Privacy notice

Version 2026-08-11.1

This notice describes what CLMV Holding Co., Ltd. actually collects through the CLMV Holdings and Mountain Durian websites, why, and who else handles it. It describes the sites as they are built today. Where a decision has not been made, this notice says so rather than guessing.

What we collect

Mountain Durian participation request: Your name, email address, country, an optional telephone number, the number of trees you selected, an optional message, and which acknowledgements you ticked. Passport, government identification, bank details, card details, tax identification and source-of-funds information are never requested, and the code refuses to store a field that looks like any of them.
CLMV Holdings project-interest registration: Your email address, and — only if you choose to fill them in — your name, country, how you describe your relationship to the project, and a message.
Account and sign-in: If you open an account, your email address and, if you choose to set one, a password. The password is handled entirely by our authentication provider; this application stores no password, no password hash and no password-derived value of any kind.
Abuse prevention: To limit automated submissions we record a one-way salted digest of the requesting network address or email address together with a request count. The digest cannot be reversed back to the address it was derived from, and no readable address is stored for this purpose.
Administrator sign-in attempts: Attempts to sign in to the operations area are recorded as a one-way digest of the address entered, a masked form of it for reading, and whether the attempt was permitted. No password, link, code or token is recorded.
Referral codes: If you arrive through a referral link, the referral code itself may be recorded against a request. The referral record deliberately stores no name, email address, network address or device information about the visitor who followed the link, and no cross-session referral cookie is written on the current site.
Your browser's own storage: Your sign-in session, your language choice, and an in-progress participation request are kept in your browser's local storage so that a reload does not lose them. They stay on your device and are cleared when you sign out or clear site data.
Server and delivery logs: Our hosting provider records ordinary web-server request logs, which include network addresses, in order to serve and protect the sites. We do not build profiles from them.

Analytics

Analytics: No analytics or advertising product runs on this deployment. Nothing tracks you across sites, and no advertising identifier is set.

Who else handles it

Vercel — hosting and content delivery: Serves both websites. Handles every request and keeps ordinary server logs.
Supabase — database and authentication: Stores participation requests, project-interest registrations, accounts and the operational records behind them, and runs the sign-in system.
Resend — email delivery: Used to send transactional email, such as a sign-in link or an acknowledgement that a request was received. It receives the recipient address and the message.
Payment providers — not currently active: Integrations for Stripe, PayPal and Opn exist in the software but participation payment is switched off, so no payment provider is contacted and no payment details are collected anywhere on these sites.

Asking about your information

To ask what is held about you, to correct it, or to ask for it to be deleted, email clmvonline@gmail.com. We will respond, but no response-time commitment has been set for these sites and none is claimed here.

Operator: CLMV Holding Co., Ltd.
Email: clmvonline@gmail.com
Telephone: +66 88 895 6949
Operating from: Bangkok, Thailand

Still being finalized

The points below have not been settled, and this notice does not guess at them. They will be added once they are approved. Until then, the description above of what is collected and who handles it is complete and accurate.

How long each category of information is kept before deletion.
The legal basis relied on for each purpose, and which data-protection regimes these sites are being operated under.
The registered corporate address and company registration number of the operating entity.
A named data-protection contact or representative.
Whether and how information is transferred outside the country it was collected in, and under what safeguard.
Which supervisory authority a complaint should be directed to.