Lootan Privacy Policy
Version 0.4
The Thai version is the authoritative one. If the English or Chinese version differs, the Thai version applies.
Effective date: 6 November 2026.Items marked ⏳ belong to features that are not live yet. They apply only once that feature is released.
1. Who we are
The operator of Lootan ("we") is Super Partner Enterprise Service Co., Ltd. (the Thai registered name will be added later).
Address: 206/75 Moo9, Central Pattaya Rd, Pattaya City, Bang Lamung District, Chon Buri 20150
We have not appointed a separate Data Protection Officer (DPO). For personal data matters, contact Lootan@spesthai.com.
2. What this policy covers
This policy covers the Lootan website and web app (PWA).
You can view draw results and number pages without signing in.
Features such as saving numbers require you to sign in with your email.
3. Data we collect
| Data | When | What for |
|---|---|---|
| At sign-up / sign-in | Sign-in and sending verification codes (we do not send result notification emails at present; before we start, we will update this policy) | |
| Verification code records | When you request a code | Check the code (we store only a keyed hash of the email and of the code, never the code itself) |
| Session | After sign-in | Keep you signed in (Cloudflare KV holds a hash of the session token, the linked account ID, and the creation and last-activity times; the token itself is not stored; the database also keeps the time of your last "sign out of all devices" so that older sessions stop working) |
| Language and large-font settings | After sign-in, when you change settings | Show pages the way you chose, and send emails in your language |
| Notification settings (email and Web Push on or off) | After sign-in, when you change them | Remember whether to send you notifications |
| Confirmation that you are 20 or older | At sign-up | Age requirement (we only record "confirmed"; we do not collect your date of birth for this) |
| Consent records (type, status, time, where given, and the version number of the terms and policy) | At sign-up and when you change settings | To show when and how you gave consent |
| Sign-up channel (if any) | At sign-up | Channel statistics |
| Referrer ⏳ | When you sign up through an invite link | Invite rewards |
| Saved numbers, with how you added them (scan, album, typed in, or dream interpretation) and the time saved; for a scanned ticket, also the content of the square code | When you save numbers or scan a ticket | Compare with draw results and notify you |
| Draw comparison results (for each draw: win or no win, number of tickets, total prize amount, and only the numbers that won, with their prizes) | After each draw, when we compare your saved numbers | Show "My results" and decide whether to notify you |
| Notification records and Web Push subscription data | When you turn on notifications | Send notifications (you can turn them off at any time) |
| Win cards and share pages (prize level, draw date, amount, a partly hidden number, whether the ticket was scanned; no name, email, ticket photo, barcode or square-code content) | When you choose to create and share a card | To create a shareable image and a public share page |
| Content shown on the winners wall ⏳ | When you choose to join | Show a win (voluntary, can be anonymous, and you can have it taken down at any time) |
| Date of birth and gender (optional) ⏳ | When you enter them yourself | Personalised dream interpretation; you can edit or delete them at any time |
| Points ledger and check-ins | When you sign up, check in, or use points | Calculate points (points are valid for a limited period, shown on the points page) |
| Entitlements ⏳ | When you receive one | Give you the right to use it |
| Device hash ⏳ | At sign-up or when claiming rewards | Count rewards once per device and prevent abuse |
| AI usage records (date, feature, points used, token count, provider, response time) | When you use AI dream interpretation, which costs points | Control quotas and costs |
| Dream interpretation records (the dream text you entered after we clean it, the text the AI wrote, and the numbers the AI gave) | When an interpretation succeeds | Show you the same result for the same dream on the same day without charging points again |
| Feature votes (which features you picked, and when) | When you vote on the feature voting page (editing replaces your earlier choice) | Help us decide which features to build first. We do not store your IP address, browser details or free text with a vote |
Without an email, you cannot sign in or use features that need an account. You can still view draw results and number data without signing in.
We do not sell your personal data.
Share pages are public: anyone with the link can see the card. The link is random and cannot be guessed, and the page asks search engines not to index it, but we cannot stop people who have the link from forwarding it. Once you post the link or image on LINE, Facebook or similar services, those services handle it under their own policies and we cannot control that.
4. Data we do not collect
- Ticket photos: Scanning and picking an image from your album are processed on your phone. The image is not uploaded or saved. Our server only receives the content of the code that was read.
- Photos from "Snap the numbers around you" ⏳: The photo is sent to an AI provider to read the digits (see section 8). We delete it right after the digits are read. We do not save, display or share it.
- We do not ask for your real name, phone number or national ID number.
5. Technical data and logs
- Our request logs record only the method, path, status code and duration. They do not record IP addresses, emails or AI-generated text. They are kept for 7 days.
- Each log entry carries an identifier that Cloudflare adds automatically (for example a Ray ID). It is a request number, not an IP address.
- Rate limiting by IP works in two separate ways:
- Limiting verification-code requests: counted by Cloudflare's rate-limiting feature. We do not store the IP or a hash of it.
- Counting daily uses of the AI number explanation: our database stores only a hash of the IP combined with a daily random salt. It does not store the original IP. The next day we delete the previous day's salt and counters.
- Cloudflare is our network provider, so it processes your IP address while delivering traffic (for example protection, request rate limiting, and Cloudflare Turnstile, which checks whether a visitor is a bot), under Cloudflare's own policies.
- We do not currently use traffic-statistics tools, advertising, or tracking cookies. Before we start using any, we will update this policy.
6. What we use your data for
| Purpose | Legal basis |
|---|---|
| Sign you in, send verification codes, save numbers, compare them with draw results, send notifications, run the points system, provide dream interpretation, and create the win cards and share pages you ask for | Performance of a contract |
| Prevent abuse, security, logs (for example mass sign-ups, scripts, disposable emails) | Legitimate interest |
| Count feature votes to decide which features to build | Legitimate interest |
| Cross-border transfer for dream interpretation | Necessary to provide the service you request |
| Cross-border transfer for "Snap the numbers around you" ⏳ | Necessary to provide the service you request |
| Age confirmation | Performance of a contract (the Terms of Service require users to be 20 or older) |
7. Marketing emails and in-site ads
- We do not send marketing emails.
- We may show ads in in-site ad slots. For now they show only Lootan's own content or partnership information. We do not use third-party ad networks, we do not choose ads based on your personal data, and we do not give your data to advertisers.
- If this changes, we will update this policy first.
8. AI features and cross-border transfer
- AI-generated content is labelled as follows: the number explanation is labelled "Generated by AI, may contain errors", and AI dream interpretation is labelled "Generated by AI, for entertainment only".
- In the number explanation feature, AI does not calculate numbers and does not make up numbers. It only restates statistical facts computed from draw records. In dream interpretation, AI may give numbers based on what you describe in your dream. They are for entertainment only, they are not a prediction, and each draw is independent.
- Number explanation: the AI receives only the statistical facts about that number. No user data, such as your email, is sent to the AI.
- Dream interpretation: we send only the dream text you entered (after we remove control characters and markup) and the language of the page. We do not send your email, your account ID or other identity data. A dream description is free text, so please do not enter names, addresses or other personal information about yourself or others. The dream page shows this notice before you submit. We keep the dream text and the result in your account (see section 10).
- ⏳ When "Snap the numbers around you" is released: we will send only the photo needed to read the digits. We do not send your email or other identity data.
- We call AI through OpenRouter. The processing providers we selected are DeepInfra (primary) and Cloudflare (backup), located in the United States and other countries. Your data is therefore sent outside Thailand. This transfer is necessary to provide the service you request.
- We set our requests to use only providers that do not collect data to train models, and we try to choose options where data is not retained. However, we cannot fully control the internal policies of those providers.
9. Who we share data with (providers and locations)
| Provider | Role | Location |
|---|---|---|
| Cloudflare | Website hosting, transactional email (verification codes, result notices), session storage, logs, Turnstile, queues, file storage, and database backups | Worldwide (Cloudflare network) |
| Supabase | Database | Singapore (ap-southeast-1) |
| OpenRouter and AI providers (DeepInfra, Cloudflare) | Processing for AI features (number explanation: statistical facts about numbers; dream interpretation: the dream text you enter; they do not receive your email or account ID) | United States and other countries |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Relay Web Push notifications to your device, only if you turn on notifications. They receive the notification text (encrypted so that only your device can read it) and your subscription address | Worldwide (each provider's network) |
Cloudflare's email service keeps sending records (recipient address, time, status), under Cloudflare's policies.
We may also disclose data where the law or an order of a competent authority requires it.
