Privacy Policy

1. Data Controller and contact details

• Data Controller: the Sawadee TAX operator
• Address: disclosed without delay on request
• Representative: disclosed without delay on request
• Privacy officer (DPO): the Sawadee TAX privacy officer
• Contact: the contact address will be published here before launch

2. Personal data we process and why

• Account: e-mail, name, password (stored encrypted — the Provider cannot see it), screen language, quick sign-in device information → sign-up, sign-in, identity verification, notifications
• Company: business name, tax ID, address, branches, business type, VAT registration status, company logo, features in use → keeping books and preparing documents, plan management
• Books and documents: photos and files of receipts, tax invoices, bank statements, letters and contracts, what the AI has read, suppliers, amounts, notes → keeping books, tax calculations, date reminders
• Staff data you enter: names, pay, schedules, document expiry dates, contact details, ID card and social security numbers and the like → calculating payroll and filing figures (Section 4)
• If you connect LINE: LINE user ID, display name, LINE app language → LINE notifications and messages
• Payments: plan, payment status and dates, Paddle customer and subscription numbers (card numbers are handled only by Paddle; the Provider does not receive them) → billing, refunds, managing limits
• Inquiries: the content of your inquiries and our replies → responding to inquiries
• Consent records: what you agreed to, the version of the terms, time, IP address, browser information → proof of consent
• Information generated automatically: access and error logs, device and browser type, IP address, cookies that keep you signed in → security, preventing misuse, fixing errors

3. Legal basis for processing

• Performance of a contract: processing needed to provide the Service (PDPA Section 24(3), PIPA Article 15(1)(4))
• Legal obligation: keeping payment and tax records, lawful requests from authorities
• Legitimate interests: security, preventing misuse, fixing errors, statistics from which no person can be identified (to the extent they do not override your rights)
• Consent: receiving news and offers (marketing), and transfers abroad where the law requires consent (such as Article 28 of Japan's APPI)

The Provider does not use personal data beyond the purposes above. If a purpose changes, we will notify you in advance or obtain your consent as the law requires. We do not ask for sensitive data (health, religion and the like), so please do not upload it.

4. Staff and supplier data you enter

For the personal data of staff and suppliers that a Company enters into the Service, that Company is the Data Controller, and the Provider is a Data Processor acting on the Company's instructions.

The Company is responsible for informing those people about the processing and having the necessary legal basis. The Provider processes the data only on the Company's instructions and within this policy, keeps it confidential, entrusts it only to the processors in Section 6, helps with requests to exercise rights and with responding to breaches, and deletes it under Section 5 when the Company is closed.

Staff and suppliers should first send requests to see or delete their data to the Company concerned. Requests that come directly to the Provider will be passed on to the Company.

5. Retention and deletion

• Account and Customer Data: while you use the Service
• After a Company is closed: kept for 30 days, then permanently deleted (it can be restored or downloaded during that time)
• Backup copies: overwritten on the regular backup cycle (up to 30 days)
• Payment records: for the period set by the relevant law (for example 5 years under Korea's Act on Consumer Protection in Electronic Commerce, and 5 years under Thai tax law)
• Consent records: while the account exists and afterwards for as long as needed to prove consent (up to 5 years)
• Access and error logs: up to 1 year

When the retention period ends or the purpose has been achieved, we delete the data without delay. Electronic files are erased in a way that cannot be recovered; we do not receive paper documents. Data we must keep longer by law is kept separately from other data and only for that purpose.

6. Entrusted processing (Data Processors)

To run the Service, we entrust processing to the companies below. We have contracts with them (data processing agreements) covering personal data protection, no use for other purposes, security and limits on sub-processing, and we oversee them.

• Supabase, Inc.: database, sign-in, storage of photos and files
• Vercel Inc.: running the website and app (hosting)
• Anthropic, PBC: AI reading of receipts, documents, bank statements and letters, AI assistant and AI CFO answers, translation of text
• Paddle.com Market Ltd.: payments, invoices, refunds (as the seller, its own privacy policy also applies)
• Resend, Inc.: sending notices and notification e-mails
• LY Corporation: sending LINE messages (if you connect LINE)
• Browser push services (Google, Apple, Mozilla and others): delivering notifications to phones and PCs (if you turn notifications on; content is encrypted)

If our processors change, we will update this policy and let you know.

7. Transfers of personal data abroad

The Service uses servers abroad, so personal data is transferred to the countries below. In every case the transfer takes place "each time you use the Service, over an encrypted network", and the retention period is as set out in Section 5 (Anthropic deletes data a short time after reading and answering, under its own policy, and does not use it to train AI).

