Shopee Open Platform Data Protection
This section sets out how ChatMai handles any data it receives through the Shopee Open Platform APIs, in compliance with Shopee's Platform Partner Rules and Data Protection Policy.
Data Controller Information
The data controller responsible for personal data processed through ContentVelo (AI content creation for Facebook) and ChatMai (unified messaging inbox) is:
NB Digital Co., LTD.
10 Soi Inthamara 18, Ratchadaphisek, Din Daeng, Bangkok 10400, Thailand (head office) · Taxpayer identification number 0105568176336
Email: [email protected]
Data Protection Officer: [email protected]
Data Protection Measures
We implement comprehensive technical and organizational measures to protect your data across both platforms:
Technical Measures
- HTTPS on every request, with plain HTTP redirected and HSTS sent in production. The TLS versions offered are a property of our hosting, not of the application
- No application-level encryption at rest: API tokens and content are stored in readable form, protected by the database server and the hosting
- Anti-forgery tokens on requests that change your account, and session cookies that browsers will not expose to scripts or send to other sites
- Every commit is built and the test suite run automatically. We do not run automated vulnerability scanning or scheduled dependency audits
Organizational Measures
- Role-Based Access Control (RBAC) for production systems
- Mandatory data protection training for all personnel
- Principle of least privilege for all system accounts
- Audit logging of actions taken in an account, with the user, the time, the IP address and the browser
Shopee Platform Data
Shopee Data Categories
| Category | Specific Data | Purpose |
|---|---|---|
| Shop Info | Shop ID, shop name, authorized user ID | Identify and authenticate seller shops in ChatMai |
| Conversations | Chat messages between sellers and buyers, timestamps | Display conversations in unified inbox, enable replies |
| Order Info | Order ID, status, tracking number | Show order context alongside customer conversations |
| Buyer Info | Buyer username, buyer ID (as provided by Shopee API only) | Identify buyers in conversations; never used for direct contact |
Shopee Data Retention (90-Day Maximum)
In strict compliance with Shopee Open Platform policies, all Shopee data is retained for a maximum of 90 days:
- Conversation messages and buyer data: permanently deleted after 90 days via secure deletion
- Order references: purged after 90 days, only anonymized metrics retained
- Sellers can trigger immediate deletion by disconnecting their Shopee shop from ChatMai
Secure Data Disposal
- Electronic records overwritten using cryptographic erasure per NIST SP 800-88 guidelines
- Database records permanently deleted with transaction logs verifying removal
- Backup copies rotated out within 90 days — no Shopee data persists beyond this window
Strict Prohibitions
We never use Shopee data to: contact buyers outside Shopee messaging, sell or share data with third parties, build buyer profiles for advertising, or for any purpose not authorized by Shopee's Terms of Service.
Contact Us
For any questions about this Data Protection Policy, your rights, or how we handle your data: