Privacy Policy

T&P AITECH CO., LTD. is the data controller for your account, payment and usage data. Contact details are under "Contact us" at the end of this policy.

For personal data contained in the documents you send for reading (for example your customers' ID cards), you are the data controller and we act as your data processor, processing it only on your instructions. See section 3.

• Account data: your email address. If you sign in with Google we also receive the name, profile picture and Google account ID that Google shares.
• Billing details (if you provide them): buyer type, person or company name, tax ID, branch, address and the email for receiving documents.
• Payment data: Stripe collects card or PromptPay details directly; we never see or store card numbers. We keep the payment reference, pack, amount, VAT, document number and refund history.
• Usage data: time of each request, channel (API, Playground or demo), mode and template, page count, credits used, success or error code, processing time, and model token counts and cost.
• Contact form messages: the topic, your name, email, company and phone number (if given) and the message.
• API keys: only a hash, the key prefix, the name you give it and when it was last used. We cannot recover the full key.
• Security data: IP addresses only as salted hashes (we do not store raw IP addresses in our database), used for the free-demo limit and rate limiting, plus events such as attempts with an invalid API key.
• Cookies: strictly necessary cookies only, a language cookie (NEXT_LOCALE, one year) and the sign-in session cookies. We use no advertising cookies or third-party behavioural analytics.

• Files are processed in memory and are not saved to our database or file storage.
• To read a document we send the file to an AI model provider through OpenRouter and return the result to you. These providers process the data under their own terms of service.
• Exception: when you call the API with an Idempotency-Key header we keep the result (not the file) for 24 hours so we can replay it if you repeat the same request, then delete it.
• We do not use your documents or results to train models.
• If a document contains other people's personal data, you must have a lawful basis to process it and obtain explicit consent where the law requires it, for example for sensitive data such as religion or health information that may appear in a document.

• Performance of our contract with you: creating and maintaining your account, reading documents, charging and refunding credits, taking payments, answering messages you send through the contact form, and sending service emails: payment confirmations and a notice when your credits run low (you can turn the credit notice off on the billing page of the dashboard).
• Legal obligations: issuing and keeping receipts or tax invoices and accounting records under Thai tax and accounting law.
• Legitimate interests: keeping the service secure, preventing abuse and fraud, investigating problems and improving the quality and cost of the service.
• We do not send you marketing without your consent, and we do not sell personal data.

We use the following providers to run the service and share only what each needs:

• Supabase: database and authentication (data centre in Singapore)
• Vercel: hosting for the website and API (processing in Singapore)
• OpenRouter and the model providers it routes to, such as Google: document reading
• Stripe: payments and refunds
• Resend: sending payment confirmations and credit notices, and forwarding contact form messages to our team
• Google: when you choose to sign in with Google

We may also disclose data where required by law or by an order of a competent authority or court.

The providers above are located in, or process data in, countries outside Thailand such as Singapore and the United States. We use providers with contractual data protection commitments and appropriate security standards, and transfer data as needed to perform our contract with you, in line with sections 28 and 29 of the PDPA.

• Account data and API keys: for as long as you have an account, deleted when you ask us to delete it.
• Usage logs: 90 days, then deleted automatically.
• Security events: 90 days, then deleted automatically.
• Hashed-IP demo counters: 7 days; rate-limit counters: 1 hour; Idempotency-Key results: 24 hours.
• Purchases, receipts or tax invoices and the related credit records: for the period required by Thai tax and accounting law (generally at least 5 years), even after you delete your account.
• Contact form messages: 1 year, then deleted automatically (the copy emailed to our team is kept as long as needed to follow up).
• System logs at our hosting provider (no document content): according to the provider's retention period.

Data is transmitted over HTTPS, API keys are stored as hashes, the database only lets each user read their own records, admin access requires two-factor authentication and every admin change is logged. If a personal data breach occurs we will notify the Personal Data Protection Committee office and affected people as the law requires.

Under the PDPA you have the right to:

• access and obtain a copy of your personal data
• have it corrected and kept up to date (you can edit billing details yourself in the dashboard)
• have it deleted, destroyed or anonymised
• restrict or object to its processing
• receive it or have it sent to another controller
• withdraw consent where we rely on consent
• complain to the Office of the Personal Data Protection Committee

Send requests through the channels under "Contact us". We respond within 30 days of receiving a request. Some rights are limited by law, for example tax records we must keep.

The service is intended for businesses and adults. We do not knowingly collect data from minors through account sign-up.

We may update this policy from time to time and show the latest effective date at the top. For material changes we will notify you by email or on the website before they take effect.

T&P AITECH CO., LTD.Contact form: https://tnpaitech.com/en/contactEmail: support@tnpaitech.com