Privacy Policy

We may collect the following types of information:

• Account Information: name, email address, password hash, interface language and role within your organisation. If you sign in with Google or LINE, we receive your name, email address and profile identifier from that provider.
• Company and Branch Data: legal entity name, tax identification number, tax region, branch codes and addresses that you enter in order to keep documents, registers and returns per entity.
• Supplier Documents: images, photos and PDF files of supplier invoices, delivery notes and receipts that you upload, together with the data extracted from them: supplier name and tax number, document number and date, line items, quantities, prices, discounts and VAT amounts.
• Accounting and Tax Data: input and output VAT registers, reverse-charge records and calculated return figures generated from the documents you process.
• POS Integration Credentials: the server address, login and password of your Syrve POS account. These credentials are stored encrypted (AES-256-GCM) and are used only to send purchase documents and read nomenclature and supplier lists on your behalf.
• Messaging Identifiers: if you link our Telegram bot to your account, we store your Telegram chat identifier so that documents you send in the chat can be attached to your account and status notifications can be delivered to you.
• Billing Data: subscription plan, number of restaurants (RMS), invoices and payment status. Card payments are processed by our payment provider; we receive only the transaction result and a payment identifier and never store full card numbers or CVV codes.
• Technical Data: IP address, browser and device type, operating system, application version and log records of actions performed in the service.

• To provide and maintain document recognition, review and posting to your POS system.
• To extract data from your documents using artificial-intelligence models operating on our behalf.
• To maintain VAT registers and calculate return figures per legal entity and tax period.
• To match suppliers and products to your existing POS records, including remembering the aliases you confirm.
• To authenticate you, manage access rights inside your organisation and protect the service from abuse.
• To administer subscriptions, issue invoices and process payments.
• To send service-related notices, including document processing results.
• To improve accuracy, functionality and user experience of the platform.

We do not sell your personal information. Some data may be processed and stored on secure cloud servers located outside Thailand; where personal data is transferred abroad we apply appropriate safeguards in accordance with the Thailand Personal Data Protection Act (PDPA), and such data is not disclosed to any third party without a lawful basis. We may share your data with:

• Users within your organisation: colleagues and administrators of your account can see the documents, registers and settings of your organisation as part of normal accounting operations.
• Your POS system: the purchase documents you approve are transmitted to the POS server you configured, under your own credentials.
• Service Providers: trusted third parties that help us operate the platform — cloud hosting and file storage, AI processing, email delivery, messaging and payment processing — bound by confidentiality obligations.
• Legal Requirements: when required by law, regulation or legal process.

We implement industry-standard security measures including encrypted data transmission (TLS/SSL), hashed passwords, token-based session authentication, encrypted storage of POS credentials (AES-256-GCM), private file storage with time-limited access links and per-tenant data isolation. However, no method of electronic transmission or storage is 100% secure.

We retain your data for as long as your account is active or as needed to provide the service to your organisation. Document images, extracted data, VAT registers and return figures are kept for the retention period required by the applicable tax legislation of your country, unless you delete them earlier. When you delete a document, its file is removed from our storage and the corresponding register entry is excluded from calculations. On termination of your account we delete or anonymise your data, except records we are required to keep by law.

Depending on your jurisdiction, you may have the right to:

• Access your personal data.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal retention requirements).
• Request a copy of the data you provided in a portable format.
• Withdraw consent for optional data collection, for example messenger integration.
• Object to processing or request its restriction on lawful grounds.

To exercise these rights, contact us using the details below. Where you use the service as an employee of an organisation, some requests may need to be addressed by the administrator of that organisation.

The platform is a business tool and is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy and updating the "Last updated" date.