Posless is operated by Posless Co., Ltd. (company registration no. 0145569005781), the data controller (“we”). We take the privacy of our users seriously and operate in line with Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). This policy explains what we collect, how we use, share, and protect your data, and your rights as a data subject.
1. Data we collect
- Account data: shop name, email (if provided), LINE user ID, your shop’s business category, and how you heard about us
- Usage data: sales, costs, products, expenses, and the entries you record through the bot
- Receipt photos you send so the system can read the amounts and costs
- Team member data: if you invite staff to help manage your shop, we store the LINE user ID of the members you add
- Payment data: the status, amount, and billing cycle of your payments (card numbers never reach us — see the paragraph below)
We do not store bank passwords, PINs, card numbers, or OTPs, and we never request the right to transfer your money. Card details are entered directly on the secure payment page of a PCI-DSS compliant payment provider. We also do not intend to collect sensitive data (such as religion, health, or biometric data); if such data appears in a receipt photo, please cover it before sending, as we only use the amount/cost figures.
2. Purposes and legal basis
We use your data only as needed, on the following legal bases:
- Performance of our contract: to calculate and summarise your profit, record your sales/costs, and run your shop’s account
- Legitimate interest: to keep the system secure, prevent misuse, and improve the service
- Legal obligation: to retain payment/tax records as required by law
- Your consent: to send you news and marketing, which you can withdraw at any time
3. Disclosure and sharing
We do not sell your data. We share data only as necessary with trusted data processors, solely to deliver the service and under confidentiality agreements:
- Cloud infrastructure and database providers (to host and run the system)
- An AI provider that reads the figures from receipt photos
- Our payment provider (Omise) for paid plan subscriptions
- An email/notification provider
We may also disclose data where required by law or legal order.
4. International data transfer
Some of our cloud and AI providers have servers located abroad, so some data (for example, receipt photos sent to the AI for reading) is transferred for processing outside Thailand. We choose providers with appropriate data protection standards and handle such transfers in line with the PDPA.
5. Cookies
This site uses cookies for analytics (Google Analytics), which run only when you accept. You can choose “Only essential” from the cookie banner and change your mind later.
6. Security
We encrypt connections (HTTPS), keep each shop’s data separate, restrict access to those who need it, and keep encrypted backups. No system is 100% secure, however, so we continuously improve our security measures.
7. Data breach notification
If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee and affected individuals under the criteria and timeframes required by law. This is a legal duty and cannot be waived by any terms of use or agreement.
8. How long we keep your data
- Account and usage data (sales, costs, products, receipt images, etc.): we keep this for as long as your shop stays active, so your profit summaries and history stay continuous.
- If your shop is inactive for more than 12 months in a row (no entries recorded and no interaction through the bot), we treat it as no longer in use and permanently delete your shop data, in line with the data-minimisation principle. We notify you via LINE at least 30 days in advance before deleting, and if you return within that window your data is not deleted. (This is measured by activity, not payment — an active Free plan is not deleted.)
- When you request deletion (see section 9), we permanently delete your data from our systems within the timeframe stated there.
- Encrypted backups kept for disaster recovery are retained for no more than 30 days, then automatically deleted on a rolling schedule.
- Payment data: our payment provider (Omise) may be required to retain certain transaction records for the period required by accounting/tax law, even after we delete data on our side. That retention follows the provider’s own data retention policy, which is outside our control.
9. Your rights
As a data subject you have the rights under the PDPA to access and obtain a copy, to rectify, to erase or destroy, to restrict use, to object to processing, to data portability, to withdraw consent, and to lodge a complaint with the regulator.
Two core rights you can exercise yourself, instantly, through LINE:
- Request a copy: type “ขอข้อมูล” (request data) in the chat and the system sends a link to download your shop’s data as a file (sales, costs, products, expenses, payments), with no other shop’s data mixed in.
- Request deletion: the shop owner types “ลบข้อมูล” (delete data) and confirms. The system then permanently and automatically deletes your shop data from our systems within 7 days, and it cannot be recovered. You can cancel the request yourself within those 7 days (type “cancel deletion request”). Payment data retained by our payment provider for legal/accounting reasons follows section 8 above.
For the other rights, or anything needing our team’s help, contact us via section 11.
10. Children’s data
Posless is a service for shop owners and businesses, and is not directed at minors. If you are a minor, please use the service under the supervision and consent of your guardian as required by law.
11. Contact us about personal data (PDPA)
The data controller is Posless Co., Ltd. (company registration no. 0145569005781). For any question or request about your personal data beyond the copy/deletion requests via LINE above, reach us via our contact form and mention “PDPA” or “personal data” in your message. Our team will take care of it and get back to you as soon as possible.
If you believe we process your data unlawfully, you have the right to lodge a complaint with Thailand’s Office of the Personal Data Protection Committee (PDPC).
12. Changes to this policy
We may update this policy from time to time and will post the latest version on this page with the update date. Continued use of the service means you acknowledge the updated policy.