Privacy Notice
Effective 18 October 2026
Version ml-privacy-2026-10b. This English text is a translation. The Thai version is the controlling text; if the two differ, the Thai version governs.
1. Who we are
Maison Lilith is a brand of Aether Works Co., Ltd. ("we", "us"), a company registered in Thailand.
- Registered address (head office): 622/149 Rama 2 Road, Samae Dam, Bang Khun Thian, Bangkok 10150, Thailand
- Tax identification number: 0105569152180 (head office)
- Privacy and customer contact: [email protected]
We are the data controller for the personal data described in this notice, under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
This notice covers people who visit maison-lilith.com or buy from it. If you buy Maison Lilith products on Shopee or TikTok Shop, that platform's privacy policy also applies to what you give the platform.
2. What we collect
| Category | Details | Where it comes from |
|---|---|---|
| Contact and delivery details | Name, email address, telephone number, delivery address | You, on the Stripe Checkout payment page |
| Payment information | Payment status, amount, currency, payment method type (card or PromptPay), and a Stripe transaction reference | Stripe. We never receive or store your full card number or card security code. Stripe handles them. |
| Company or tax ID details for your tax invoice (only if you choose to give them) | Full name or company name, 13-digit tax identification number, head office or branch, billing address | You, at checkout |
| Order details | Products, quantities, prices, discounts, promotion codes used, free gifts, order number, delivery status, tracking number, returns and refunds | Created when you place and receive an order |
| Refund details (only if needed) | Bank account name and number, if a refund cannot be returned to the original payment method | You, when you ask for a refund |
| Emails | What you write to us, and our replies; the order and shipping emails we send you | You and us |
| Technical data | IP address, browser and device type, the pages requested, time of request, security signals | Your browser, through our website host Cloudflare |
Tax identification number for individuals. For a person, the 13-digit tax identification number is the same as the national ID card number. We ask for it only when you ask for a full tax invoice, because the Revenue Code requires it on that document. We restrict who can see it.
What stays on your device. Your shopping cart is stored in your own browser (local storage), not in a cookie. It is not linked to your identity. When you ask the site for a price total or go to checkout, your browser sends us the cart contents and any promotion code you entered. That request does not contain your name or contact details.
What we do not collect. You do not create an account with us. We do not collect sensitive personal data such as health, religious or biometric data. We use no advertising or analytics cookies, no tracking pixels and no marketing emails (see section 10).
3. Why we use it, and our legal basis
| Purpose | Legal basis under the PDPA |
|---|---|
| Taking your order, taking payment, packing and delivering it, and contacting you about it, including order and shipping emails | Performance of a contract with you (section 24(3)) |
| Handling cancellations, returns, refunds and complaints | Performance of a contract (section 24(3)); legal obligation under consumer protection law (section 24(6)) |
| Issuing tax invoices and credit notes, and keeping accounting and tax records | Legal obligation under the Revenue Code and the Accounting Act B.E. 2543 (section 24(6)) |
| Applying promotions and their limits, including checking whether a code limited to one use per customer has already been used with your email address | Performance of a contract (section 24(3)); legitimate interest in running promotions fairly (section 24(5)) |
| Preventing fraud and payment abuse, and keeping the website secure | Legitimate interest (section 24(5)) |
| Establishing, exercising or defending legal claims | Legitimate interest (section 24(5)), and sections 24 and 26 as applicable |
| Complying with a court order or a lawful request from a government authority | Legal obligation (section 24(6)) |
| For orders delivered outside Thailand: preparing customs documents and clearing the parcel through export and import customs | Performance of a contract (section 24(3)); legal obligation under Thai customs law (section 24(6)) |
If you do not give the information needed to process an order (name, contact details and a delivery address in a country we deliver to), we cannot accept or deliver the order. Full tax invoice details are optional; if you do not give them, we still issue the tax invoice the law requires for your purchase.
We do not make decisions about you by automated means that have legal or similarly significant effects. Stripe may automatically decline a payment it assesses as fraudulent; you can contact us if that happens.
4. Who we share it with
We do not sell or rent your personal data.
| Recipient | What they receive | Why | Role |
|---|---|---|---|
| Stripe | Contact and delivery details, payment data, order amount | To process payments and refunds | Our service provider (processor). For its own fraud prevention and legal compliance, Stripe acts as an independent controller under its own privacy policy. |
| Cloudflare (Cloudflare, Inc.) | Technical data, and order data passing through our website's server functions | Hosts the website, delivers it and protects it from attack | Our processor |
| Supabase (Supabase, Inc.; database hosted in Singapore) | All order data described in section 2 | Stores our order and customer records | Our processor |
| Brevo (based in the European Union) | Your name, email address and order details, including the tracking number | Sends our order and shipping emails | Our processor |
| Zoho Mail (data centre in the United States) | Emails you send us, and our replies | Receives and stores customer emails | Our processor |
| Delivery companies: Flash Express and Thailand Post (Thailand); DHL Express (orders outside Thailand) | Name, telephone number, delivery address, parcel details; for international orders, also the parcel contents and declared value | To deliver your order and, for international orders, to clear customs | Each uses the data to deliver, under its own terms |
| Customs authorities in Thailand and in the destination country (international orders only) | Name, address, telephone number, parcel contents and declared value, as shown on the customs documents | Export and import customs clearance | Each authority acts under its own law |
| Our accountants and auditors | Order, tax invoice and refund records | Bookkeeping, tax filing and audit | Bound by confidentiality |
| The Revenue Department and other authorities | Only what the law requires | Legal obligation | Not applicable |
| Professional advisers (lawyers) | Only what a matter requires | Advice and disputes | Bound by confidentiality |
| A buyer of all or part of our business | Data related to the part transferred | Business transfer | We will tell you before your data is transferred |
Inside our company, only staff who need it for fulfilment, customer service or accounting can see your data. They use our order system, which runs on a server we operate in Thailand and reads from the database described above.
