Privacy policy
Revision date: 01.11.2026.
The controller under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (Thai PDPA) is PHUKET 24 ONLINE CO., LTD., operating as FreePass (“we”, “the Company”).
Tax ID: 0835561011742. Address: 96/7 Moo 7, Soi Saiyuan, Rawai, Phuket 83130, Thailand.
For data matters and rights requests, contact our manager on Telegram @RUTVR or WhatsApp +66 94 538 8352. This is our data contact; no separate Data Protection Officer has been appointed.
This policy covers the website, airport Fast Track requests, Telegram bot, Telegram Mini App, sign-in and account area, communications and trip notifications. It concerns personal data about individuals.
Booking and trip arrangements
Your name and supplied contacts: phone, WhatsApp, Telegram, email, Line or another selected channel; language; airport, arrival or departure, service, local flight date, optional flight number, passenger count and comments. We store the price calculation, booking status and related handling information, including manager notes.
Your name, at least one contact and the main trip details are needed to process a request. Please do not put health information, beliefs or other sensitive data unnecessary for the trip in comments. We do not ask for such information.
Telegram, sign-in and your account
When you use the bot, Telegram sign-in or Mini App, we process your Telegram ID, username if available, profile first and last names, language and Telegram authentication data. The bot uses temporary conversation state to guide you through booking steps.
Email sign-in involves your address, address verification and a single-use link. Session records hold a technical identifier, browser information (User-Agent), creation, last-use and expiry times. Link requests also store IP and User-Agent.
The account area brings together sign-in methods, bookings, name, contacts and notification settings. Contacts are populated from sign-in and bookings and can be edited in your profile. Explicitly attaching a sign-in method already associated with another account merges the accounts and their history.
Email, messages and technical information
We process the recipient address, service email content and delivery state: sign-in or verification links, booking receipt, booking notifications. Settings also include news; notifications for selected categories and channels depend on account settings. Emails provide an unsubscribe option. Manager communications use the channel you choose.
IP addresses are used to limit excessive requests; we store hashes rather than the addresses themselves. We also process request times, technical events and errors in logs to operate and protect the service.
- Handling bookings, calculating trip costs, contacting you, arranging airport meeting and assistance, and service notifications: steps at your request before a contract and contract performance (Section 24(3) Thai PDPA).
- Operating accounts and sign-in methods, preserving preferences, preventing spam and unauthorised access, and diagnosing faults: the Company’s legitimate interest in a functional and secure service (Section 24(5)).
- Optional visit analytics: prior consent (Section 19). Refusal does not restrict booking, sign-in or contacting a manager.
- Applicable legal requirements and legal claims: legal obligations (Section 24(6)) and legitimate interests (Section 24(5)).
You can manage notifications in your account area or in the bot, and unsubscribe from emails using the link in any email. Unsubscribing from notifications does not cancel processing of your sign-in request or booking.
Necessary cookies and preferences
- ftr_session: account session, 90 days, renewed when an active session is refreshed. It uses HttpOnly and SameSite=Lax, with Secure in production. Signing out removes the cookie and server session.
- ftr_locale and ftr_theme: selected language and theme, up to one year. The theme may also be saved in Telegram CloudStorage.
- ftr_cookie_consent, when the cookie-consent mechanism is enabled, saves analytics permission or refusal for one year. It stores your choice rather than tracking behaviour.
Booking draft
To restore a booking, the browser uses localStorage (ftr:draft:v1) and, in Telegram where available, CloudStorage (ftr_draft_v1). Drafts can include contacts, flight and service details. No automatic draft expiry is set. You can remove local data through your browser; CloudStorage is separate Telegram storage and is not necessarily cleared by clearing the browser.
Optional analytics
When analytics modules are enabled, their scripts and cookies load only after permission, including in the Mini App. You can change your choice through “Cookie settings” in the footer when that mechanism is available. Withdrawing permission reloads the page and stops further analytics processing. Withdrawal does not affect earlier lawful processing or automatically guarantee deletion of previously collected data.
Google Analytics 4 and Yandex Metrica
When enabled and with your consent, these services may receive visit and page-view information, URLs, traffic sources, event times, cookie identifiers, IP addresses, approximate location, browser and device information. These are pseudonymous rather than guaranteed anonymous data. Booking details and contacts are not intended for transmission to analytics.
Metrica is connected without Webvisor or click maps. A disabled service does not load. Analytics retention depends on the relevant account settings and provider rules.
