Privacy Policy

Effective date: 29 October 2026 (or the later date this document is first published)
Last updated: 29 October 2026 (or the later date this document is first published)
Website: https://www.eclipse9.com

1. Who is responsible for your information?

ECLIPSE 9 is operated by Chayangkoon Hanwang, contactable at admin@eclipse9.com (“ECLIPSE 9”, “we”, “us” or “our”). We are the controller of personal data processed for the purposes described in this Policy.

Privacy contact: admin@eclipse9.com
Privacy-related enquiries, including requests about any applicable representative or data-protection contact, should be sent to admin@eclipse9.com.

This Policy explains how we handle information about visitors, account holders, members, purchasers and people who contact us. It covers E9 ID, My ECLIPSE, the Novel Reader, E9 Wallet, memberships, badges, Digital Cards and other collection features to the extent available.

We apply the Thai PDPA and other applicable privacy laws. The GDPR provisions below apply when the relevant processing falls within its territorial scope, including applicable EU/EEA establishment, offering-of-services or behaviour-monitoring circumstances. Accessing our website from Europe does not, by itself, determine the legal position.

Acknowledging this Policy is not blanket consent. Where consent is required, we request it separately for a specific purpose.

2. What information do we process, and where does it come from?

If online payments are enabled, the checkout will identify the payment provider and its privacy notice before payment. We process order details, payment status and the transaction references needed to deliver purchases, investigate errors and manage refunds. We will update this notice before introducing a payment integration that changes our data processing. Do not send passwords, one-time codes or full card details to customer support.

If someone reports misuse or infringement, we may receive information from that person or their representative to investigate the report. We will provide additional information about indirect collection when required by law.

We do not request sensitive personal data for ordinary account use. Please avoid including health, biometric or other sensitive information in your profile or support messages. If a specific feature needs such data, we will first provide a separate notice and establish the required legal basis.

3. Why we process information

We use only information necessary for the stated purpose. Applicable bases are assessed separately under the PDPA and GDPR; the availability of a basis under one law does not automatically establish a basis under another.

Where we rely on legitimate interests, we assess necessity and the impact on your rights and freedoms. You may ask about that assessment and object where the law permits.

Account, authentication and transaction information marked as required is necessary to provide the relevant service or meet a legal requirement. Without it, we may be unable to open an account, complete a purchase or issue required records. Optional marketing and non-essential cookie consent are not conditions of access to core services.

4. Who receives information?

We disclose information only as necessary to the following categories:

• Hosting, database, storage, authentication and security providers.
• Payment providers and parties needed to investigate refunds, disputed charges or suspected fraud.
• Email-delivery and customer-support providers.
• Analytics and advertising providers identified in our Cookie Notice, subject to your choices.
• Accountants, legal advisers, insurers and auditors where necessary.
• Courts, regulators and authorities where disclosure has a lawful basis.
• A prospective successor or purchaser in a genuine business restructuring, subject to confidentiality, data minimisation, an appropriate legal basis and required notices.

We use Supabase as our backend platform. Depending on the enabled features, it processes database records, authentication information and stored files on our behalf. Its processing terms are available at https://supabase.com/legal/customer-resources/data-processing-addendum and its subprocessor information at https://supabase.com/legal/customer-resources/subprocessor-list. This statement does not mean every Supabase feature is enabled. Processors acting for us must process information under appropriate contractual instructions and safeguards. Independent controllers apply their own legal obligations and notices.

We do not sell personal data. Display names, profile images, badges and collection items are visible to others only as you choose or as clearly explained before enabling a public feature. Email addresses, wallet balances and payment histories are not public profile information.

5. International processing and transfers

We are based in Thailand. For hosted Supabase services, core project data is stored in the project's configured region. Depending on the service configuration, support, operational processing and subprocessors may involve other countries. Current vendor location information is available at https://supabase.com/legal/customer-resources/subprocessor-list. Protection and legal rights may differ between countries.

For transfers governed by the Thai PDPA, we use an applicable lawful transfer mechanism and required safeguards. For transfers subject to GDPR Chapter V, we identify and implement an applicable mechanism, such as a relevant adequacy decision or appropriate contractual safeguards, including the European Commission's Standard Contractual Clauses where suitable, together with necessary transfer assessments and supplementary measures.

