Privacy Policy

Last updated: 9 November 2026

ThvnderLab ("we", "us") is operated by BCX RESOURCES (202603004980), Kuala Lumpur, Malaysia. This policy explains what personal data we collect when you use thvnderlab.website, how we use it, who we share it with and how we protect it, in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

1. Information we collect

• Account details: your email address and password (stored only in encrypted, hashed form).
• Profile and link page details: username, display name, bio and the social media links you choose to add.
• Content you add: product names, prices, affiliate links, image links and product notes.
• Content we generate for you: captions, scripts, prompts and stories, saved in your History.
• Payment records: which Bolt pack you bought, the amount and the date. Card and banking details are entered directly with Stripe; we never see or store them.
• Technical data: login cookies needed to keep you signed in, and basic server logs (such as IP address and browser type) used for security and fixing errors.

2. How we use it

• To create and run your account and keep you logged in.
• To generate content from the product details you provide.
• To process Bolt purchases, keep your Bolt balance and send receipts.
• To show your public link page, if you create one.
• To answer support requests, prevent abuse and fraud, and keep the service secure.

We do not sell your personal data and we do not use it for third-party advertising.

3. Who we share it with

We share data only with service providers that we need to run ThvnderLab, and only for that purpose:

• Supabase — account login and database hosting.
• Vercel — website hosting.
• Anthropic (Claude API) — the product details and options you submit are sent to generate your content.
• fal.ai — when you create an image or video, the scene description and your product photo are sent to generate it. Generated files are stored with Supabase.
• Stripe — payment processing. Stripe handles your payment details under its own privacy policy.

These providers may store data on servers outside Malaysia. We may also disclose information where required by law or to protect our rights and users.

4. Public information

If you set a username, your link page (thvnderlab.website/your-username) is public. It shows your display name, bio, social links and the products you mark "Show on my link page". Your email address and Bolt balance are never shown.

5. How we protect it

• All connections use HTTPS encryption.
• Passwords are hashed; we cannot read them.
• Database access rules make sure each user can only read and change their own data.
• Secret keys are stored on the server only and never sent to your browser.

6. How long we keep it

We keep your data while your account is active. If you ask us to delete your account, we delete your profile, products and history. We may keep payment records as long as required for tax and accounting purposes.

7. Your rights

You may ask to access, correct or delete your personal data, or withdraw consent, by emailing support@thvnderlab.website. We reply within 21 days.

8. Changes

We may update this policy. The date at the top shows the latest version. Important changes will be shown on the site.

9. Contact

BCX RESOURCES (202603004980), Kuala Lumpur, Malaysia. Email: support@thvnderlab.website