Google reCAPTCHA v3
When enabled, reCAPTCHA v3 protects booking submission and email sign-in link requests. This is strictly necessary protection against automated requests and does not depend on analytics consent. Google may process IP addresses, browser and device parameters, interaction signals and the _GRECAPTCHA cookie; a token is used to verify the request.
The check protects form submission and sign-in; it does not decide trip eligibility or entry into a country. If this protection blocks your request, reach the manager through our contacts.
Access as needed is available to FreePass staff and managers handling requests, airport staff who arrange your meeting, to the extent needed for it; technical providers including hosting and network infrastructure; the SMTP email delivery provider; Telegram for the bot, sign-in, Mini App and CloudStorage; Google for enabled reCAPTCHA; and Google and Yandex for enabled analytics with consent. Messengers and other communication channels you choose process messages under their own rules.
Disclosure to authorities or other recipients may be required by applicable law. Providers acting on our instructions must use data for agreed purposes and apply appropriate safeguards. We do not sell personal data.
Google, Yandex, Telegram, email and infrastructure providers may process data outside Thailand. An appropriate transfer mechanism must be identified under Sections 28 and 29 Thai PDPA: adequate protection, contractual or other appropriate safeguards, or an applicable lawful exception.
If a particular transfer requires consent because protection in the destination country is insufficient, we will request separate informed consent after explaining the risks. This policy does not itself constitute that consent.
Automatic periods in the service
- Sign-in or email-linking links are valid for 15 minutes; links in booking receipt emails for 72 hours. These are validity periods, not a promise of immediate record deletion.
- Account sessions last 90 days, renewed on use. Expired links and sessions are deleted automatically about one day after they expire.
- Email and IP counters for link requests expire after one hour; Telegram sign-in exchange counters after 60 seconds. Telegram Login replay-protection records last 10 minutes and expired records are cleared during subsequent checks.
- The temporary state of a bot conversation is kept for 24 hours. This is not the retention period for accounts or bookings.
- Booking submission replay records last 24 hours; expired records are cleared when bookings are created.
- Service-delivery data is retained for processing and retries. Completed tasks are cleared under queue rules; this is not the recipient mailbox retention period.
- Cancelled and completed bookings are not automatically deleted by the daily task. You may request deletion through the manager, subject to applicable retention obligations.
- Application log files rotate with a five-day retention setting. This does not determine retention for all infrastructure logs or backups.
Other data
No single automatic deletion period is defined in code for accounts, profiles, completed bookings, related correspondence, backups or infrastructure logs. Data is retained while needed for the stated purposes, obligations or legal claims; when no longer needed, it is subject to deletion, destruction or irreversible anonymisation unless further retention is required by law. Mandatory accounting records are retained for the applicable statutory periods. Cookies and drafts are covered in section 5; analytics in section 6.
Subject to Thai PDPA conditions, you may withdraw consent, request access and copies, information about data sources, portability, correction, deletion or anonymisation, restriction, object to processing, and complain to Thailand’s Office of the Personal Data Protection Commission (PDPC).
Write to the manager on Telegram @RUTVR with your request and information allowing us to find your account or booking. Reasonable identity or authority verification may be needed to protect data. Access or copy requests are handled without undue delay and, unless there is a lawful ground for refusal, within 30 days of receiving a complete request. Rights may be limited by law or the rights of others.
We use Telegram authentication checks, single-use links, session validation and booking access controls. These measures reduce the risk of unauthorised access; absolute security is not guaranteed. Thai PDPA notification obligations apply to incidents.
An adult submits a family request. Children’s ages are not required; please share no more information about a child than the trip needs. We do not rely on a child’s independent consent where parental or legal representative involvement is required. Contact @RUTVR about children’s data.
Flight search
Flight search uses Travelpayouts/Aviasales and ticket providers. Search parameters and technical information needed for a query are processed when you use search. A seller’s own rules apply after following its link. A Fast Track request and flight purchase are separate actions; booking contacts are not intended for flight search.
External maps, websites and messengers follow their owners’ rules. This policy is updated when the service or processing changes; the current dated revision is published here. Any required new consent is requested separately.
Send questions and requests to the manager on Telegram @RUTVR. You may also contact PDPC through its official services.
FAQ
Message our manager on Telegram @RUTVR or WhatsApp +66 94 538 8352. Describe your request and include details that help us find your account or booking; we may need to verify your identity.
Talk now
Message our manager in your preferred channel — we will help with airport services and booking.