• Supabase, Inc. (Singapore; supabase.com/privacy): all items in Section 2 / storage and sign-in
• Vercel Inc. (the nearest region, including the United States; vercel.com/legal/privacy-policy): all items in Section 2 pass through / running the website
• Anthropic, PBC (United States; anthropic.com/legal/privacy): the documents and book entries to be read or asked about / AI reading and answers
• Resend, Inc. (United States; resend.com/legal/privacy-policy): e-mail address, name, e-mail content / sending e-mail
• Paddle.com Market Ltd. (United Kingdom; paddle.com/legal/privacy): e-mail address, company name, payment details / payments
• LY Corporation (Japan; lycorp.co.jp): LINE user ID, message content / sending LINE messages (if connected)

Personal data regimes in those countries: Singapore has the Personal Data Protection Act 2012 (PDPA 2012), the United Kingdom has the UK GDPR (recognised by Japan's Personal Information Protection Commission (PPC) as offering an equivalent level of protection), and Japan has the Act on the Protection of Personal Information. The United States has no general federal personal data protection law, but has state laws (such as California's CCPA) and sector-specific laws, as well as regimes for government access to information. The receiving companies maintain safeguards through data processing agreements, including access controls, encryption and standard contractual clauses (SCCs).

You may refuse transfers abroad, on the sign-up screen or by writing to the contact address will be published here before launch. However, because the Service runs only on these companies' servers, if you refuse we cannot provide the Service and you will not be able to sign up or use it (LINE data is not transferred unless you connect LINE).

8. Disclosure to third parties

The Provider does not sell or disclose personal data to other companies, except in the following cases:

• Where you send or connect it yourself: accountant share links, LINE messages to Team Members or accountants, and communication with a Loyverse account you have connected
• Thai Revenue Department VAT registrant lookup: we send only the supplier's tax ID to check whether it is registered.
• Where required by law, or requested by investigative authorities, courts or others through lawful procedures
• Transfer or merger of the business: we will tell you in advance and let you leave if you do not wish to continue.

9. Cookies and browser storage

We use only the cookies and browser storage that are strictly necessary to keep you signed in, remember your screen language and screen settings, and keep work in progress. We do not use advertising or tracking cookies or third-party analytics tools. If you block cookies in your browser, you may not stay signed in.

10. News and offers (marketing)

We send news of new features, discounts and events by e-mail or LINE only to people who have separately agreed to "Receive news and offers". You can use the Service just the same without agreeing.

Advertising messages are marked "(Ad)" and include a way to unsubscribe, and are not sent between 9 p.m. and 8 a.m. in the recipient's time zone. You can withdraw consent at any time in Settings → My account, and we will remind you of your consent status every 2 years.

Notices essential to using the Service (payments, security, changes to the terms and the like) are sent regardless of marketing consent.

11. Your rights and how to exercise them

You may ask to see your personal data, receive a copy, correct it, delete it, suspend its processing, move it elsewhere (download it), object to its processing, or withdraw your consent.

• Directly in the app: Settings → My account (name, password, news and offers), Settings → My data (download everything, close the Company)
• Other requests: "Contact us" in the app or the contact address will be published here before launch

After verifying your identity we will act without delay and reply within the time the law sets (for example 10 days in Korea and 30 days in Thailand). Legal representatives and authorised persons may also make requests. We may refuse, with reasons, for example where the law requires us to keep the data, and withdrawing consent does not affect processing carried out before it.

If you have a complaint, please tell the Provider first. You may also report to or consult Thailand's Personal Data Protection Committee (PDPC), Japan's Personal Information Protection Commission (PPC), or Korea's Personal Information Infringement Report Center (118) and Personal Information Dispute Mediation Committee.

12. Security measures

• All communications are encrypted (HTTPS), and passwords are stored encrypted.
• Each Company's data is kept separate, and the database prevents other Companies from seeing it.
• The screens and data each Team Member can see are limited by their role and permissions, and important changes are logged.
• On the Provider's side, the people who can access Customer Data and the occasions when they do so are kept to a minimum, and operator screens are protected by two-factor authentication and logged.
• If a personal data breach occurs, we will notify the authorities and the people affected without delay and within the time the law sets (72 hours to Thailand's PDPC, 72 hours in Korea, and promptly to Japan's PPC), and take steps to limit the harm.

13. AI and automated processing

The AI reads documents, suggests categories and accounts, and answers questions. These are only suggestions for you to check and correct; no decision that has legal effects on you or similarly significantly affects you is made automatically without human review. You may ask for an explanation of an AI result or choose not to follow it.

14. Minors

The Service is for businesses, and people under 20 may not sign up. If we learn that a minor's data has been provided, we will delete it.

15. Changes to this policy

If we change this policy, we will announce it in the Service at least 7 days before the change takes effect; changes that are unfavourable to Users or important will be announced 30 days in advance and also notified separately, for example by e-mail. Where a change requires consent, we will ask for it again in the Service.