YELZIPrivacy policy
What Yelzi collects, why, how long we keep it, who receives it, and how to use your rights under Thailand's Personal Data Protection Act.
Who we are and what this covers
Yelzi (“we”) is the data controller under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) for the data collected through the Yelzi app on iOS and Android and the website yelzi.com.
You can watch Yelzi without an account (as a guest) or sign in with Google to get an account, profiles and a list that follow you to every device. This policy covers both.
What we collect, why, and our legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| A random install id made by the app or browser, and session tokens (stored as hashes) | Let you watch without signing in, keep your session, stop token reuse | Necessary to provide the service (contract, section 24(3)) |
| Your operating system's device id (Android ID or iOS identifierForVendor) — we keep only an irreversible HMAC of it, never the id itself · device model, OS, app version | Count active devices, show “signed-in devices”, cap how often an ad is shown, prevent abuse | Legitimate interests (section 24(5)) |
| Your Google account when you sign in: email, name and Google account id (subject id) — we never receive your password and do not store your Google profile photo | Create your account, sign you in, confirm it is you before deleting the account | Necessary to provide the service (contract, section 24(3)) |
| Profiles (up to 5 per account, kids profiles included): name, a picture from Yelzi's own set, maximum rating, language, subtitles, autoplay, favourite genres · a profile PIN is stored only as a salted HMAC | Keep each person's experience separate, filter by rating, lock a profile | Necessary to provide the service (contract, section 24(3)) |
| Watching: where you stopped (continue watching), watch history, My List | Let you continue where you left off and keep your list | Necessary to provide the service (contract, section 24(3)) |
| Playback records: the episode played, time, device, country | Deliver the video, check free-episode access, rank popular series, overall statistics | Legitimate interests (section 24(5)) |
| App usage events (e.g. screen opened, button tapped, episode started or finished) linked to a pseudonymous viewer id | Improve the app and fix problems | Legitimate interests (section 24(5)) · on the website only after you choose “Accept all” (consent, section 19) |
| Ad events: the ad shown, how far it played, skips and clicks, linked to a pseudonymous device id (kids profiles never get ads) | Show ads that fit the series, cap frequency, report totals to advertisers | Legitimate interests (section 24(5)) so that free episodes exist |
| IP address and the approximate country derived from it | Security, rate limits, offering the content available in your country | Legitimate interests (section 24(5)) |
| Website cookies (see the Cookie policy) | Remember the age confirmation, language, cookie choice and the session that plays free episodes | Essential cookies: sections 24(3) and 24(5) · analytics: consent |
| Messages you send us (e.g. email) | Answer your questions and rights requests | Legitimate interests (section 24(5)) and legal obligations (section 24(6)) |
We do not collect your birth date, phone number, location more precise than the country, contacts or the photos on your device. We do not read Apple's (IDFA) or Google's advertising id and do not track you across other companies' apps or websites.
Transfers outside Thailand
The processors above may store or process data on servers outside Thailand. We transfer data only to providers with appropriate safeguards under sections 28 and 29 of the PDPA, such as that provider's standard data protection clauses.
How long we keep data
| Data | Kept for |
|---|---|
| Account, Google link, profiles, PINs, settings, favourite genres | The life of the account · when you delete the account it closes at once and is deleted for good after 30 days |
| Continue watching, watch history, My List | The life of the profile · deleted with the profile or the account |
| Playback records | 30 days |
| Daily activity records (counting active users) | 90 days · removed at once when the account is deleted for good |
| PIN attempt records | 30 days |
| Ads shown and ad events | 13 months (to reconcile with advertisers) · daily frequency data 3 days |
| Usage events | As long as they help improve the service · unlinked from the account when the account is deleted |
| Website cookies — see the Cookie policy | 30 to 400 days depending on the cookie |
After an account is deleted for good we keep only its id and the time of deletion, so that we can confirm it was deleted.
Your rights
Under the PDPA you have the right to:
- access your data and get a copy
- receive your data, or have it sent, in a machine-readable format
- object to processing based on legitimate interests
- have your data deleted or made anonymous
- have the use of your data restricted
- have your data corrected
- withdraw consent at any time (this does not affect what was done before)
- complain to the Personal Data Protection Committee office of Thailand
You can change profile names and settings and delete your account yourself in the app (how to delete your account). For the other rights, email privacy@yelzi.com from your account's email address. We may ask you to confirm your identity first and will answer within 30 days.
Children
You must be at least 13 to create an account, or older if the law of your country or the app store's rules require it. Children use Yelzi only through a kids profile inside a parent's account; the parent creates, manages and deletes that profile.
A kids profile shows only All-ages and 13+ series, has no ads and cannot open the account or devices pages. We ask for no personal data about a child beyond the profile name the parent chooses.
Security
Data travels over encrypted connections (HTTPS). Tokens, device ids and PINs are stored as hashes or HMACs instead of their real values. On your device the app keeps the session in the system's secure storage (Keychain or Keystore). Staff access to data is limited to their role and logged.
Contact us
Questions or requests about personal data: privacy@yelzi.com
Yelzi's data protection officer (DPO): privacy@yelzi.com
Changes to this policy
When we change this policy we update the date and version at the top, and tell you in the app or on the website if the change matters to you.