Supabase's contractual transfer provisions are described in its Data Processing Addendum. The appropriate mechanism must apply to the particular data flow; a vendor's standard terms alone do not establish that every transfer by ECLIPSE 9 is compliant. We do not treat agreement to these Terms or this Policy as consent to unrestricted international transfers. Contact admin@eclipse9.com for information or a copy of relevant safeguards, subject to necessary redactions.

6. How long we retain information

When information is no longer needed, we delete it, securely destroy it or irreversibly anonymise it. Account deletion does not automatically erase records that must lawfully be retained. Restricted backup copies are removed under the stated schedule and are not restored to ordinary use without reapplying relevant deletion restrictions.

7. Cookies and similar technologies

Strictly necessary technologies support authentication, security and features you request. Non-essential analytics, advertising and similar technologies remain off until you opt in under our consent approach.

Where optional technologies are offered, you can accept, reject or select categories using the website's cookie controls. You can also contact admin@eclipse9.com to withdraw consent or obtain help. Rejecting must be readily available, and withdrawing consent must be as easy as giving it. Browser controls may offer additional choices, although disabling necessary technologies may affect functionality.

Before any optional technology is activated, its consent interface must identify its provider, purpose, duration and relevant third-party access. Necessary session and authentication storage is used only for features you request. These rules also apply to equivalent pixels, SDKs and local-storage tools; changing the technology's name does not remove consent requirements.

8. Your rights

Depending on the law and circumstances, you may request access and a copy, correction, deletion, restriction or suspension of use, portability, and information about the source of data not collected directly from you. You may also withdraw consent and object to relevant processing.

For GDPR processing, you may object to processing based on legitimate interests on grounds relating to your situation. We will stop unless a lawful exception permits continuation. You may object to direct marketing, including related profiling, at any time; we will stop using your data for those purposes. Portability applies within its statutory conditions and does not transfer intellectual-property rights or make Digital Cards transferable.

Contact admin@eclipse9.com to submit an account or privacy request. We may request proportionate information to verify identity or authority. Withdrawing consent does not affect processing that was lawful before withdrawal.

For GDPR requests, we respond without undue delay and normally within one month. Where permitted because of complexity or number of requests, we may extend by up to two further months and explain the extension within the first month. Requests are normally free; any refusal or fee must meet the law's conditions and will be explained. PDPA requests are handled within the applicable Thai statutory deadlines, including the applicable access-request deadline.

You can complain to Thailand's Office of the Personal Data Protection Committee. Where GDPR applies, you may also complain to an appropriate EU/EEA supervisory authority, including in your habitual residence, place of work or place of the alleged infringement, without first contacting us. Authority information: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

9. Children and young people

Account and purchasing eligibility is explained in our Terms. The capacity to enter a contract and the capacity to consent to data processing are separate issues.

Under the Thai PDPA, where consent is required and the minor cannot validly provide it alone, we obtain the legally required authorisation from the holder of parental responsibility; for a child not over ten years old, consent is sought from the legally authorised holder of parental responsibility.

Where GDPR Article 8 applies to an online service offered directly to a child on the basis of consent, the relevant national threshold is between 13 and 16. Below the applicable threshold, we require and take reasonable steps to verify parental authorisation. We do not use “13” as a universal threshold.

If we learn that required authorisation is missing, we will assess the situation and restrict the relevant processing or remove information as appropriate. A parent or guardian may contact admin@eclipse9.com. Any content age restrictions must be applied separately.

10. Automated decisions and profiling

Routine wallet calculations and badge awards may be automated. If you believe an automated restriction has materially affected your account, you may request a review at admin@eclipse9.com. The use of a backend platform does not itself establish whether GDPR Article 22 applies to a particular decision.

If significant automated fraud restrictions or other qualifying decisions are introduced, we will first provide the required information about their operation, consequences and legal basis, and the applicable rights to human intervention and challenge. Any optional personalisation or advertising profiling must also be described in the relevant feature or Cookie Notice.

11. Security and incidents

We maintain technical and organisational safeguards appropriate to the risks, covering access management, transmission, authentication and incident handling. No system can guarantee absolute security.

We investigate suspected personal-data breaches and make notifications to regulators and affected individuals where required. Applicable PDPA and GDPR notification thresholds are assessed separately; where required, regulator notification is made without undue delay and within the applicable 72-hour period where feasible, with reasons for delay when necessary.

12. Changes and new purposes

We publish the current version and effective date here. Material changes will be communicated through an appropriate channel. Before using information for a new purpose, we provide any required additional notice and establish a valid legal basis, obtaining fresh consent when required. Continued browsing is not treated as consent to new optional processing.