Data Protection & PDPA Compliance
How we protect your personal data across ContentVelo and ChatMai platforms, in compliance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and Shopee Open Platform requirements.
Data Controller Information
The data controller responsible for personal data processed through ContentVelo (AI content creation for Facebook) and ChatMai (unified messaging inbox) is:
NB Digital Co., LTD.
10 Soi Inthamara 18, Ratchadaphisek, Din Daeng, Bangkok 10400, Thailand (head office) · Taxpayer identification number 0105568176336
Email: [email protected]
Data Protection Officer: [email protected]
Legal Basis for Processing (PDPA)
Under Thailand's PDPA, we process personal data based on the following lawful grounds:
- Consent — You explicitly agree to data processing when creating an account, connecting social platforms, or authorizing Shopee/Facebook integrations.
- Contractual Necessity — Processing required to deliver ContentVelo and ChatMai services you have subscribed to.
- Legitimate Interest — Analytics, service improvement, and fraud prevention where your rights are not overridden.
- Legal Obligation — Compliance with Thai law, tax regulations, and platform partner requirements.
Data We Collect by Platform
We collect and process different categories of data depending on the platform you use:
| Platform | Data Categories | Purpose |
|---|---|---|
| ContentVelo | Facebook page tokens, AI-generated content, post analytics, user profile (name, email), billing information | AI content creation, scheduling, publishing to Facebook, usage analytics |
| ChatMai | Platform conversations (Shopee, LINE, Facebook Messenger), order context, buyer/sender identifiers, team collaboration data | Unified inbox messaging, AI auto-reply suggestions, conversation analytics |
What You Must Provide, and What Happens If You Do Not
Section 23(2) of the PDPA requires this notice to say where providing personal data is required by law or by a contract, or is necessary in order to enter into one, and what the effect of not providing it is. No Thai law obliges you to give ContentVelo anything: what makes the first rows below unavoidable is the agreement between us, not the Act. The table is written from the code that does the refusing, and it says which refusals are real ones — a form that will not submit, a screen that does not draw, a scheduled post marked failed — and which are only a worse result.
| What we ask for | Do you have to? | If you do not give it |
|---|---|---|
| Your email address | Required by the contract | There is no account without it. It is the name you sign in under, the only address a password reset can be sent to, and the one piece of you the payment provider receives. The registration form refuses to submit while it is empty, and the address has to be unique: a second account cannot be opened on the same one. |
| A password | Required if you register with an email address | The form refuses anything shorter than eight characters, or missing an upper-case letter, a lower-case letter, a digit or one other character, and the server applies the same four rules again before the account is created. Sign in with Google, Facebook or LINE instead and you are never asked for one — the product makes a random password you never see, and you can set a real one later from Settings if you want to. |
| Confirming your email address | Required before your first sign-in | An account registered with an email address and a password cannot sign in at all until the link we email is clicked. Not to billing, not to anything: the check sits in front of the whole product. The link lasts 24 hours and can be sent again after a minute's wait. An account opened through Google, Facebook or LINE never meets this step, because the provider has already confirmed the address. |
| Your name, and a name for your workspace | Required on the registration form, and never checked again | The form refuses to submit while either is empty or shorter than two characters, and no account is created. After that nothing enforces them: you can clear your name in Settings and every part of the product carries on working. They label your account and address you in email; nothing depends on either being true. |
| Agreeing to the Terms | Required | The form will not submit, and the server refuses the registration a second time if the box is somehow unticked. There is no way into the product without it. We record the date and time you agreed, and that record is what the agreement rests on. |
| A Facebook Page you administer | Not required for an account; required for the product to do anything | You can register, sign in and look around without one, and nothing else works. The writing screen stops at the page picker and does not draw the form at all; the AutoPilot screen is replaced end to end by an invitation to connect a Page; publishing refuses with a missing-token error; and a scheduled post whose Page has gone is marked failed rather than retried. If the Facebook account you sign in with administers no Page, the connection cannot even complete — Facebook returns an empty list and we send you back with an error. |
| A business type, and a description of your business of at least ten characters | Required to finish setting up a connected Page | These two are the only fields in page setup that are enforced, and the step will not save without them. Until a Page is set up, AutoPilot refuses that Page outright and the quick templates refuse to run. Ordinary writing still works and is still charged, but worse: the instruction sent to OpenAI carries no description of your business at all, so what comes back is generic, and the image brief goes out with no tone on it. |
| The rest of the brand profile — tone, audience, keywords, topics to avoid, colours, what you sell | Optional, every field of it | Each field is skipped on its own when it is empty. Tone falls back to friendly and language style to conversational, and the rest is simply absent from the instruction we send. Nothing refuses, nothing costs more, and nothing tells you off. The posts are only less like you. |
| The contact details you want to appear in posts — telephone number, email address, LINE ID, website, shop links | Optional | Leave them empty and they are never sent to OpenAI and never appear anywhere: the post is written with no call to action, and the instruction tells the model not to invent one. Fill them in and they go out with every instruction, which is what the recipients section of this notice describes. |
| A linked LINE account | Optional | Without one no LINE message is ever sent to you — the code stops at the missing account identifier before it builds anything — and the "ask me before posting" switch on the AutoPilot screen is shown greyed out with the reason beside it rather than hidden. Nothing else changes, and you can unlink at any time in Settings. |
| A telephone number, a postal address, a company name, a tax or VAT number, a date of birth, an identity document | Never asked for | Not one of these exists as a field anywhere in ContentVelo: not at registration, not in Settings, not at checkout, not for a paid plan. There is nothing here for you to withhold and nothing for us to lose. If anybody asks you for one of them in our name, it is not us. |
| Your IP address and the identification your browser sends | Not asked for, and not refusable while you use the product | Your address is read when you register, to limit how many accounts can be opened from one place, and it is written together with your browser's identification into the audit log of what is done in your account. These are not boxes you can leave empty: the only way not to give them is not to use the product. |
One obligation in this notice runs the other way, and it is ours rather than yours: once you have paid us, Thai accounting law requires us to keep the accounting record of that payment for five years, so deleting your account does not delete it. You are taken out of the record instead of the record being taken out. Our data deletion page says exactly what survives and what is erased from it. Everything else above is either the agreement you entered into, or a box you are free to leave empty.
Data Protection Measures
We implement comprehensive technical and organizational measures to protect your data across both platforms:
Technical Measures
- HTTPS on every request, with plain HTTP redirected and HSTS sent in production. The TLS versions offered are a property of our hosting, not of the application
- No application-level encryption at rest: API tokens and content are stored in readable form, protected by the database server and the hosting
- Anti-forgery tokens on requests that change your account, and session cookies that browsers will not expose to scripts or send to other sites
- Every commit is built and the test suite run automatically. We do not run automated vulnerability scanning or scheduled dependency audits
Organizational Measures
- Role-Based Access Control (RBAC) for production systems
- Mandatory data protection training for all personnel
- Principle of least privilege for all system accounts
- Audit logging of actions taken in an account, with the user, the time, the IP address and the browser
Data Retention Policy
We retain personal data only as long as necessary. Retention periods vary by data type and platform requirements:
| Data Type | Retention Period | Post-Expiry Action |
|---|---|---|
| Account data | Until account deletion | Deleted from our database immediately on confirmation |
| AI-generated content | Until user deletes | Deleted from our database; image files on our image host remain |
| Shopee/platform messages | Maximum 90 days | Secure deletion per NIST SP 800-88 |
| API access tokens | Until revoked or expired | Our copy is deleted when you disconnect; we do not call the platform to revoke it |
Your Rights Under PDPA
As a data subject under Thailand's PDPA, you have the following rights regarding your personal data:
Request a copy of all personal data we hold about you across both platforms.
Correct inaccurate or incomplete personal data in your account.
Request deletion of your personal data. Deleting your account in Settings removes it from our database immediately, with no grace period; ask us instead and we will confirm in writing when it is done.
Object to data processing based on legitimate interest.
Receive your data in a structured, machine-readable format.
Withdraw consent at any time. Disconnect platforms from settings.
Ask us to stop using your personal data while keeping it, under section 34. What this product can actually do about that is written out below the grid.
Take a complaint about how we handle your data to the Personal Data Protection Committee, under section 73. The filing-complaints section of this notice says where.
