1. Who we are
Nequz is provided by an individual ("we"), the data controller for visitors to our website and for Nequz account users.
For anything about personal data, email hello@nequz.app.
2. Who this policy covers
- Visitors to nequz.app
- Owners and staff of businesses who sign in to Nequz
- People who contact us, for example by email
For customers who book through a booking page or a broker, the owner is the data controller and we process the data on its behalf (see section 13). If you are a business's customer, please contact that business first about your rights; we will help it respond.
3. Data we collect
| Category | Data | Source |
|---|---|---|
| Account | Name, profile picture, LINE or Google user ID, and email | LINE or Google when you choose to sign in, and the email you confirm |
| Business | Business name, language and time zone, offerings, prices, commission rules, booking link, deposit details (PromptPay ID or bank account) | You |
| Bookings | Customer name, phone, email, LINE ID, language, booked date and time, party size, notes, recorded deposits and the booking's source (broker or UTM) | Customers through booking pages, or users creating bookings |
| Brokers | Workspace name, connection requests and their message, connection status, the broker's link and its clicks | Brokers and owners |
| Plan billing | Plan, payment status, Stripe customer ID and billing email. We never store card numbers | You and Stripe |
| Security and usage | Sign-in cookies, confirmed devices, email code sends, and API request logs (route, status, time, IP address and user agent) | Your device and browser |
| Contact | Name, email and what you send us | You |
We do not intend to collect sensitive personal data (such as religion, health or biometrics). Please do not put it in notes.
4. Why we use data, and the legal basis
| Purpose | Legal basis (PDPA) |
|---|---|
| Create accounts, verify identity and send sign-in codes on new devices | Necessary for the contract (s. 24(3)) |
| Take bookings, connect owners with brokers, email booking notices, calculate commission, produce statements and run the API | Necessary for the contract (s. 24(3)) |
| Bill plans and issue invoices and receipts | Contract (s. 24(3)) and accounting and tax obligations (s. 24(6)) |
| Keep the service secure, prevent unauthorised access and abuse, fix problems | Legitimate interests (s. 24(5)) |
| Answer questions and give support | Contract (s. 24(3)) or legitimate interests (s. 24(5)) |
| Send essential service notices, such as changes to terms or prices | Contract (s. 24(3)) |
| Analytics or marketing with non-essential cookies (if introduced) | Consent (s. 19), which you can withdraw at any time |
| Comply with the law, court orders or authorities | Legal obligation (s. 24(6)) |
If you do not give data needed for the contract, such as an account to sign in with, we cannot provide the service. We do not sell personal data and do not use businesses' customer data for our own marketing.
6. Who we share data with
We share data only as needed, with:
- people in the same business: owners and staff see the business's data according to their role;
- the parties to a booking: the owner sees its business's bookings and a broker sees only the bookings it sent, to do that work and calculate commission;
- LINE (LY Corporation): LINE sign-in;
- Google: Google sign-in, and Google Fonts on the website;
- Stripe: card payments and invoices for plans;
- Stripe: processes a customer's payment details when they pay a deposit through Stripe, as the business's payment processor;
- Cloudflare: hosting of the website and database, and sending sign-in code emails;
- systems a business connects through the API or webhooks, as that business configures;
- authorities or courts where the law requires, and our legal advisers and auditors under confidentiality;
- a successor if the business is merged or sold, who must protect the data under this policy.
7. International transfers
Some of our providers, such as Cloudflare, Google, Stripe and LINE, store or process data outside Thailand. We transfer only what is needed to perform our contract with you (s. 28(3)) and choose providers with appropriate safeguards, such as standard contractual clauses or certified security standards.
8. How long we keep data
| Data | Period |
|---|---|
| Accounts and business data | While you use the service; deleted or anonymised within 90 days after the account or business is closed |
| Bookings and statements | While the business uses the service; the business can delete or ask us to delete them unless the law requires keeping them |
| Plan billing records | 5 years, under accounting and tax law |
| API request logs (incl. IP and user agent) | 30 days, then deleted automatically |
| Hourly API usage statistics (no personal identifiers) | About 13 months |
| Sign-in cookies and confirmed devices | 30 days, or until you sign out or revoke the device |
| Email sign-in codes | Valid 10 minutes, deleted when expired |
| Contact emails | Up to 2 years after the matter is closed |
9. Security
- All traffic is encrypted with HTTPS.
- No passwords: sign-in goes through LINE or Google, with an email code on new devices.
- Sign-in tokens and secrets are stored hashed; cookies are HttpOnly and Secure.
- Each business's data is separated, and access is limited by owner and staff roles.
- A Content Security Policy and rate limits reduce the risk of attacks.
- Staff access to data is limited to what running the service needs.
No system is perfectly secure; we review and improve these measures regularly.
10. Your rights
Under the PDPA you have the right to:
- access and get a copy of your data (s. 30);
- receive your data, or have it sent to someone else, in a machine-readable format (s. 31);
- object to processing based on legitimate interests (s. 32);
- have your data deleted, destroyed or anonymised (s. 33);
- restrict the use of your data (s. 34);
- have your data corrected and kept up to date (s. 35);
- withdraw consent at any time, without affecting what was done before (s. 19);
- complain to the Personal Data Protection Committee (PDPC), www.pdpc.or.th.
Send requests to hello@nequz.app. We may ask you to verify your identity first and will reply within 30 days of receiving the request. If we refuse a request where the law allows, we will tell you why. Some data you can change or download yourself in the dashboard, such as the business name, your email, your team and statements as CSV.
11. Minors
Nequz accounts are for adults acting for a business. We do not knowingly collect minors' data through user accounts. A business that takes bookings for minors must obtain a parent's or guardian's consent where the law requires.
12. Personal data breaches
If a personal data breach occurs, we will notify the PDPC within 72 hours of becoming aware of it where the law requires, and notify affected people with remedies without undue delay when the breach poses a high risk to their rights. For data we process for a business, we will notify that business without undue delay so it can meet its own duties.
13. Data we process for businesses
When customers book through a booking page or a broker, the owner is the data controller. We process that data only on the business's instructions to provide the service, under the processing terms in section 10 of the terms of service. Businesses should give their customers their own privacy notice.
14. Changes to this policy
We may update this policy as the service or the law changes and will show the effective date at the top. For material changes we will notify you in the dashboard or by email before they take effect, and ask for consent again where the law requires.
15. Contact
Nequz · email hello@nequz.app