1. Who we are and scope

The app is operated by NAYA PEOPLE CO., LTD. (บริษัท นายา พีเพิล จำกัด), company registration no. 0105569083102, head office 231 Moo 1, Nong Bua Subdistrict, Ban Khai District, Rayong 21120, Thailand.

For data about the administrators of Pages or accounts connected to our services (our customers), Naya People is the data controller. For messages and data of people who message a customer's Page, the customer is the data controller and Naya People acts as a data processor on the customer's instructions.

2. Data we receive from Meta

We request only the permissions needed for the features you turn on, and receive only the data you approve on Facebook's permission screen. This may include:

• Public profile — name, profile picture and app-scoped user ID, plus email address if you allow it
• The Pages and accounts you choose to connect — Page name and ID, the linked Instagram business account, and the access token used to act on the Page's behalf
• Messenger and Instagram Direct messages sent to a connected Page or account, including the sender's page-scoped ID (PSID/IGSID), name, profile picture and any attachments they send
• Technical connection data — when the connection was made, the permissions granted, and API call logs kept for security and troubleshooting

We never receive your Facebook password and we do not access messages in your personal account.

3. How we use the data

• Authenticate you and let you log in to our services with Facebook
• Connect your Page or Instagram account to our products (such as KuiKeng) to receive and reply to customer messages on the business's behalf, show product information, and take orders or bookings in the chat
• Show conversation history in the back office so the business's staff can review it and take over
• Keep the service secure, prevent abuse and fix technical problems
• Comply with the law and with Meta's terms

4. What we never do with Meta data

• We do not sell, rent or license the data to anyone
• We do not use it for advertising or to build advertising profiles, and do not pass it to data brokers or ad networks
• We do not use one business's customer messages to serve another business; each customer's data is isolated at the database level
• We do not use the data beyond the purposes in this policy, and we comply with the Meta Platform Terms and Developer Policies

5. Disclosure and sharing

We share data only:

• With the business or organisation whose Page you messaged — so it can reply to and serve you
• With sub-processors working under contract and on our instructions, such as the cloud provider hosting the system and the AI model provider used to generate replies, who may not use the data for their own purposes
• With authorities or other parties where the law requires it

6. Legal basis (PDPA)

We process data under Thailand's Personal Data Protection Act B.E. 2562 (2019) on the basis of performing our contract with the customer, our legitimate interest in providing and securing the service, the consent you give on Facebook's permission screen, and legal obligations.

7. Data retention

We keep the data for as long as the Page or account stays connected and the customer account is active. When a connection or subscription ends, we delete the access token immediately and delete or anonymise data received from Meta within 30 days, unless the law requires us to keep it longer.

8. Security

We encrypt data in transit, store access tokens encrypted, limit access to staff who need it, isolate each customer's data at the database level, and keep access logs for audit.

9. Your rights

You may request access to, a copy of, correction, deletion, restriction or portability of your personal data, object to processing, and withdraw consent at any time. If your data comes from messaging a business's Page, we will work with that business (the controller) to act on your request. You may also complain to Thailand's Personal Data Protection Committee.

11. International transfers

Data may be processed on servers of our cloud or AI providers outside Thailand. Where it is, we put appropriate safeguards in place as the PDPA requires.

12. Changes to this policy

We may update this policy from time to time and will show the latest update date above. We will give customers with connected Pages advance notice of significant changes.

13. Contact us

NAYA PEOPLE CO., LTD. (บริษัท นายา พีเพิล จำกัด)
231 Moo 1, Nong Bua Subdistrict, Ban Khai District, Rayong 21120, Thailand
Phone 094-892-9561 · Email vorapart.cho@nayapeople.com
This policy is governed by the laws of Thailand.