Privacy Policy

Version 1, 29 September 2026 · Written for Thailand’s Personal Data Protection Act (PDPA)

1. What data we hold

Merchant accounts: your name and email (from Google sign-in), your store details (name, address, tax ID, phone, logo) and everything you enter to run your store.

Your customers’ data: when your customers order, their name, phone number and delivery address are stored in your store. For this data you are the data controller and FreshOS acts as your processor: we store and display it for you and use it for nothing else.

2. What we do NOT do

We do not sell personal data, we do not run advertising trackers, and we never use your business data (sales, margins, suppliers) for anything except showing it to you.

3. Cookies

We use only functional cookies: your sign-in session, your language and theme, and (for shop customers) which store their QR code points to. No advertising or cross-site tracking cookies.

4. Where data lives

Data is hosted with Supabase on AWS (Asia-Pacific, Mumbai region) and served through Vercel. Access is protected by row-level security: every store’s data is isolated from every other store. Connections are encrypted (HTTPS).

5. How long we keep it

As long as your store is active. If you close your store, we delete personal data after a reasonable wind-down period, except immutable financial records (invoices, receipts) that must be retained under Thai accounting rules.

6. Your rights (PDPA)

You can request access to, correction of, export of, or deletion of your personal data at any time via the in-app Support chat. If your customers exercise their PDPA rights with you, we help you fulfil them (e.g. deleting a customer record on your instruction).

7. Changes

If this policy changes materially, we announce it in the app before the change takes effect.

See also our Terms of Service and, for the data of your customers, the Data Processing Agreement.