Privacy Policy

NetPan is a tool for tracking your own dividend-stock and fund portfolio. This policy explains what we collect, what we use it for, and how you control your data, in line with Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

What we collect

• Account data: email, display name, a one-way hashed password, and your two-factor secret.
• Portfolio data: the stocks and funds you record, quantities, cost basis, trades, dividends received, and the targets you set.
• Broker connection data: the API key you enter yourself. It is stored separately and used only to fetch your portfolio and order fills. We never store the PIN used to place orders — you enter it every time.
• Usage data: sign-in times, IP address and device type, for account security.
• If you sign in with Google: we receive only your email, name and user ID from Google. We have no access to your mail, files or calendar.

What we use it for

• Calculating your portfolio value, dividends, tax credit and buy plan.
• Verifying your identity and preventing unauthorised access to your account.
• Improving data accuracy and developing the service, using aggregated data that cannot identify you.

We do not sell your data, and we do not share portfolio data with third parties for marketing.

Who can see your data

• You.
• Only the family members you have chosen to share with — and you can withdraw that at any time.
• The administrator, only when needed to resolve an issue you have reported. Every access is logged, and you can read that log yourself on the “Account & family” page.

Storage and security

• Data is stored on a server in Singapore, with all connections over HTTPS.
• Passwords are stored as one-way hashes; broker keys are stored separately from portfolio data.
• Automatic backups protect against data loss.
• Two-factor authentication is required for password sign-in.

Your rights

• Request access, a copy, correction or deletion of your data.
• Withdraw consent and close your account at any time, using the “Delete account and all data” button on the account page — account and portfolio data are removed immediately on confirmation, and backup copies are overwritten within 30 days.
• Download a copy of all your own data yourself, using the “Request a copy of all data” button on the same page.
• Lodge a complaint with Thailand's Personal Data Protection Committee if you believe we have acted improperly.

For personal-data enquiries, contact [email protected]