Controller and processor roles
The provider is controller for user accounts, security, billing and direct service administration. For customer documents or data an organization submits for processing under its instructions, the organization is generally controller and the provider is processor. The operating entity and registered address remain to be confirmed before this policy takes effect.
Data categories and sources
Data may include identity and contact details; account and device data; organization context and permissions; accounting, tax, payroll, slip and counterparty records; LINE messages and files; tokenized payment and card-last-four details; request records, security events and technical data. Data comes from you, an authorizing organization, connected channels and providers needed for selected features.
Purposes and legal bases
We use data to deliver the service and follow instructions; authenticate and scope access; prevent fraud; receive and deliver documents; process payments; resolve issues; preserve auditability; perform contracts and legal duties; and improve reliability. Depending on context, the basis may be contract, legal obligation, legitimate interests or consent. Without required data, some features cannot operate.
Documents, images, OCR and classification
Images and documents may be read through configurable OCR and may be sent to a slip-verification or AI provider enabled by the organization. Results are work aids and require human review before filing, payment or evidence use. If a user submits the wrong file, the service should support cancellation, correction, replacement evidence or review without silently rewriting completed history.
Recipients and subprocessors
Necessary data may be disclosed to infrastructure and file-storage providers, email, LINE, Omise or Opn, slip-verification, enabled OCR or AI services, and authorities where legally required. We do not sell personal data. The final list, locations and subprocessor-change notice terms must be confirmed before this policy takes effect.
International transfers
Messaging, email, infrastructure or AI providers may process data outside Thailand. Live use must minimize the data transferred, assess the country and recipient, and apply legally supported contracts or safeguards. Destination details must follow each environment's actual configuration rather than a blanket assumption.
Retention and deletion
Data is retained for service, contract, dispute and applicable accounting or tax requirements. Data outside a retention duty should be deleted or de-identified under a published schedule. A deletion request may be limited for records the law requires us or the controller to retain, with the reason and available correction or objection route explained.
Security and personal data breaches
Controls include authentication, purpose-based permissions, organization scope, encryption, activity records, provider-secret boundaries and processes to detect, contain and investigate incidents. Where legal thresholds are met, we coordinate with the controller and notify the authority or affected people as required.
Rights and request correction
Subject to law, you may request access, a copy, correction, portability, deletion, restriction, objection, consent withdrawal or make a complaint. We may verify identity and refer a request to the organization that controls the data. If evidence is incomplete, you should be able to add or correct it without restarting; immutable evidence uses an auditable correction or replacement.
Cookies and device settings
The website uses cookies required for sessions, security, request-forgery protection, language and accessibility preferences. On a device, it uses localStorage for a remembered sign-in email and sessionStorage for an in-progress accounting action or an in-tab privacy-mask preference. Invitation credentials remain only in the memory of the page opened from the invitation link and are not written to browser storage or caches. The remembered email is cleared only after successful sign-out or when it is no longer selected at a later sign-in; session entries end when the tab closes and the relevant flow may clear them after a successful operation or completion, after an invalid read, or when the privacy mask is turned off. The desktop app keeps a redacted portal activity audit in the device's application data. It is not currently uploaded to the platform, is not cleared on sign-out, and rotates at 1 MiB per file with the latest four archives plus the active file retained. Non-essential or marketing analytics require consent before activation and must support withdrawal. This page does not claim that advertising trackers are currently in use. Purchase recovery also keeps the exact request and order/payment references in this tab, partitioned by user, acting context and firm. References older than one day are recovery-only and are not silently removed while their outcome is unknown. A resolved result can be cleared explicitly; closing the tab removes its stored references. Card tokens and provider payment payloads are not stored in this recovery record.
Changes and contact
When controller details, providers, retention or purposes change, we will revise the version and review date and communicate material changes through an appropriate channel. A verified rights-request and complaint channel must be displayed here before launch.