LINE and Facebook are not our service providers. We hand a link or image to them only when you choose to share it yourself.
Cross-border transfer: your data is stored or processed outside Thailand: the database at Supabase in Singapore; the website, email and backups through Cloudflare's global network; and AI providers in the United States and other countries; and, if you turn on notifications, the push services of browser makers. The basis is that this is necessary to provide the service you request, and the data protection terms of those providers.
10. How long we keep data
| Data | Period |
|---|---|
| Account data | While your account exists. When you delete your account, we delete the data. |
| Saved numbers, comparison results, notification records, points and check-ins, AI usage records, dream interpretation records, feature votes | While your account exists, and all of them are deleted when you delete your account. You can delete saved numbers one by one and change or clear your feature votes yourself; a single dream interpretation record cannot be deleted on its own. A Web Push subscription is removed when you turn off notifications on that device. Points expire after the period shown on the points page, but the records stay until the account is deleted. |
| Win cards and share records | Kept while your account exists. When you withdraw a share, the draw result it is based on is corrected, you delete the saved number, or you delete your account, the share page stops working immediately and the card images are deleted within 90 days at the latest. We cannot recall copies cached by other platforms or saved by others. |
| Email verification codes | Valid for 10 minutes. The record holds only keyed hashes of the email and the code, and is deleted within 24 hours. |
| Temporary data during sign-up | If the code is verified but sign-up is not completed, the email is kept for at most 30 minutes. |
| Sessions | Expire after 30 days without activity, and immediately when you sign out. |
| Request logs | 7 days |
| IP hashes and daily salts | Deleted the next day |
| Backups | Database backups are stored encrypted in Cloudflare R2 and deleted automatically after 30 days (data you have deleted may remain in backups until then). |
| Consent records | While your account exists; deleted together with the account when you delete it. |
11. Your rights
You have the right to:
- ask to see your data
- ask for a copy / export of your data
- ask us to correct your data
- ask us to delete your data or your account (except where the law requires us to keep it)
- object to the processing of your data
- ask us to restrict the processing of your data
- withdraw consent you have given (to withdraw your consent to the terms and this policy, delete your account or email us)
- turn off notifications (Web Push) at any time
- withdraw a win card you have shared (at any time, from "My results")
- complain to the Personal Data Protection Committee (PDPC)
How to use your rights: exporting your data and deleting your account can be done on the "Me" page, and you can also email a request to Lootan@spesthai.com. To see your data, download the export file on the "Me" page. To correct your data, send a request by email. You can delete saved numbers one by one and change or clear your feature votes yourself. The export file includes your share records (full number, share ID, status, times) but not the card images.
To prevent others from impersonating you, we accept only requests sent from your account's email address, and we may ask you to act while signed in.
Deleting your account requires a confirmation code that we send to your email.
We will reply within 30 days.
12. Cookies and local storage
- The session cookie
__Host-lootan_session(HttpOnly, Secure) is used only to keep you signed in. - The temporary sign-up cookie
__Host-lootan_reg(valid for 30 minutes). - When you are not signed in, language and large-font settings are stored only in your browser. After you sign in, they are also stored in your account.
- The language cookie
NEXT_LOCALE, which remembers the interface language you chose (a session cookie). - We ourselves set no other cookies and use no statistics or advertising tracking tools. Cloudflare Turnstile on the sign-in page is processed by Cloudflare and may store necessary information in your browser, under Cloudflare's policies.
13. Age
This service is for people aged 20 or older (the age to buy lottery tickets in Thailand). You must confirm your age at sign-up. We do not direct the service to people under 20.
14. Security measures
What we have in place today:
- Sign-in with an email verification code (valid for 10 minutes; the code is voided after 5 wrong attempts)
- The email and the code in the verification code records are stored as keyed hashes
- Cloudflare Turnstile on the sign-in page
- Request rate limiting, and blocking of disposable email addresses
- HttpOnly session cookies
- Data sent over HTTPS
No system is completely secure. We cannot guarantee the security of data in every situation.
15. Changes to this policy
When we change this policy, we will announce it on the website and update the version number and date. For significant changes, we will give at least 7 days' notice by email or an in-site notice, and ask for your consent again where the law requires.
16. Contact us
Email: Lootan@spesthai.com (we have not appointed a separate DPO)