Last updated: 7 September 2026
This policy explains what personal data Baan Arun collects when you visit baanarun.com, join the community, or take a course, why we collect it, who we share it with, and the choices you have. We have written it to be read, not skimmed: it covers advertising, the AI tools we use, and your rights under Thailand’s Personal Data Protection Act (PDPA) and, where they apply, the GDPR and similar laws.
Who we are
Baan Arun is a learning community for practical AI skills, founded by John Vilaikeo and operated through IKEO Group. For the purposes of data-protection law, Baan Arun is the data controller for the personal data described in this policy. See How to contact us for ways to reach us.
What we collect and why
Account and profile
When you create an account we collect your name, email address, username, and password (stored as a one-way hash). You may add a profile photo, a short bio, links, and other optional profile fields. We use this to create and secure your account, to show you as a member of the community, and to send you the emails described below. Legal basis: performance of our agreement with you.
Community activity
Posts, comments, reactions, messages, uploads, and the spaces and courses you join are stored so the community can work. Some of this is visible to other members by design. Your course progress, lesson completions, and any feedback you leave are stored so we can track your learning and improve the courses. Legal basis: performance of our agreement with you and our legitimate interest in running and improving the community.
Founding Members feedback
Founding Members receive courses free in exchange for completing them and telling us what to improve. We keep that feedback, and your completion record, to shape future courses. We will not quote you publicly, by name or in a way that identifies you, without asking you first.
Email and updates
We send account emails you cannot opt out of (verification codes, password resets, security notices) and community notifications you control in your profile settings. If you sign up for workshop updates, we add you to a mailing list and you can unsubscribe with one click in any message. Legal basis: consent for marketing; performance of our agreement for account emails.
Technical data
Our servers and security tools record your IP address, browser type, the pages you request, and timestamps. We use this to keep the site running, to detect abuse and attacks, and to diagnose errors. Legal basis: our legitimate interest in security and reliability.
Payments
Founding Members do not pay for courses. If we later sell workshops or paid products, payment details will be handled by the payment processor we name at checkout; we do not store full card numbers on our servers.
Advertising: Google AdSense
We show advertisements served by Google AdSense on parts of this site. Google and its partners use cookies and similar technologies to serve ads based on your visits to this site and to other websites, and to measure how ads perform. In practice that means Google may collect your IP address, a device or advertising identifier, and information about the pages you view here.
- Google’s use of advertising cookies enables it and its partners to serve ads based on your visits to this and other sites. Google describes this in its advertising policy and its partner sites notice.
- You can turn off personalised advertising at Google Ads Settings, and opt out of many third-party ad networks at aboutads.info or youronlinechoices.com.
- Ads are shown on public pages. We do not sell or hand your account details or course activity to advertisers, and we do not target ads using what you post in the community.
- If you are in the European Economic Area, the United Kingdom, or Switzerland, we will ask for your consent before advertising cookies are set, as required there. Elsewhere, you can block or delete cookies in your browser at any time.
How we use artificial intelligence
Baan Arun teaches practical AI, and we use it ourselves. We want to be clear about where it touches your data.
- Making content. Course text, images, narration, and video on this site may be drafted, edited, translated, or produced with AI tools. A human reviews course material before it is published, but we do not label every AI-assisted draft.
- Running the community. We use AI assistants to help moderate, summarise activity, draft replies to questions, and give feedback on course exercises. This means posts, comments, exercise submissions, and feedback you share in the community may be processed by AI systems. A person remains responsible for decisions that affect you, such as removing content or changing your membership.
- Which providers. Some AI tools run on our own equipment; others are provided by companies such as OpenAI, Anthropic, and Google. Where a provider offers a setting that stops it from using our inputs to train its public models, we use it. We send providers only what the task needs and do not sell your data to them.
- Your own AI use. Courses ask you to try AI tools. When you paste something into a third-party AI product, that company’s privacy policy applies, not ours. Do not share passwords, financial details, or other people’s personal data in exercises.
- No automated decisions with legal effect. We do not use AI to make decisions about you that have legal or similarly significant effects without human review.
Cookies
We use cookies and similar storage for four things: keeping you signed in and remembering choices such as light or dark mode (essential); protecting the site from attacks and abuse (security); understanding which pages are used, in aggregate (performance); and advertising, as described above. Essential cookies are set when you sign in and are removed when you sign out. Advertising cookies are set by Google under the terms above. You can block or delete cookies in your browser; the site will still work, though you will need to sign in each visit.
Who we share data with
We do not sell personal data. We share it only with service providers that help us run Baan Arun, under agreements that limit what they may do with it:
- Hosting and delivery: Oracle Cloud Infrastructure (servers, located in the United States), Cloudflare (network security, content delivery, and storage for community media).
- Email: Oracle Cloud email delivery for account and community messages; our own mailing-list software for workshop updates.
- Fonts: Google Fonts, which receives your IP address when fonts load.
- Advertising: Google AdSense, as described above.
- AI providers: as described above.
- Security and operations: tools that scan for malware, back up the site, and let our team administer it. Backups may contain your data and are kept in encrypted storage.
- Legal: authorities or third parties when the law requires it, or to protect the rights and safety of members and the public.
Other members can see what you choose to post and, depending on your settings, your profile. Embedded content from other websites (for example a video player) may set its own cookies and collect data as if you had visited that site.
International transfers
Baan Arun starts in Thailand, but our servers and most of our service providers are in the United States and other countries. By using the site you understand that your personal data is transferred and stored there. We rely on contracts with our providers, and on the safeguards they offer, to protect your data to a standard consistent with the PDPA.
How long we keep data
- Account, profile, community activity, and course progress: for as long as your account exists. When you delete your account, or ask us to, we remove or anonymise it within 30 days, except where we must keep it for legal, security, or accounting reasons.
- Mailing-list subscriptions: until you unsubscribe.
- Server and security logs: up to 90 days.
- Backups: rotated on a fixed schedule; deleted data leaves backups as they expire.
Your rights
Under the PDPA, and under the GDPR and similar laws where they apply, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, or restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent where we rely on it, for example by unsubscribing from emails.
You can edit most profile information yourself in your account settings. For anything else, contact us using the details below; we answer within 30 days. You also have the right to complain to a supervisory authority. In Thailand that is the Personal Data Protection Committee (PDPC).
Security
Connections to the site are encrypted, passwords are stored as one-way hashes, access to member data is limited to the people who need it, and we keep security tools and backups in place. No system is perfectly secure; if we learn of a breach that affects your data we will tell you and the relevant authorities as the law requires.
Children
The community is for adults. You must be at least 18 to create an account. Because Thai law treats people under 20 as minors for some purposes, we may ask for a parent’s or guardian’s consent if you are 18 or 19. If we learn that a child has registered, we will remove the account.
Changes to this policy
We will update this page when our practices change and update the date at the top. For significant changes we will also notify members by email or in the community.
How to contact us
Members can reach the team in the community’s Help & Questions space. Anyone can write to us through the form on our home page, or by post via Baan Arun, c/o IKEO Group. Put “Privacy” in the subject line and we will route it to the person responsible for data protection.