เวอร์ชัน 2.2 · มีผลบังคับ 18 September 2026
Data Controller: MORESTTO COMPANY LIMITED (Opentaps team) · okbab@cerenc.com. This policy supersedes the mobile-app privacy policy (effective 15 July 2026) and covers both web and mobile.
1. Data We Collect
Account data (email when a sign-in provider supplies it, phone, display name via Google, Apple or LINE sign-in — we never see your password for those providers) · usage data (search history; likes, shares, comments; pseudonymous content-interaction events not linked to your legal identity) · conversations with AI assistants and with merchants · images you upload · WiFi connection records when you use merchant WiFi through us (connection metadata — never the content of your communications) · payment history (never full card numbers) · crash diagnostics via Sentry (not identity-linked) and push notification tokens via Firebase Cloud Messaging.
2. Purposes & Legal Bases
Providing the service you signed up for — contract performance (PDPA s.24(3); GDPR Art 6(1)(b)) · security, abuse and fraud prevention — legitimate interests (PDPA s.24(5); GDPR Art 6(1)(f)) · record-keeping required by law, e.g. computer traffic data — legal obligation (PDPA s.24(6); GDPR Art 6(1)(c)) · marketing and news — consent only, withdrawable at any time as easily as it was given (PDPA s.19, s.24(1); GDPR Art 6(1)(a), Art 7(3)) · operating a business’s own connected advertising and messaging accounts on that business’s instruction — contract performance with that business (PDPA s.24(3); GDPR Art 6(1)(b)).
For LINE sign-in, after you consent, we use the email address LINE supplies to create or sign in to your account and, when the provider verifies the address, link a sign-in method to an existing account using the same address. LINE may not supply an email address; in that case we do not use one for this purpose.
3. What We Do Not Do
We do not sell or share personal data (including as "sell/share" is defined by the California CCPA/CPRA). We do not use your personal data to advertise to you, we do not build advertising audiences from your activity here, and we run no third-party behavioural analytics or advertising trackers on our own surfaces.
This section is about your data. Businesses that use Opentaps may connect their own advertising and messaging accounts to it, and we then act on that business’s own account data on its instruction. That is the business’s data about its own campaigns — not yours, and not used to target you.
4. Children & Minors
The service is not yet directed at children: full support for minors (date-of-birth check and parental-consent flow per Thailand PDPA s.20 — under 10: parent-only consent; 10–19 not sui juris: minor + parent) is under development and this section will be updated when it launches. Until then, users under the applicable digital-consent age (Thailand: s.20 tiers; e.g. GDPR Art 8: 13–16 by member state; COPPA: under 13 in the US) should use the service only with parental supervision. If you believe a child has provided data without required consent, contact us — we will verify and delete data not subject to statutory retention.
5. Disclosure & Subprocessors
Infrastructure and authentication: AWS (incl. Cognito); third-party sign-in: Google, Apple and LINE · AI processing: OpenAI · crash reporting: Sentry · notifications: Firebase Cloud Messaging (Google) · email: Resend · chat channel: LINE. We also disclose to merchants you interact with (only as necessary for your use) and to public authorities where the law requires. The current sub-processor list is published and updated with notice.
Advance notice: from 25 September 2026, Meta Platforms (US) becomes a recipient for businesses that connect their own Meta advertising or messaging accounts. It is not one today. The sub-processor list carries the details and the date.
6. International Transfers
AI processing takes place with providers abroad (e.g. OpenAI, US). We implement appropriate safeguards under PDPA s.28 and, for users in the EU/UK, GDPR Chapter V mechanisms such as the 2021 Standard Contractual Clauses and the UK Addendum.
7. Retention
Account data: until you delete your account, plus a short recovery window. WiFi traffic records: at least 90 days from entry into the system, and user-identification data at least 90 days from end of use, as mandated by Thailand’s Computer-related Crime Act s.26 and the MDES Notification B.E. 2564; competent officials may order extensions (up to 6 months per order, 2 years total). This retention is a legal duty — it cannot be shortened by consent withdrawal. Identifying data is deleted within 30 days of a verified deletion request, except where such legal duties apply.
8. Your Rights
Access, copy, rectification, erasure, restriction, objection, portability, and withdrawal of consent (PDPA ss.30–36; GDPR Arts 15–22) — answered within 30 days via okbab@cerenc.com. Erasure may be refused or deferred only for records the law obliges us to keep (PDPA s.33 para 2); in that case we tell you why and log the refusal in our records of processing (s.39). You may complain to the Thai PDPC or your local supervisory authority.
For breaches likely to pose a high risk to your rights and freedoms, we notify you directly without undue delay — nature of the breach, likely impact, and measures taken (PDPA s.37(4) para 2; GDPR Art 34) — in addition to the 72-hour regulator notification.
9. Security
Encryption in transit (HTTPS), role-based access control, and append-only system activity logging. Our security controls are aligned with ISO/IEC 27001:2022 Annex A, and we are progressing toward certification — we do not claim certification until it is achieved.
10. Assistants You Connect
You can connect a third-party AI assistant — Claude, ChatGPT, or another client that speaks the Model Context Protocol — to an opentap you are a member of. Nothing is shared until you complete a consent screen that names the assistant and lists exactly what it is asking to read, and you tick what it may have.
What it can read: only what you ticked, from three categories. The opentap’s own profile (name, description, category, location, and the words the merchant wrote about the business); its catalogue (items, descriptions, prices, availability); and a sales summary — totals, number of bills and top items over a window of at most 90 days. The summary is aggregates. No tool returns individual orders, customer names, contact details, member balances or transaction rows.
It can never read more than you can. Every request is checked twice: against the permissions your own seat in that opentap carries, read fresh at the moment of the request, and against the scopes you ticked. A connection is the narrower of the two, so it cannot become a way to reach something your own account could not open.
Purpose and legal basis: to carry out the connection you asked for — your consent, given on the consent screen (PDPA s.19; GDPR Art 6(1)(a)) — together with our legitimate interest in keeping that connection secure and inside its limits (GDPR Art 6(1)(f)).
What we record about a connection: which assistant, which scopes you granted, when you granted them, when it was last used, and a count of calls per week used to enforce your plan’s allowance. Access tokens are short-lived, and refresh tokens are stored only as a one-way hash. We never hold your assistant account’s credentials.
Withdrawing: Business Settings → Connectors → Connected assistants lists every connection with its scopes and when it was last used. Revoking takes effect immediately — the next request from that assistant is refused. Revoking removes the assistant’s access, not the opentap’s data.
Retention: a revoked connection is kept, marked revoked, for the period in §7, so a record of what was shared and when stays auditable; its tokens stop working at the moment you revoke. Deleting your account removes its connections with it.
The assistant’s side is not ours. Once an answer reaches the assistant, what that company does with it — including whether it is retained or used to train their models — is governed by their privacy policy, not this one. Read it before you connect.
11. Changes to This Policy
Material changes are notified in advance in-app or by email, with a published version history. The change from the previous policy’s "not designed for children under 13" approach to the s.20 consent tiers is a material change and will be notified directly to existing users.
This policy covers our service only. Third-party sites we link to are governed by their own policies — please read them before providing data.