5. Transfers outside Thailand
Some of our service providers store or process data outside Thailand:
- Singapore: our order database (Supabase).
- European Union: our order and shipping emails (Brevo).
- United States: our customer email inbox (Zoho Mail). Stripe, Cloudflare and Supabase, Inc. are also US companies, and their staff and systems may access or process data from the United States.
- Destination of an international order: DHL Express and the customs authorities of the country you ship to receive the details listed in section 4. DHL may also process them in the countries the parcel passes through.
- Other countries: Cloudflare runs its network worldwide, and website traffic is handled at the location nearest to you. Our providers use sub-processors in other countries, which they list on their own websites.
At the date of this notice, the Personal Data Protection Committee has not published a list of destination countries that it considers to have adequate personal data protection standards. We rely on the following:
- For payment, order processing, order emails, and delivery and customs clearance of international orders, the transfer is necessary to perform the contract with you (PDPA section 28(3)).
- For data storage, hosting and our email systems, our providers' data processing terms include contractual safeguards for international transfers, of the kind recognised in the Personal Data Protection Committee notification on the protection of personal data sent or transferred abroad under section 29.
You may ask for a description of these safeguards at [email protected].
6. How long we keep it
| Data | How long | Why |
|---|---|---|
| Order, payment, tax invoice, credit note and refund records, including the delivery and tax invoice details on them | 5 years from the end of the accounting period in which the order was made, or longer if a tax authority requires it or a tax audit is open (up to 7 years) | Revenue Code section 87/3 and Accounting Act B.E. 2543 section 14 |
| Records of returns, complaints and emails about an order | 3 years after the matter is closed | To handle claims about the products, including claims under the Product Liability Act B.E. 2551 |
| Bank account details given for a refund | Deleted within 90 days after the refund is completed, except the payment record kept for accounting | Only needed to make the transfer |
| Promotion-use records (code and email address) | Kept with the order record | To apply promotion limits and record the discount on the order |
| Website technical logs | No longer than 90 days, unless needed to investigate a specific security incident | Security and troubleshooting |
| Cart in your browser | Until you clear it, place the order, or clear your browser storage | It never leaves your device unless you request a total or go to checkout |
When the retention period ends, we delete the data or anonymise it so it can no longer identify you.
7. How we protect it
We take security measures appropriate to the risk (PDPA section 37(1)), including: encryption in transit (HTTPS); card data handled only by Stripe; access to the order system limited by staff role; database credentials and payment keys kept on the server only, never in your browser; and restricted access to tax identification numbers.
If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to your rights. If the risk to you is high, we will also notify you without delay (section 37(4)).
8. Your rights
Under the PDPA you have the right to:
- access your personal data and obtain a copy, and ask how we obtained data you did not consent to (section 30);
- receive your data in a commonly used machine-readable format, or have it sent to another controller, where technically feasible (section 31);
- object to processing based on legitimate interest (section 32);
- ask us to delete, destroy or anonymise your data (section 33);
- ask us to restrict use of your data (section 34);
- ask us to correct inaccurate, incomplete or out-of-date data (sections 35 and 36);
- withdraw consent at any time, where we rely on consent (section 19); and
- complain to the Office of the Personal Data Protection Committee (section 73).
Some rights have legal limits. In particular, we cannot delete order and tax records during the legal retention period in section 6, but we will restrict their use to that legal purpose.
Send requests to [email protected]. We will reply within 1 working day to confirm we have your request, and we will act on it within 30 days. We may need to verify your identity first, for example by asking you to confirm details of an order. There is no charge.
9. Children
Our products are not intended for children. If you are under 20, please buy with the consent of a parent or guardian.
10. Marketing, cookies and similar technologies
Marketing. We do not send marketing emails or messages. The emails we send are about your order only. If we ever want to send marketing, we will ask for your separate consent first. It will never be a condition of buying, and you will be able to withdraw it at any time.
Cookies and local storage. We use only what the site needs to work:
| Technology | Set by | Purpose | Needed for the site to work? |
|---|---|---|---|
| Local storage: cart | maison-lilith.com | Remembers your cart on this device | Yes |
| Security cookies | Cloudflare | Distinguish real visitors from bots and protect against attack | Yes |
| Cookies on the payment page | Stripe, on Stripe's own domain | Payment processing and fraud prevention | Yes, for payment. Governed by Stripe's privacy policy |
We do not use advertising or analytics cookies or tracking pixels. If we add them, we will update this notice first and ask for your consent before they load.
11. Changes to this notice
We will publish any change on this page with a new version number and effective date. If we want to use your data for a new purpose that needs your consent, we will ask you first.
12. Contact and complaints
Aether Works Co., Ltd., 622/149 Rama 2 Road, Samae Dam, Bang Khun Thian, Bangkok 10150, Thailand
Email: [email protected] (we reply within 1 working day)
If you are not satisfied with our answer, you may complain to the Office of the Personal Data Protection Committee: https://www.pdpc.or.th