Privacy Policy

Effective date: September 11, 2026

VapeExperts is responsible for how this website handles your personal data. We are based in Bangkok, Thailand. Our contact details are below and in our imprint. You can read our reviews, guides and news without creating an account or submitting personal information.

Hosting and Request Logs

Vercel hosts the site and delivers pages through its global edge network. Serving a request involves processing your IP address and request information. Hosting and security logs may contain information about requests, errors and network activity. We use this information to operate the site, investigate problems and prevent abuse. Log retention depends on the hosting service and its configured settings.

Vercel supplies a visitor-country header derived from your connection. Our application uses that header only to detect a shopping market, including choosing the appropriate retailer destination. We do not request access to your browser's precise location.

Functional Cookies and Browser Storage

We remember preferences in your browser so prices and retailer links match your market. These settings are functional; they are not advertising or tracking identifiers.

• When you choose a market, we save its country code in the vpx-market cookie and a localStorage entry with the same name. The cookie lasts for one year from your choice. The localStorage entry has no automatic expiry.
• When we automatically detect a supported market, we cache its code and a timestamp in vpx-market-geo in localStorage. We reuse that detection for 24 hours. An expired entry may remain in browser storage until replaced or cleared. Automatic detection does not set a market cookie.
• Search can remember up to six recent searches in vpx-recent-searches in localStorage. This list stays in your browser, has no automatic expiry and is replaced as you make new searches. We do not send your search text to our analytics service.

You can change your market using the site's market selector, or remove these settings by clearing this site's cookies and localStorage in your browser. Blocking browser storage may prevent us from remembering your preferences.

Analytics

We use Plausible Analytics through a proxy on this site to understand aggregate usage, such as page views, referral sources, market selections and retailer clicks. Our custom events include product and market information, review ratings and search result counts. They do not include review names, comments, email addresses or search text. Analytics is disabled on staff administration pages.

Plausible uses no analytics cookies or browser storage. According to its data policy, it provides aggregated statistics without storing personal data that identifies visitors. It processes IP addresses and browser information to calculate daily counts, then discards the raw values. It does not use persistent identifiers to follow you across websites or days.

Affiliate Links

Links to retailers pass through our /go redirect. We may receive a commission if you buy through an affiliate link. We do not set a tracking cookie when you use these links. The c query parameter on our redirect carries only a shopping-market country code, not a visitor identifier. We measure retailer clicks in aggregate through Plausible as described above.

The retailer or its affiliate provider may use its own cookies or other attribution methods after you leave our site. Its privacy policy applies to that processing and to any purchase you make. Read more in our about page.

Reviews, Questions and Votes

If you post a review or question, you provide a display name, your text and whether you own the vaporizer. Owners also provide a rating and may select how long they have owned it. We store the submission, its date, an identifier, votes and any team reply in Upstash Redis. Your name, text, ownership information, rating, date and vote total are public. No email address or public account is required. Please avoid including contact details or sensitive personal information in your name or text.

We store a salted hash of the submitting IP address with each review or question to limit repeat submissions. We also store salted hashes for votes to prevent repeat voting. These hashes are not shown publicly. They are pseudonymous data, not a promise of complete anonymity.

The rate limiter that caps review submissions and votes is keyed by the same salted hash, so that limiter writes no raw IP address; its records expire within about two hours. The reviews, questions, replies and associated hashes have no automatic expiry and remain stored until removed. You can contact us to request correction or removal of your contribution.

Contact and Staff Accounts

If you email us, we receive your email address and whatever information you include. We use this correspondence to handle your enquiry and related follow-up. Do not send information that is unnecessary for your request. Our contact page explains how to reach our team.

Accounts are for authorised staff only. We do not offer public registration. Staff authentication uses better-auth with a Turso database for account information and Upstash Redis for session storage. Staff sign-in uses functional authentication cookies. Sessions are configured to expire after seven days and may be renewed through use; cached session information in the browser cookie lasts five minutes. A staff session record in Upstash contains the signed-in person's IP address and browser identifier for the life of the session, sign-in rate-limit records are keyed by IP address and expire within a minute, editorial rate-limit records are keyed by the staff email address, and an editorial activity log keyed by staff email address is kept in Upstash. Account records have no automatic deletion period configured by this site.

No Advertising, Newsletter or Data Sales

We do not run advertising or personalise ads, and we do not sell personal data. We do not currently operate a newsletter or collect newsletter subscriptions. The subscription form is kept hidden until a mailing provider is available.

Legal Bases Under the GDPR

Where the GDPR applies, we rely on legitimate interests (Article 6(1)(f)) to keep the site available and secure, prevent submission and voting abuse, respond to enquiries and understand aggregate site usage. These interests must be balanced against your rights. For analytics, this basis applies to any processing of personal data involved before the statistics are aggregated.

Processing needed to provide the review or question service you request, including publishing your contribution, is based on providing that service (performance of a contract, Article 6(1)(b)). Where we ask for and rely on consent for a separate purpose, you can withdraw it at any time. Simply browsing this site is not consent to unrelated uses of your data.

Service Providers and International Transfers

Vercel, Plausible, Upstash and Turso process information for the functions described above. For our team only, Telegram (editorial notifications that name the staff member) and GitHub (publishing, where commits carry the staff author) also process staff identity; neither receives visitor data. Our hosting uses regions in the United States, the European Union, the United Kingdom and Asia. The Turso staff-account database is in Tokyo, Japan. Plausible states that its analytics processing and storage take place in the European Union. Our team operates in Thailand.

Your information may therefore be processed outside your country, including outside the European Economic Area. Where the GDPR applies, these transfers require an applicable legal transfer mechanism. Contact us for information about the locations and safeguards relevant to your data.

Your Data Protection Rights

Where the GDPR applies, you can request access to your personal data, correction, erasure or restriction of processing. You can object to processing based on legitimate interests for reasons relating to your situation. Where the conditions apply, you can receive data you provided in a portable format when processing is automated and based on consent or contract. You can withdraw consent without affecting the lawfulness of processing before withdrawal.

Email hello@vapeexperts.com to exercise these rights. For a review or question, include the page URL, display name and approximate submission date so we can locate it. We may need information to verify that the request relates to you. The GDPR generally requires a response within one month, with an extension allowed in some cases. You may also complain to your local data protection authority. The European Commission explains these rights.

Children

This site is intended for adults aged 18 and over. Please do not submit personal information if you are under 18. If you believe a child has submitted personal data, contact us so we can investigate and remove it where appropriate.

Changes to This Policy

We may update this policy. The current version is always available at vapeexperts.com/privacy-policy.

Contact Us

Email us at hello@vapeexperts.com or write to: