Privacy Policy

1. Our role in relation to your data

EazyChat is a tool businesses use to serve their own customers, so we act in two distinct roles with different legal obligations.

Data controller

For subscriber account data — contact name, email, business name, billing details and system usage data. We determine the purposes for this data ourselves.

Data processor

For messages and end-customer data flowing through your workspace. You are the controller of that data; we process it only on your instructions and never for other purposes.

2. What we collect

We only ask for what the service needs (data minimization). Signing up requires no phone number, address or identity documents.

• Account data: contact name, email, business or store name, and your password (stored as a one-way hash — we cannot read it)
• Usage data: sign-in records, settings, message volume and AI usage, used for billing and system operation
• Billing data: invoices and payment history. Full card numbers stay with our compliant payment provider; we do not store them
• Service data: messages from the chat channels you connect, the knowledge base you build, and conversation history (here we act as processor per section 1)
• Technical data: IP address, device and browser type, for security and troubleshooting

3. Legal bases and purposes

We do not sell your personal data, and we do not use your end-customers' messages to train AI models for our own general purposes.

Performance of a contract

Creating and maintaining your account, delivering your plan, billing, and service-related contact

Legitimate interest

Securing the system, preventing misuse, investigating technical issues, and improving service quality

Consent

Marketing news and promotions — entirely optional, and you may withdraw consent at any time without affecting your service

Legal obligation

Tax and accounting records, and compliance with lawful requests

4. Disclosure and third-party providers

To deliver the service we rely on a limited set of providers, disclosing only what is necessary and under data processing agreements.

• Cloud infrastructure providers, for storage and processing
• AI model providers, for generating answers — receiving only the text needed to answer that question
• Payment providers, for collecting subscription fees
• Chat channel providers you connect yourself (LINE, Meta, WhatsApp, Telegram), which are also governed by their own policies
• Google reCAPTCHA on the signup page, to screen out automated signups — Google may collect device and interaction data from that page under its own policy
• Google Analytics, to measure site usage in aggregate — active only with your consent
• Pusher, the Cloudflare CDN and Google Fonts — assets for the chat box on this website

5. International data transfers

Some cloud and AI model providers operate servers outside Thailand, so delivering the service may involve transferring data abroad.

Where that happens, we put appropriate safeguards in place as required by the PDPA — such as standard contractual clauses, or transferring only to jurisdictions with adequate protection standards.

If you have specific data residency requirements, contact us to discuss a suitable deployment arrangement.

6. Data retention

• Account and usage data: retained while your account remains active
• After account closure: deleted or anonymised within the period set out in your service agreement, unless the law requires longer retention
• Tax and accounting records: retained for the period required by law
• End-customer conversation data: the system is designed for unlimited searchable history; retention and deletion follow your instructions and your service agreement

7. Your rights as a data subject

Under the PDPA you have the following rights. Contact us using the details below to exercise them, and we will respond within the statutory period.

• Right of access, and to obtain a copy of your personal data
• Right to rectification of inaccurate or outdated data
• Right to erasure where retention is no longer necessary
• Right to restrict processing
• Right to data portability to another controller
• Right to object to collection, use or disclosure
• Right to withdraw consent at any time
• Right to lodge a complaint with the Personal Data Protection Committee if you believe we are not complying with the law

8. Security measures

No system is perfectly secure. If a personal data breach occurs that poses a risk to individuals' rights and freedoms, we will notify as required by the PDPA.

• Encryption of data in transit, and passwords stored in an irreversible form
• Data separated per brand and store
• Role-based access control, with audit logging of significant actions
• Staff access to subscriber data limited to what is necessary for operating the system and resolving issues

9. Cookies

This website uses Google Analytics to measure which pages are useful and where visitors arrive from. It runs only after you accept in the cookie settings bar; before that, no cookie is set for this purpose.

We never send your name, email or anything that identifies you to Google Analytics, and we do not use cookies for targeted advertising.

The one exception is the signup page, which uses Google reCAPTCHA to screen out automated signups. Google may set its own cookies and collect device information for that purpose. We use it because it is necessary for the security of the service, not for advertising or marketing measurement, and it does not appear on any other page.

The only cookie we set records the choice you make in the cookie settings bar, so we do not have to ask again — it is necessary to honour your consent.

This site carries our own chat box in the lower-right corner. It keeps your conversation in the browser's local storage so the thread survives a reload — necessary to provide the chat itself, not advertising tracking, and cleared by clearing site data.

That chat box loads assets from third parties: Pusher (realtime messaging), the Cloudflare CDN (icons) and Google Fonts (typefaces). Those providers see your IP address to the extent needed to serve those files.

If we later introduce analytics or marketing cookies, we will always ask for your consent first, and you can change your choice at any time from the "Cookie settings" link in the footer.

10. Children's data

EazyChat is a business service and is not designed for minors to subscribe directly. If you believe a minor's data has been provided without valid consent, please contact us so we can delete it.

11. Changes to this policy

We may update this policy as the service or legal requirements change; the effective date always appears at the top of this document.

Where a change materially affects your rights, we will give advance notice through an appropriate channel.

12. Contact

Data controller: Fullteam Co., Ltd.

Address: Assawin Asset Tower, 5th Fl., 111 Moo 1, Om Kret, Pak Kret District, Nonthaburi 11120

Personal data enquiries: contact@fullteam.tech

Telephone: 02 502 0211