Legal
Privacy Policy
Draft — August 6, 2026
This Privacy Policy explains how PIATEC (Thailand) Co., Ltd. ("Sendao", "we") collects, uses, discloses, and protects your personal data when you use the Sendao Service, whether as a restaurant, a creator, or a website visitor, under Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
1. Data Controller
The data controller under this Policy is PIATEC (Thailand) Co., Ltd., 24 Prime Building, 10th Floor, Room A, Sukhumvit 21 (Asoke) Road, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand. For all data protection matters, including requests to exercise the rights described in Section 9, contact our data protection contact point at info@piatec.co.th.
2. Personal Data We Collect
We collect the following categories of data when you use the Service: Account data — email address, password (stored as an irreversible cryptographic hash) or a linked Google/LINE identifier for social sign-in, display name, profile picture, user role (restaurant/creator/admin), email verification status, and last login time. Restaurant profile data — restaurant name, description, address, province, phone number, business hours, restaurant photos, and the restaurant's Instagram/TikTok links. Creator profile data — display name, bio, province, phone number, profile picture, and the handle of any linked Instagram/TikTok account. Data from linked social media accounts — see Section 3 for details. Campaign activity data — campaign details, applications, matching status, chat messages between a restaurant and a creator, attachments (including draft videos submitted for review), published post links, and post performance data (reach, likes, comments retrieved from the post link you submit). Visit data — the agreed visit date/time and the QR check-in timestamp. Rating & complaint data — ratings and comments exchanged between parties, and details of any complaint filed. Billing data (restaurants) — subscription package details, billing period, and payment status, recorded for internal tracking only; actual payment is handled outside the platform and we do not process any credit/debit card data through the Service. Technical data — IP address and device/browser (user agent) information recorded with your login session for security purposes.
3. Social Media (SNS) Data Collected via a Third-Party Service
When a creator links an Instagram or TikTok account to the platform, we periodically retrieve that account's public data through a third-party automated data-collection service (Apify) — a temporary approach used in Phase 1 of the Service, pending the official Instagram/TikTok APIs, which require business verification. The data retrieved includes: follower and following counts, post count, account verification status, display name and bio, profile picture, engagement rate, and average likes/comments/views/shares/saves across recent posts, as well as performance data for the specific posts you submit to a campaign. The data retrieved is limited to information publicly visible on the account you choose to link — we do not access private messages, detailed follower/following lists, or any information not publicly disclosed on that account. Linking an account is required to use the Service's creator features (see Section 5 of our Terms of Service), so we collect this data on the basis of contractual necessity rather than as a separate, freely-withdrawable consent; unlinking an account will prevent you from applying to new campaigns until you link another one. If the linked account does not in fact belong to the person who registered it, we process that account's public data on the basis of our legitimate interest in operating creator scoring and matching, and the actual account holder may contact us at info@piatec.co.th to object to this processing or request that the link be removed.
4. Purpose & Legal Basis for Processing
We process your personal data for the following purposes, relying on the following legal bases under the PDPA: - Contractual necessity (operating the platform): creating and managing your account, matching campaigns, processing applications, delivering chat messages, verifying visits, calculating scores, collecting data from a creator's linked SNS account as needed to provide creator features (Section 3), and sending campaign status notifications. - Your consent: contacting you by email or LINE for purposes beyond core account operation (such as general news or announcements) where you have given consent at registration. - Our legitimate interests: preventing fraud and misuse, maintaining system security, improving service quality, analyzing usage in a manner that does not unduly affect your rights, and processing publicly available social media data associated with a linked account where that account does not belong to the person who linked it. - Legal compliance: responding to lawful requests from government authorities and meeting statutory record-keeping obligations.
5. Disclosure to Third Parties
We disclose your personal data to third parties only as necessary to operate the Service: - Apify Inc. — the automated web-scraping service used to retrieve public data from linked Instagram/TikTok accounts (Section 3). - Google LLC and LINE Corporation — identity providers when you choose to sign in via social login. - Resend — our transactional email provider (account verification, password reset, campaign notifications). - Our cloud object storage provider — for storing photos, attachments, and videos you upload. - Government or other legally authorized bodies, where required by a lawful order or legal obligation. We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
6. International Data Transfer
Some of the service providers listed in Section 5 (such as Apify, Google, LINE, and Resend) operate servers located outside Thailand. Using the Service may therefore result in your personal data being processed abroad. Before transferring personal data to these providers, we put in place the safeguards required under Section 28 of the PDPA — such as data-protection terms or standard contractual clauses in our agreement with each provider — and we work only with providers in jurisdictions with adequate data protection or covered by such safeguards.
7. Retention Period
We retain your personal data for as long as your account remains active, and for up to 3 years after account closure to comply with legal obligations, resolve disputes, and prevent fraud. SNS sync logs are retained for up to 1 year, and billing records for 5 years as required under Thai accounting and tax law. Once data is no longer needed for the purpose it was collected, we delete it or render it unable to identify you.
8. Security Measures
Your password is stored as an irreversible cryptographic hash. Tokens for linked Google/LINE accounts are encrypted before storage. Access to internal data is restricted by user role (restaurant/creator/admin). Traffic between your device and our servers is encrypted via TLS. We rate-limit login attempts to guard against credential-guessing attacks.
9. Your Rights Under the PDPA
Under Thailand's Personal Data Protection Act B.E. 2562, you have the right to: - Access and request a copy of your personal data - Request correction of inaccurate data - Request deletion or destruction of your data once it is no longer necessary for the purpose collected - Request restriction of processing in certain circumstances - Object to processing carried out on the basis of legitimate interest - Request your data in a machine-readable format, or request its transfer to another controller, where technically feasible - Withdraw consent you have given at any time (e.g. unlinking an SNS account or turning off email notifications) without affecting the lawfulness of processing carried out before withdrawal At present, requests to exercise these rights — including permanent account deletion — are handled by contacting our team at info@piatec.co.th, as the Service does not yet offer self-service account deletion within the app. We will act on your request within the timeframe required by law and may ask you to verify your identity before proceeding.
10. Contact by Email and LINE
Upon registering, you will receive emails necessary to operate your account — such as identity verification, password reset, and campaign/application status notifications — which are part of the Service and cannot be fully disabled. You may adjust notifications that are not essential to core operation (such as reminder emails) from the notification settings page. Where you have given separate consent to receive news, promotions, or contact via a LINE Official Account for purposes beyond operating your account, we will contact you only through the channel and consent you have provided. You may withdraw that consent at any time without affecting your use of the core Service.
11. Cookies & Similar Technologies
Our website and apps use only cookies necessary for operation: a cookie that remembers your chosen language on our marketing site (retained for 1 year), and cookies/tokens necessary for signing in and authenticating via Google/LINE. We do not currently use cookies for advertising or cross-site behavioral tracking. Should this change in the future, we will update this Policy and notify you.
12. Children's Privacy
The Service is not directed at individuals under 20 years of age, except with the consent of a legal guardian as required by law. If we become aware that we have collected a minor's personal data without valid consent, we will delete that data as soon as reasonably possible.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to the Service or applicable law. We will notify you of material changes via your registered email or a platform notice before they take effect.
14. Contact Us
If you have questions about this Privacy Policy, or wish to exercise any of the rights described in Section 9, please contact: PIATEC (Thailand) Co., Ltd., email info@piatec.co.th, address 24 Prime Building, 10th Floor, Room A, Sukhumvit 21 (Asoke) Road, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand.
Questions about this Policy? Reach us at info@piatec.co.th