Privacy Policy

• Account data: username, shop name and email (if you provide one)
• LINE profile: LINE user ID, display name and profile picture, when you log in with LINE or use the LINE bot
• Google account: Google user ID, name, email address and profile picture, when you sign in with Google
• Slip data sent for verification: QR data, payer and payee names, account numbers masked by the bank, banks, amounts, transaction times and transaction references
• Technical data: request IP addresses and device/browser information (user-agent)
• Login and session logs, and activity logs in the portal
• Payment and order records, such as the plans you buy, amounts and the slips you upload to confirm a transfer
• Cookies needed for the website to work, and analytics/marketing cookies if you consent (see “Cookies”)

We use data for the following purposes, relying on performance of a contract, legitimate interests and legal obligations as applicable.

• Providing slip verification and related features such as verification history, webhooks and the LINE bot (contract)
• Detecting duplicate and fake slips and preventing fraud (legitimate interest)
• Billing, managing plans and keeping payment records (contract and legal obligation)
• Answering questions and providing support (contract and legitimate interest)
• Security, audit trails and preventing misuse (legitimate interest and legal obligation)
• Improving and developing the Service (legitimate interest)
• Website analytics and ad measurement with analytics/marketing cookies (consent — see “Cookies”)

If a purpose ever requires your consent, we will ask for it separately, and you can withdraw it at any time.

The data in slips that shops send for verification belongs to the shops' customers. The shop is the data controller for that data, and SLIP2TRY processes it on the shop's behalf to provide slip verification. Shops are responsible for informing their customers and for having a legal basis to send the data.

Verification results are cached and shared across shops only to detect duplicate or fake slips. Shops cannot see other shops' verification history.

The “Latest checks” feed on our home page shows only the bank, amount and time of recent checks — never names or account numbers.

If you are a shop's customer and want to exercise your rights over slip data, please contact that shop first. We will help the shop handle related requests.

We share only what is necessary with the following recipients, who process data to provide services to us:

• Bank-transaction verification provider — to confirm slips with the bank
• LINE — for LINE login and messaging through the LINE bot
• Google — for signing in with Google
• Cloudflare (Turnstile) — checks that sign-ups come from real people, to block bots
• Google (Google Analytics), Meta, LINE (LINE Tag) and TikTok — website usage data from analytics/marketing cookies, only if you consent (see “Cookies”)
• Cloud hosting and database providers — to store and process Service data
• Government authorities or other parties with legal authority — when required by law

Some of these providers may process or store data outside Thailand. When that happens, we transfer data with appropriate safeguards as required by the PDPA.

Cookies fall into 3 categories. Necessary cookies are always used; analytics and marketing cookies are used only if you click “Accept all” in the cookie bar or turn that category on in “Cookie settings”. The tools actually in use are listed in the cookie settings window.

• Necessary — session cookies (keep you logged in), the language cookie, the referral cookie (set when you open an invite link, so the inviter can be rewarded), LINE/Google login state cookies (used briefly for security) the visit-source cookie (s2t_attr, kept for 90 days — only the utm link, referring website and landing page, used to record which channel a shop signed up from; never shared with third parties) and the cookie that remembers your cookie choice (s2t_consent, kept for 12 months)
• Analytics (consent required) — Google Analytics 4: counts visitors, pages viewed and where visits come from, so we can improve the website
• Marketing (consent required) — Meta Pixel (Facebook/Instagram), LINE Tag (LINE Ads) and TikTok Pixel: measure which ads lead to visits, sign-ups, free-use claims and plan purchases

What we send to analytics and marketing tools are usage events (such as page views, completed sign-ups, free-use claims, checkout starts and purchases with the plan code, amount and order number), together with device data and that provider's own cookies. We never send names, emails, phone numbers, LINE user IDs or slip data to these providers. Each provider processes data under its own policy and may do so outside Thailand.

You can change your mind or withdraw consent at any time from the “Cookie settings” link at the bottom of every page (choose “Necessary only” or turn off the categories you don't want). The website then stops sending data and deletes that tool's cookies from your browser; you can also delete cookies in your browser settings. Declining does not affect your use of the Service.

We will ask for consent again after 12 months, or when we change the tools or purposes.

Your theme setting (light/dark) is stored only in your browser.

We keep data for as long as your account is active. Shops can request deletion of their data or closure of their account through our contact channels.

Some records, such as payment evidence and accounting records, may be kept longer where the law requires it.

Under the PDPA you have the following rights, which you can exercise through the channels under “Contact us”:

• Access your personal data and obtain a copy
• Correct inaccurate or outdated data
• Have your data deleted or anonymised
• Restrict the use of your data
• Object to the collection, use or disclosure of your data
• Receive your data or have it transferred (data portability)
• Withdraw consent where processing is based on consent
• Complain to the Personal Data Protection Committee (PDPC)

We may ask you to verify your identity before acting on a request, and may decline a request where the law allows.

• Passwords and API keys are stored hashed — we don't keep key secrets in readable form
• Data is encrypted in transit (HTTPS)
• Access to data is limited to those who need it, and administrator actions are logged
• Shops can restrict which IPs may use an API key (IP whitelist) and can view and sign out logged-in devices

If a personal data breach occurs, we will notify the PDPC and affected people as required by law.

We may update this policy from time to time and will show the date of the latest update at the top of this page. For significant changes, we will also let you know on the website or in the portal.

For questions or to exercise your data rights, contact SLIP2TRY through the following channels:

• Telegram support: @blacksteps
• Discord support: discord.gg/Utr2KgzjqE