here is unclear, email gem.tra@ogtraplord.com and you’ll get a straight answer.
1.Information we collect
1.1 Things you give us
- Account details. Your name, email address, and password when you create a free account. Passwords are stored only as a one-way hash; we can’t read them.
- Chat messages. Whatever you type to the site’s AI assistant, plus a name and email if you choose to leave them so we can follow up.
- Order details. The item you buy, the price, and (for PromptPay) the transfer slip you upload so the payment can be verified.
- Email. Anything you send to our address, including project enquiries.
1.2 Things collected automatically
- Basic technical data. Your IP address (used for rate limiting and abuse protection), timestamps, and the page a chat started on.
- Site analytics. The pages you view, what you click, how far you scroll, and which sections you see, counted anonymously for every visitor. Only if you accept the cookie banner is this linked to your device, with your IP address. See Site analytics.
- Download history. Which member tools your account has downloaded, so your dashboard can show it back to you.
- Standard server logs kept by our hosting provider.
1.3 Things we deliberately don’t collect
We never see or store card numbers. Payments happen inside your own banking or crypto app. We use Google Analytics across ogtraplord.com and its subdomains (including the live template demos, and pay.ogtraplord.com) only after you accept analytics cookies. We do not send account details, chat messages, payment details, or URL query strings to Analytics. Advertising personalization is disabled.
2.How we use it
- Running your account and giving you access to what you’ve bought.
- Answering chat conversations and following up on enquiries you asked us to follow up on.
- Verifying PromptPay slips and confirming crypto payments so orders complete.
- Sending the emails the service needs: confirmations, receipts, password resets, and order updates.
- Keeping the site safe: rate limits, spam honeypots, and abuse prevention.
- Measuring visits across ogtraplord.com and its subdomains to improve the website: anonymously for everyone, and in more detail only with your permission (see Site analytics).
- Reading our own chat transcripts to make the assistant and the site better.
That’s the full list. We don’t run ad campaigns off your data and we don’t send marketing blasts.
3.The AI assistant
The site chat is powered by Google’s Gemini API. When you send a message, the conversation is relayed to Google to generate the reply, and the transcript is stored in our database where the site owner can read it (that’s how a “talk to us” widget works: a person eventually reads it).
We never use your conversations to train AI models. Still, treat the chat like any contact form: please don’t paste passwords, card numbers, or anything sensitive into it.
6.Site analytics
The site counts its own visits with a small first-party script, so we can see which pages, templates, and sections people use. It runs on ogtraplord.com and its subdomains (never in the admin area), and what it records stays in our own database. It works in two tiers.
6.1 Every visitor: anonymous, no cookies
- Pages. The page address (never its query string), the page title, the site that sent you and any campaign tags (utm_*), and whether you landed on our “page not found” page.
- Your device, roughly. Screen and window size, browser language, device type, operating system, and browser; your time zone, used to estimate your country (there is no IP-based location lookup); your connection type as the browser reports it (like “4g”) and whether data saver is on; whether your device is set to dark or light mode and to reduced motion; whether you use touch or a mouse; portrait or landscape.
- Speed and errors. How fast the page loaded and responded (time to first byte, first and largest paint, layout shift, how quickly it reacted to your taps and clicks, load time, and page size), and JavaScript errors on the page: the error message, the file, and the line number, with any web address cut down to its path.
- What you do on the page. Every click, with the button or link text, where it leads, the part of the page it was in, and its position on the page (for click heatmaps); which sections come into view and for how long, how far you scroll, time on the page, how long until your first tap or key press, and how often you switch away from the tab; the FAQ answers you open; signs of frustration, meaning quick repeated clicks in one spot (“rage clicks”) and clicks on things that don’t respond (“dead clicks”); text you copy from the page, only the first 80 characters of the site’s own text, never from a form field and never on account or checkout pages; clicking into a template’s live demo; resting the mouse on a button for a while without clicking it; printing a page; starting a video or sound.
- Forms. Which forms you start, send, or leave unfinished, and the name of the last field you were on (like “email”), never what you type into them.
- Search. That you used a search box on the site and how long your search was; the words themselves only if you clicked Accept (see 6.2).
- Signed in or not. A yes or no for whether you’re signed in to an account, but not which account it is.
- How it stays anonymous. Nothing is stored on your device. Each day’s visits are grouped by a key made from your IP address and browser details mixed with a random value that changes every day and is deleted after 2 days, so the key can’t be traced back to you or linked across days. Your IP address itself is not stored.
- Why. Our legitimate interest in understanding and improving the site (GDPR Art. 6(1)(f); Thai PDPA section 24(5)).
6.2 Only if you click Accept: visit history linked to your device
- What changes. The ogt_vid cookie (a random ID, about 400 days) links your visits across days, so a return visit joins your earlier ones, and your full IP address is stored with them. Pages you viewed before clicking Accept stay anonymous.
- What’s added. Which visit this is and how many days since your last one; your device’s memory and number of processor cores, as your browser reports them; the words you type into a search box on the site (lower-cased, up to 60 characters); and, if you are signed in, the link between these visits and your account.
- Why. Your consent (GDPR Art. 6(1)(a); Thai PDPA section 19). It is never switched on while your browser sends a Global Privacy Control signal.
6.3 How long, who sees it, how to opt out
- Retention. Analytics records, error reports included, are deleted after 13 months; stored IP addresses are erased after 30 days.
- No selling, no sharing. Our own analytics are never sold, shared, or used for advertising. Google Analytics only loads after you accept, as described in section 4.
- Opting out. Click Decline on the banner or turn on Global Privacy Control, and your visits are only ever counted anonymously. To withdraw consent later, use the button in section 5 or clear this site’s cookies.
- The owner’s own visits. They’re marked by a cookie on the site owner’s own browser and left out of the numbers.
Questions, or a request to see or delete the visit history linked to your device: gem.tra@ogtraplord.com. Include the ogt_vid value from your browser’s cookies for this site; it’s the only way to find that history, because nothing else ties it to you.
7.Your rights and choices
Your data is yours. At any time you can ask to see what we hold about you, correct it, export it, or delete it. Email gem.tra@ogtraplord.com from your account address and it’ll be handled within a few days.
A couple of honest notes: records of completed purchases may be kept for bookkeeping even after an account is deleted, and you can browse most of the site without any account at all.
8.Security
Passwords are bcrypt-hashed, the whole site runs over TLS, admin access is limited to the studio owner, and we practise data minimalism: the least data collected is the least data at risk. No system is perfect; if a breach ever affects you, we’ll tell you plainly and quickly.
9.How long we keep it
- Account data is kept for as long as your account exists.
- Chat transcripts and leads are kept for as long as they’re useful for running the studio, and deleted on request.
- Purchase records are kept for accounting.
- Site analytics are kept for 13 months. IP addresses (stored only for visitors who clicked Accept) are erased after 30 days, and the daily random value behind the anonymous key after 2 days.
- Rate-limit counters are kept for hours, then they roll off automatically.
10.Children
The site isn’t directed at children under 13, and we don’t knowingly collect their information. If you believe a child has given us personal data, email us and it will be deleted.
11.Changes to this policy
When the site gains a feature that touches your data, this page gets updated and the date at the top changes. Meaningful changes get a visible note on the site. No silent rewrites.
12.Contact
Privacy questions, data requests, or anything else: gem.tra@ogtraplord.com (OGtraplord, Bangkok, Thailand). See also our Terms of Service.