Privacy Policy

The KhaiKhlong system operator, operated by an individual (“Operator”), is the data controller for user accounts, the website, subscriptions, billing, security, and support data.

For customer, recipient, employee, and other personal data uploaded or connected by a merchant, the merchant is the data controller and the Operator acts as data processor on the merchant’s instructions, unless law requires otherwise.

Account and usage data may include names, email addresses, profile images, phone numbers, stores, memberships, roles, permissions, subscriptions, transactions, security logs, device and IP information, consent evidence, and product, order, inventory, shipping, customer, and business data authorized by the merchant.

Where a merchant connects a messaging integration, the Services may also process chat messages and related content from Facebook and Instagram (such as message text, sender name, and timestamps) and customer details entered by the merchant (such as name, phone number, and address) for the purpose of creating and managing orders.

Data may come directly from users, authorized members, Clerk, social login providers such as Google, LINE, or Microsoft, payment providers, and technical events generated through use of the Services. Where a merchant authorizes a connection, data may also be obtained through the Meta Platforms APIs (Facebook and Instagram); such data is collected and processed on behalf of the merchant, who remains the data controller.

Data is processed to create and maintain accounts, provide tenant-isolated SaaS services, perform contracts, bill users, secure the Services, prevent fraud, provide support, comply with law, resolve disputes, and improve reliability. Lawful bases include contract, legal obligation, legitimate interests, and consent. Marketing consent may be withdrawn at any time.

The Services use essential cookies for sign-in, sessions, CSRF protection, security, language, preferences, and operation, and may use performance or visitor analytics where legally permitted or consented to. Users may restrict cookies in their browser, but disabling essential cookies may prevent sign-in or feature use. Personal data is not sold through cookies.

Clerk provides registration, sign-in, sessions, email verification, multi-factor authentication, and account recovery. Google, LINE, and Microsoft process data under their own policies and return necessary identity data to Clerk and KhaiKhlong.

The Services currently support selected integrations only. Where offered, a merchant may connect Facebook and Instagram (Meta Platforms) to receive messages and turn conversations into orders. Connecting an integration requires the user’s explicit authorization, and data exchanged through it is processed in accordance with the relevant platform’s policies in addition to this Policy.

Features and integrations may change, be added, limited, or removed over time. A merchant may disconnect an integration at any time, after which the Services stop receiving new data from it; data already collected is retained and deleted in line with the retention section below.

Data is disclosed only as necessary to authentication, hosting, database, email, analytics, payment, support, authorized third-party, and professional service providers, and lawful authorities. The Operator does not sell personal data and requires appropriate confidentiality, security, and purpose limitations from processors.

Clerk, social login providers, and infrastructure providers may process data outside Thailand. The Operator uses safeguards required by law, including contractual protections, security standards, and recipient assessments where applicable.

Data is retained while accounts are active and for periods required for service delivery, backups, audits, disputes, fraud prevention, and legal obligations. Consent and transaction evidence may be retained to establish legal rights. Data is then deleted, destroyed, or anonymized through appropriate processes.

Risk-based measures include tenant isolation, server-side authorization, encryption in transit, Secure and HttpOnly cookies, rate limits, input validation, webhook signatures, least privilege, and audit trails. No system is completely secure, and users must also protect their accounts and devices.

Merchants represent that they have the lawful basis, notices, consents, and rights necessary for submitted data and remain responsible for accuracy, retention, data-subject requests, and processing instructions. To the maximum extent permitted by law, the Operator is not liable for unlawful instructions or data submitted without legal authority.

Subject to legal conditions and exceptions, individuals may request access, copies, correction, portability, deletion, restriction, objection, consent withdrawal, and complaint handling by contacting [email protected]. Merchants may also disconnect a connected integration and request deletion of data collected through it. Identity verification may be required.

Controller: KhaiKhlong (ผู้ให้บริการระบบ)
Address: 1022/115 ซอยประชาอุทิศ 28 แขวงบางมด เขตทุ่งครุ กรุงเทพมหานคร 10140 ประเทศไทย
Privacy: [email protected]
Support: [email protected]

Individuals may also complain to Thailand’s Personal Data Protection Committee through its official channels.

The Operator may transfer rights, obligations, Services, and related data to a legal entity established in the future, a successor, or a business transferee, provided the recipient remains subject to applicable data-protection obligations and User rights are not reduced. Material policy changes will carry a new version and effective date and may require renewed acknowledgement.