Privacy Policy

This policy explains how BoxBak (“we”, “us”) collects, uses, discloses, and protects personal data under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). It covers visitors to our website, store owners and staff who use the system, and a store’s customers who order via QR. BoxBak is operated by Chanchai Munjit, an individual (not yet a registered company). This English version is provided for convenience — the Thai version prevails if the two conflict.

1. Our role for each kind of data

• Account data of the person who signs up (e.g. the owner’s email and name) — we act as the data controller.
• Data a store records in the system (staff records, time clock, payroll, sales, customer orders, etc.) — the store is the controller and we act as a data processor on the store’s instructions given through its use of the system. Requests concerning this data should be made to the store you deal with first; we support the store in fulfilling them.

2. Data we collect

Account and authentication data

• Email, name, and username of owners and staff.
• Passwords and PINs, always stored as one-way hashes — we cannot read the original values.
• Identifiers of devices bound to a store for front-of-house sign-in, and a LINE user ID when a user chooses to link their account for OTP delivery.

System usage data

• Sales, orders, stock, costs, and documents the store records.
• Clock-in/out times, shift schedules, and compensation data the store records.
• System audit logs of key financial, stock, and permission actions, designed to be tamper-evident for transparency and review.

Store customers (QR ordering)

• The items ordered and the table they were ordered from. Customers are not required to register or identify themselves.

Data sent to AI for processing

• When a user asks for an AI task, such as photographing a supplier bill, asking about sales or drafting a menu, we send the photo, the question and only the store data that task needs to an AI provider, and keep the result as a draft for the store to review.

Payment data

• Payment status from payment providers (e.g. PromptPay confirmation). We do not store full card numbers or bank account details of payers.

3. Cookies we use

• Session cookie — strictly necessary for secure sign-in; digitally signed against tampering and expires automatically.
• Store device cookie — strictly necessary to recognize devices the store has approved, so staff can sign in at the counter safely and conveniently.
• Website visitor statistics (cookieless) — on BoxBak’s public website pages only (the home page, the features page, the pages for each type of shop and the signup page), we use Vercel Web Analytics to count visitors as aggregate statistics. It sets no cookie on your device, does not tie data to your IP address, does not identify you and does not track you across websites; the value used to tell visitors apart is discarded within 24 hours. What we see is the page opened, the referring website, approximate country and city, device type, operating system and browser. We strip every URL parameter except campaign codes (utm), and we never count pages inside a store’s system, QR pages or pages carrying a private code. If your browser sends Global Privacy Control or Do Not Track, we send nothing about your visit.
• We use no advertising cookies and no cross-site tracking cookies.

4. Purposes and legal bases

• Providing the contracted service — creating accounts, signing in, recording and displaying the store’s data (contract).
• Security, fraud prevention, and investigating anomalies (legitimate interests).
• Understanding how many people visit the public website and where they come from, to improve it — aggregate statistics that cannot identify anyone (legitimate interests).
• Complying with law, such as keeping accounting and tax records (legal obligation).
• Sending essential account and service emails — marketing communications only with your consent (consent).

5. Disclosure to third parties

We do not sell personal data. We disclose it only as needed to run the service, to the sub-processors below, and where required by law or a lawful government order:

• Cloud infrastructure, web hosting and website visitor statistics — Vercel
• Database and file storage — Supabase
• Transactional email (such as signup verification links and OTP codes) — Resend
• AI assistant — Anthropic (Claude), and possibly Google (Gemini) for some AI tasks; only the data of the task a user requests is sent
• The LINE platform — when a store or user chooses to connect LINE
• Payment and slip verification providers (such as Opn Payments, SlipOK, EasySlip) — only when the store turns them on

Several providers are located, or store data, abroad, for example in Singapore, the United States and the European Union; we select providers with data protection standards adequate under the PDPA. If an owner connects their own external AI assistant to BoxBak (for example through MCP), what that assistant reads is governed by the terms of the provider the store chose.

Technical error reports are processed by an error-monitoring provider (Sentry), which stores the data in the European Union. Before a report is sent, personal data is minimised: contact details and payment identifiers are redacted, and users and stores appear only as pseudonymous internal IDs.

6. Retention

• Account and store data — for as long as the account remains active.
• After cancellation — up to 90 days to allow recovery, except data we must keep by law (e.g. accounting and tax records), which is kept for the statutory period; it is then deleted or anonymized.
• System logs — kept as long as needed for security and auditing.
• Website visitor statistics — held by Vercel as aggregate statistics that cannot identify anyone, for the period the provider sets.

7. Security measures

• All connections are encrypted over HTTPS.
• Passwords and PINs are stored only as hashes.
• Each store’s data is isolated at the database level (row-level security) — one store cannot access another’s data.
• Access within a store is role-based, and key actions carry an audit log that can be reviewed after the fact.

8. Your rights under the PDPA

You may request access to and a copy of your data, correction, deletion or destruction, restriction of use, objection to processing, data portability, and withdrawal of consent you have given, by contacting us below. We will respond within the statutory period, and you may lodge a complaint with Thailand’s Personal Data Protection Committee (PDPC) if you believe processing violates the law. For data controlled by a store (such as staff records or customer orders), please direct your request to the store.

9. Children’s data

The service is designed for business operators. We do not intend to collect minors’ data; if we find such data collected without valid consent, we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. For material changes we will give reasonable advance notice through the system or by email. The latest update date is shown at the top of this page.

11. Contact

Data controller: BoxBak is operated by Chanchai Munjit, an individual (not yet a registered company) — for questions or data subject requests, contact support@boxbak.app