Restriction, in practice. There is no switch in ContentVelo that suspends an account and keeps its data: the user record carries an active flag, and no screen in the product ever turns it off. What exists instead are three real controls, and between them they stop most of what this product does with your data. Disconnecting your Pages in Settings clears the connected flag on each one and deletes our copy of its access token, while leaving your posts, your products and your settings alone — after that nothing is published and nothing is read back from Facebook. Turning AutoPilot off stops anything new being generated, though a post already scheduled still goes out at its time. Deleting your account removes the data rather than restricting it, which is the other right, and it cannot be undone. If what you need under section 34 is none of those three — holding data still while a dispute about its accuracy is settled, for instance — write to the Data Protection Officer and we will do it by hand and confirm in writing what was done. We would rather tell you that than describe a feature we have not built.
To exercise your rights, contact our Data Protection Officer at [email protected] or use the Privacy Contact form. For Shopee-specific data, you can also revoke access through Shopee Seller Centre.
Who Receives Your Personal Data
Section 23(4) of the PDPA requires us to tell you the categories of person or entity your personal data may be disclosed to. Below is every category ContentVelo has, with the companies named wherever the product's own code names them. This is the whole list: we do not sell personal data, and no data broker receives anything from us. The only advertising network is Meta, and only as the "Advertising measurement" row describes: on ChatMai's public introduction page, after the visitor allows it.
| Category of recipient | Who is in it | What reaches them |
|---|---|---|
| AI providers | OpenAI (United States); Google, through the Gemini API | The instruction used to write a post or draw an image, which carries your business description, your tone and keyword settings and — where you have entered them — the telephone number, email address, LINE ID, website and shop links you want to appear in posts. When you ask us to learn a Page's style, up to twenty of that Page's existing posts go with it. Google also receives any reference image you upload, and receives each finished image back again to be marked for quality. |
| The platforms you connect | Meta, through the Facebook Graph API; LINE, through the Messaging API | Meta receives the text and the images we publish to the Page you connected, sent with that Page's own access token, and returns that Page's posts, their figures and the names of people who comment. LINE receives the notification and the address of the image when you have linked a LINE account to be told about posts. |
| Sign-in providers, if you use one | Google, Meta (Facebook) and LINE | Choosing one of these to sign in tells that provider you are signing in to ContentVelo. It returns your name, your email address and your profile picture, which become your account. Signing in with an email address and a password sends them nothing. |
| Payment provider | PaySolutions, whose payment page is at thaiepay.com | Your email address, our order reference, the description of what you are buying and the amount. Your card details are typed on the provider's own page and never reach ContentVelo, and we do not send it your name. A second provider is built into our payment service and is not in use: no payment is routed to it today, and if that changes this page changes with it. |
| Image hosting | Our image host, a separate server at storage-server.rayoutdesign.com | Every image generated for you and every image you upload. The files are served from a public web address that is not guessable but is not access-controlled either, and deleting your account does not remove them. |
| Outbound email | Google: our mail is relayed through Gmail's SMTP server | Your email address and the whole content of the message, whenever we send you a verification link, a password reset, a purchase confirmation or a reply to a support ticket. |
| Website analytics, and only if you accept them | Google Analytics (Google LLC) | Which pages you open on our public website, roughly where you are, and what browser you use. The tag is fetched only after you press Accept All in the cookie notice; until then nothing is fetched and no analytics cookie is set. The signed-in application does not load it at all. |
| Files your browser fetches to draw our pages | Google Fonts; the Tailwind CSS content delivery network; and Gravatar, for the placeholder picture shown while you have no profile picture | None of your account data. But your browser asks these companies for a typeface, a stylesheet and an image on every page load, and the asking itself tells them your IP address, which page you are on and what browser you are using. It happens before you are asked anything, and in the signed-in application as well as on the public site. Moving those files onto our own servers is work we have not done. |
| Hosting, and the network in front of it | Our hosting supplier, and any content delivery network our domains are routed through. This application names neither. | Everything ContentVelo keeps, because it sits on servers we rent; and every request, because every request crosses that network. The application adds no encryption of its own, so whoever operates those servers can read what is on them. Ask us and we will tell you who they are at the time you ask. |
| ChatMai, our other product | The same company named in section 1, running a second application | Moving between ContentVelo and ChatMai is not a disclosure to anyone else: the controller does not change. It is done with a single-use token written to our own database and read back from it, not with a message sent to another company. |
| Courts, regulators and law enforcement | Named only if and when it happens | Whatever we are lawfully required to disclose, and nothing beyond it. No part of the product sends personal data to any authority automatically. |
| Advertising measurement | Meta Platforms (Meta pixel and Conversions API) | Only after a visitor of ChatMai's public introduction page (chatmai.contentvelo.com/start) presses Allow on ChatMai's advertising-measurement notice: that page visit and a click on Start free, with Meta's own browser cookies (set for the contentvelo.com domain), and, if the same browser then creates a ChatMai workspace, a signal that a workspace was created, with the device's IP address, browser details and a code that does not reveal which workspace. Never a name, email address, conversation or workspace content. Without that consent nothing is sent, and it can be withdrawn at any time on that page. Meta uses what it receives under its own terms. |
We do not sell personal data to any of the companies above, and none of them is given it in order to advertise to you. What each of them keeps afterwards is governed by its own policy and not by ours: we can tell you what we send and when we stop sending it, and no more than that. Most of them are outside Thailand, which is what the next section is about.
