Privacy policy

Kudds is a submission platform for competitions, classes and other programs where people hand in work. It’s run by Rachata Suksereekul, an individual based in Bangkok, Thailand. In this policy, “Kudds”, “we” and “us” mean him.

Some data is ours to look after: your account, and how you use the website. For that data, Kudds is the data controller under Thailand’s Personal Data Protection Act (PDPA). Some belongs to the people running a space (a simple submission, a competition or a project). They decide what to ask participants for and what to do with it, and we process it for them. For that data, the space’s owner is the controller and Kudds is a processor.

Write to info@kudds.com about anything in this policy. If you need a postal address to send a legal notice, ask us there and we’ll give you one.

If Kudds becomes a company, that company will take over this policy and look after your data in the same way. We’ll tell you before it happens.

• Account details: your name, email address, and anything you add to your profile, such as a photo, username, organization or bio. If you set a password, we keep only a secure one-way hash of it, never the password itself.
• Your date of birth, asked once for your account. If you’re under 20, we also note that a parent or guardian agreed.
• What you tell us when you first set up Kudds: how you heard about us and what you’d like to do with it. Both are optional.
• If you sign in with Google or Discord: the name, email address and profile photo they share with us. Nothing else from those accounts (not your contacts, servers or messages), and we never post for you.
• What you do in a space: your registration and the answers to an organizer’s questions, your team, the files, links and text you submit, and a receipt for each version.
• Project work: your team’s plan, your peer ratings of teammates, and the grades and feedback organizers give.
• Entry fee slips: when a space charges an entry fee, the payment slip you upload, kept so its organizers can check your payment. Kudds doesn’t process payments. You pay the organizers directly.
• What organizers and judges add: checks, scores, comments, decisions and announcements.
• If you pay for Pro: your plan and your payment history. Stripe handles your card, and we never see the number.
• Messages you send us by email, live chat or Facebook.
• Technical data: your IP address (used briefly to stop abuse), error reports when something breaks, and page views and loading times counted without cookies.
• Your devices: the browser and rough location (city and country) of each device you’re signed in on, so you can see them under Security and sign any of them out.

We don’t ask for sensitive personal data, such as health, religion, biometric data or criminal records. Organizers mustn’t ask for it either, unless they truly need it and have your explicit consent. If a space asks you for something like that, you can ask its organizers why, or tell us.

• To run your account and the spaces you organize or take part in.
• To show each space’s organizers and judges the work and registrations for that space, and only that space.
• To send the emails you need: sign-in codes and links, invitations to an organizing team, and updates from the spaces you take part in.
• To keep Kudds safe and working: stopping spam and abuse, finding and fixing errors, and seeing which pages are slow.
• To know when a parent or guardian needs to agree, and to keep Kudds within age rules. That’s all your date of birth is used for.
• To take payments for Pro and keep the records tax law asks for.
• To answer your messages.

Today we send only service emails. We don’t send newsletters or marketing emails. If we ever do, we’ll ask for your consent first, and you can change your mind at any time.

We don’t sell your data, show you ads, or use what you submit to train AI models.

The PDPA asks us to name a lawful basis for each thing we do with your data. For the data Kudds controls:

For what participants submit in a space, the organizers choose the basis, and we process it on their instructions. Where we rely on legitimate interest, you can object. Where we rely on consent, you can withdraw it at any time.

• Organizers see the registrations and submissions in their own space. Judges see the work they’re given. With independent scoring, they don’t see each other’s scores until they’ve given their own.
• Peer ratings are private to the organizers. Teammates never see what you gave them or what they were given.
• Grades and feedback are shown to you only once the organizers release them.
• Organizers see how often their space’s page was viewed and where visits came from, such as LINE or a link they shared. These are counts only, never who visited. If you registered through someone’s invite link, the organizers can see whose link it was, and that person sees only how many joined through it.
• A space’s page can be public. Anyone with the link sees what the organizers publish there. We may show public space pages, such as a space’s name and artwork, to promote Kudds. Organizers can opt out by writing to us. Your profile shows only what you choose to make public.
• Your date of birth is private. It’s never shown on your profile, to organizers or to judges.
• A small number of people at Kudds can open accounts to give support or keep the service safe. Every such access is recorded.

We run Kudds with a few providers. Each one handles data only to provide its service to us, under its own security and data processing terms.

Your account and everything in a space are stored in Tokyo, Japan (PlanetScale, region ap-northeast-1), uploaded files in the Asia-Pacific region (Cloudflare R2), and the app runs on servers in Tokyo.

Some of this happens outside Thailand. Where it does, we rely on each provider’s contractual commitments and safeguards to protect it. We’ll update this list before we add a new provider.

We use only the cookies Kudds needs to work:

• Your sign-in session.
• Your language and currency choices.
• An access code you entered for a space, so you don’t type it again.
• A short step while you sign in with Google or Discord.
• The support chat (Crisp), so a conversation you started is still there on the next page.

No cookies for advertising or tracking. Some pages also remember small choices in your browser, such as the view you last used for a plan.

What’s in a space stays as long as the space does. When its owner deletes it, everything in it is deleted too: registrations, submissions, files, plans, grades and reviews.

Your account stays until you delete it, or until it’s removed for breaking our Terms. A deleted account can be restored for 30 days, then it’s erased with the spaces you own and your entries in other spaces.

Your date of birth stays while you have an account, and is erased with it. You can correct it in Settings, under Account.

Billing records, such as payments and refunds, are kept for as long as Thai tax and accounting law requires, currently 5 years, even after an account is deleted.

Security logs of who opened which file are kept for 12 months, then deleted.

Backups, error reports and server logs are cleared on a rolling basis, within 90 days. Something you delete can stay in them until then, out of use.

Under the PDPA, you can ask to see the personal data we hold about you, get a copy, correct it, have it sent to another service, object to or limit how we use it, or have it deleted. Where we rely on your consent, you can withdraw it at any time.

Most details can be changed on your Account page. For anything else, write to info@kudds.com. We may ask you to confirm who you are, then we’ll answer within 30 days. For data inside a space, you can also ask its organizers, who decide how it’s used.

If you’re not happy with our answer, you can complain to the Office of the Personal Data Protection Committee (PDPC) in Thailand.

If you’re in the EU or the EEA, the GDPR also applies to the personal data we look after. We rely on the same bases listed above: contract, legitimate interest, legal obligation and consent.

You can ask to access your data, correct it, delete it, get it in a format you can take elsewhere, or object to how we use it. You can also complain to the data protection authority where you live.

Your data is stored in Japan, and some providers work from the United States. These transfers are covered by our providers’ standard contractual clauses.

Write to info@kudds.com for any of this.

Delete your account in Settings, under Account. It goes offline at once, and you can restore it for 30 days by signing in with the same email. After 30 days it’s erased for good, with the spaces you own and your entries in other spaces. You can also ask us at info@kudds.com.

Signed in with Google or Discord? Deleting your Kudds account removes what they shared with us too. To take Kudds off that account as well, open its connected apps settings (myaccount.google.com/connections for Google, Authorized Apps in Discord’s settings).

We take reasonable steps to protect your data. Connections are encrypted, files sit in private storage and open only through short-lived links after Kudds checks you’re allowed to see them, sign-in attempts are limited, 2-step sign-in is available, and opening a submission is recorded. Only the founder can reach the production systems. No system is perfectly secure, so we can’t promise your data will never be exposed.

If a breach affects personal data Kudds controls, we’ll notify the Office of the PDPC within 72 hours of finding out where the law requires it, and tell the people affected without delay when the risk to them is high.

If it affects a space, we tell its owner without delay, so they can act for their participants.

Found a security problem? Write to security@kudds.com. Please give us time to fix it before telling others, and don’t open or change other people’s data while testing.

When the way we handle data changes, we’ll update this page and the date at the top. If a change matters, we’ll tell you by email at least 30 days before it takes effect.

This policy is provided in Thai and English. If the two differ, the Thai version applies to users in Thailand, and the English version to everyone else.