1. Our roles: controller and processor

For the Customer's own account and billing data, Naya People is the data controller. For the end-customer messages and data processed through the LINE chat, the Customer is the controller and Naya People acts as its data processor, handling that data only on the Customer's instructions.

2. Information we collect

Depending on how the Service is used, this may include:

• Customer account data — the shop details and admin users configured in the Admin Panel.
• End-customer data — LINE identifier, messages, and any details a customer shares in the chat.
• Content and configuration — the product data and knowledge you load into the Service.
• Usage and billing data — log-ins, actions, and the information needed to invoice your subscription.

3. How we use personal data and AI processing

We use personal data to generate replies, answer customers and help close sales on the Customer's behalf, and to secure, support and bill the Service. Messages may be processed by third-party AI models to produce responses; we do not use your end-customers' data to train our own general models.

4. Legal basis (PDPA)

We rely on the lawful bases under the PDPA — performance of a contract, legitimate interests in running and securing the Service, consent where required, and compliance with law. The Customer is responsible for having a lawful basis for the end-customer data processed through the chat.

5. Third-party platforms and sharing

The Service operates through LINE and relies on third-party AI providers; interactions are also subject to their privacy terms. We do not sell personal data. We share it only with sub-processors that host, power or support the Service, professional advisers, or authorities where required by law.

6. Data retention

We keep personal data for as long as the account is active and as needed to provide the Service. After cancellation we make your data available for export for a reasonable period, then delete or anonymise it unless the law requires longer retention.

7. Data security

We apply appropriate technical and organisational measures — including access controls, encryption in transit, and database-level tenant isolation — to protect personal data against unauthorised access, loss or misuse.

8. Your rights under the PDPA

Subject to the PDPA, data subjects may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. As processor, we forward such requests to the relevant Customer (controller) or assist in responding.

9. International data transfers

Data may be processed in Thailand and, where AI providers operate abroad, outside Thailand. Where processing occurs outside Thailand, we put appropriate safeguards in place as required by the PDPA.

10. Children's privacy

The Service is intended for businesses and their customers. Where a chat involves a minor's data, the Customer is responsible for handling it lawfully, including obtaining any consent required.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, for material changes, provide reasonable notice.

12. Contact us

For privacy questions or to exercise your rights, contact Naya People Co., Ltd. using the details below. This policy is governed by the laws of Thailand.