International Data Transfers
Your data may be transferred to and processed in countries outside Thailand for the following purposes:
- AI processing via OpenAI (USA) and Google Gemini — content generation only, no personal data stored by AI providers
- Application hosting and image storage provided by third-party infrastructure suppliers
- All transfers are protected by adequate safeguards as required by PDPA Section 28
Data Breach Response
In the event of a security incident affecting personal data, we follow a strict breach response protocol:
- Immediate containment — affected systems isolated within 1 hour, and our copy of every access token deleted. We cannot revoke a grant at Facebook or LINE; we tell you at once which Pages are affected and how to remove the permission there.
- Platform notification — Shopee and affected platform security teams notified within 24 hours.
- Regulatory notification — PDPC notified within 72 hours as required by PDPA.
- User notification — All affected users informed without delay with breach scope and remediation steps.
Shopee Open Platform Data Protection
This section sets out how ChatMai handles any data it receives through the Shopee Open Platform APIs, in compliance with Shopee's Platform Partner Rules and Data Protection Policy.
Shopee Data Categories
| Category | Specific Data | Purpose |
|---|---|---|
| Shop Info | Shop ID, shop name, authorized user ID | Identify and authenticate seller shops in ChatMai |
| Conversations | Chat messages between sellers and buyers, timestamps | Display conversations in unified inbox, enable replies |
| Order Info | Order ID, status, tracking number | Show order context alongside customer conversations |
| Buyer Info | Buyer username, buyer ID (as provided by Shopee API only) | Identify buyers in conversations; never used for direct contact |
Shopee Data Retention (90-Day Maximum)
In strict compliance with Shopee Open Platform policies, all Shopee data is retained for a maximum of 90 days:
- Conversation messages and buyer data: permanently deleted after 90 days via secure deletion
- Order references: purged after 90 days, only anonymized metrics retained
- Sellers can trigger immediate deletion by disconnecting their Shopee shop from ChatMai
Secure Data Disposal
- Electronic records overwritten using cryptographic erasure per NIST SP 800-88 guidelines
- Database records permanently deleted with transaction logs verifying removal
- Backup copies rotated out within 90 days — no Shopee data persists beyond this window
Strict Prohibitions
We never use Shopee data to: contact buyers outside Shopee messaging, sell or share data with third parties, build buyer profiles for advertising, or for any purpose not authorized by Shopee's Terms of Service.
Security & Compliance
We implement comprehensive security measures across both ContentVelo and ChatMai to protect your data at every layer of our infrastructure.
Data Handling
- Tokens and credentials are stored in readable form — the application adds no encryption of its own
- Minimal data collection — we only store what is necessary
- Every query is scoped to your workspace by the application; customers are not on separate databases
Token Security
- OAuth 2.0 for all platform connections (Facebook, Shopee, LINE)
- A short-lived Facebook token is exchanged once for a long-lived one when you connect. There is no automatic rotation afterwards
- Disconnect a platform at any time in your settings; withdraw the permission itself in that platform's own settings
Audit & Monitoring
- Complete history of all content and publishing actions
- Detailed access logs with user, timestamp, and action type
- There is no self-service export of audit records today; they can be requested under your right of access
Compliance Status
Filing Complaints
If you believe your data protection rights have been violated, you may file a complaint with us first, or directly with the regulatory authority:
Personal Data Protection Committee (PDPC)
You have the right to lodge a complaint with the PDPC if you believe we have violated your rights under the Personal Data Protection Act B.E. 2562.
Contact Us
For any questions about this Data Protection Policy, your rights, or how we handle your data: