Privacy policy

Legal basis

This policy is written in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA), to explain how we collect, use and protect your personal data when you contact a shop that uses our service.

What we collect

• Conversations — the messages customers send and the replies the shop (or the system) sends back, including images and files attached to the conversation.
• Contact details from the platform — the platform's user ID, display name and profile picture, as far as that platform provides them alongside the message.
• The shop's own notes — the name and notes a shop's staff record about that customer themselves.
• Shop account details — the name, email address and permissions of the staff who sign in.
• Technical records — when the system was called and any errors that occurred, so we can fix problems and review security.

We do not store passwords for platform accounts, and we do not store the payment card details of a shop's customers.

What we use it for

• Showing conversations to the staff of the shop that owns that channel, so they can read and reply.
• Generating automatic replies from the knowledge base the shop sets up itself.
• Sending replies back to the customer through the same channel they wrote in on.
• Keeping the service secure, preventing misuse, and fixing faults.

We do not sell your data, we do not use your conversations for advertising, and we do not use them to train any AI model of our own. For the language-model provider we send messages to for processing, we choose one whose terms cover not training on customer data.

Roles under the law

In this relationship, the shop using our service is the Data Controller for its conversations with its own customers — it decides how that customer data is collected and used. Wasu AI acts as the Data Processor, processing data only on the shop's instructions.

Sensitive personal data

Some conversations may contain sensitive personal data, such as health information a customer sends to a shop (for example, a clinic). We process this only as far as needed to pass it to the shop for a reply, and for no other purpose. Obtaining explicit consent for sensitive data is the shop's responsibility as the Data Controller, as required by law.

Who we share it with

• The shop you messaged — your conversation is visible to that shop's staff, and to the Wasu AI team to the extent needed to operate and troubleshoot the service. Each shop's data is kept separate; one shop cannot see another shop's conversations.
• Our language model provider (DeepSeek) — message content is sent for processing so a reply can be generated, limited to what is needed to answer that question.
• The originating chat platforms (Meta, LINE) — so we can send replies back to you, under those platforms' own terms.
• Our infrastructure providers — the server and database services we use to run the system.

Beyond this, we disclose data only when required to by law.

International data transfers

The servers we use to host the service are located outside Thailand, and the language-model provider we use to process messages (DeepSeek) is also based abroad. Your data is therefore sent to and stored outside Thailand. We disclose this before you use the service, use providers with data security measures in place, and send only what is needed to run the service.

How long we keep it

We keep conversations for as long as necessary for the purposes above and for as long as the shop continues to use the service, so staff can look back over their history with a customer. When a shop cancels, we delete that shop's data within 90 days, except for anything the law requires us to keep for longer. System audit logs are automatically deleted once they are older than 365 days.

Your rights, and asking us to delete your data

You have the right to see, correct or delete the personal data we hold about you.

• If you are a customer who wrote to a shop — contact that shop directly, as the shop controls its own conversation data. You may also write to us at the address below and we will pass it on.
• If you are a shop using the service — write to the email below to export or delete all of your shop's data.
• Facebook and Instagram users — you can withdraw the permissions the app was given at any time in your own account settings, and request deletion on our data deletion page.

We will respond to any request within 30 days.

Security

All data is sent over encrypted HTTPS. The access tokens for the chat channels a shop connects are encrypted before being written to the database, and access to a shop's data is limited to that shop's own staff accounts.

Data breach notification

If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify Thailand's Personal Data Protection Committee without undue delay as required by law, and where the risk to you is high, we will notify the affected shop without delay so it can inform its own customers.

Changes to this policy

If we change this policy we will update the date above and give the shops using the service reasonable notice.

Contact us

For questions or requests about personal data, write to contact@wasuai.app