Privacy Policy

1. Who we are

Khaojai IT Co., Ltd. ("Khaojai IT", "we", "us", or "our") is a technology and AI partner registered in Thailand, with its office at 199 Column Tower Building, 15th Floor, Room 1512, Ratchadaphisek Road, Khlong Toei Subdistrict, Khlong Toei District, Bangkok 10110, Thailand.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit www.khaojai.it, contact us, or use our services. We process personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other applicable laws.

2. Personal data we collect

Data you provide to us. When you contact us through our website forms, by email, or by phone, we collect the information you choose to share, such as your name, work email address, company name, phone number, and the content of your message.

Data collected automatically. When you visit our website, we and our analytics providers collect limited technical data such as IP address, browser type, device information, pages visited, and time spent on the site, through cookies and similar technologies.

Preferences stored on your device. Your language and display theme choices are stored locally in your browser. They are not transmitted to us and can be cleared at any time through your browser settings.

Data from conversations with our AI assistant. When you use the chat on our website, we collect the messages you type or speak (your voice is transcribed to text by your own browser; we neither receive nor store audio), the assistant's replies and the time of the conversation. If you choose to identify yourself to keep asking, we collect the name and email you provide, or basic profile data from the Google, Microsoft or Facebook account you choose.

3. How we use personal data

We use personal data to:

• Respond to your inquiries and requests
• Prepare proposals, provide our services, and manage client relationships
• Operate, secure, and improve our website and services
• Analyze website usage to improve content and experience
• Comply with legal and regulatory obligations
• Answer your questions with our AI assistant from our own knowledge base, and hand the conversation to our team when you ask for a person or the assistant cannot help
• Improve the assistant's answers by having our team review conversations it could not answer (we do not use your conversations to train the AI provider's models)

We rely on the following lawful bases under the PDPA: performance of a contract or steps prior to entering a contract, our legitimate interests in operating and promoting our business, compliance with legal obligations, and your consent where required.

4. Cookies and analytics

We use Google Analytics to understand how visitors use our website. Google Analytics places cookies that collect usage data in aggregated form. You can disable cookies through your browser settings or use Google's opt-out tools. Essential preferences (such as language) stored locally on your device do not track you across sites.

5. How we share personal data

We do not sell personal data. We share personal data only with:

• Service providers that support our operations, such as cloud hosting, email delivery, and analytics providers, under appropriate data protection terms
• Professional advisers such as auditors and lawyers, where necessary
• Authorities where disclosure is required by law, court order, or regulatory request
• AI processing providers, namely Amazon Web Services (Amazon Bedrock), which processes your chat messages to generate the assistant's replies under data protection terms and without using them to train models
• Our team's conversation system, hosted by us, so that our team can see and continue conversations after the AI assistant

6. Client and project data

In the course of delivering consulting and platform services, we may process data on behalf of our clients under a service agreement. In those cases we act according to the terms of the relevant agreement, apply strict confidentiality, and maintain clear professional boundaries so each client's information remains protected at all times.

7. Data retention

We keep personal data only as long as necessary for the purposes described in this policy, to comply with legal obligations, or to establish and defend legal claims. When data is no longer needed, we delete it or anonymize it.

Conversations with the AI assistant by visitors who did not identify themselves are kept for 90 days from the last message; conversations of identified members are kept for 2 years. Contact details and leads are kept for the duration of the business relationship and no longer than 2 years after the last contact. Consent records and system logs are kept for 2 years. You can ask us to delete your data as described in section 10, and we act within 30 days.

8. International transfers

Some of our service providers may store or process data outside Thailand. Where this happens, we take reasonable steps to ensure an adequate level of protection consistent with the PDPA, including contractual safeguards with those providers.

Messages you send to the AI assistant may be processed temporarily in Amazon Web Services data centres outside Thailand (we select the Singapore region as the primary one, but the provider may route processing to other regions for availability). Messages are encrypted in transit, are not stored permanently by the provider, and are covered by the provider's data processing addendum (AWS Data Processing Addendum), whose standard contractual clauses are the safeguard under section 28 of the Personal Data Protection Act.

9. Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration. These include access controls, encryption in transit, and internal confidentiality practices.

10. Your rights

Under the PDPA, you have the right to:

• Access and request a copy of your personal data
• Correct inaccurate or incomplete data
• Request deletion or anonymization of your data
• Restrict or object to certain processing
• Request data portability
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with Thailand's Personal Data Protection Committee

To exercise any of these rights, contact us using the details below. We will respond within the period required by law.

11. Children

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. Significant changes will be communicated through the website.

13. Contact us

For questions about this policy or your personal data, contact:

Khaojai IT Co., Ltd.199 Column Tower Building, 15th Floor, Room 1512, Ratchadaphisek Road, Khlong Toei Subdistrict, Khlong Toei District, Bangkok 10110, ThailandEmail: inquiry@khaojai.aiTelephone: 02-123-3806