Privacy Policy
Privacy Policy · Last updated 2 August 2026
- We have no advertising trackers, no Google Analytics, no Facebook Pixel — no tracking SDKs at all
- We do not sell your personal data and do not share it with advertisers
- We do not store credit-card numbers — all payments are made on Stripe's own pages
- Passwords are stored as a hash (PBKDF2, 100,000 rounds) — even we cannot read your password
- The messages you send to the AI and the images you upload are sent for processing to AI providers located outside Thailand — see section 4
- You can delete your own account and data at /account/delete
1. Data Controller and Scope
- Data Controller: Kaokla Home Co., Ltd. (บริษัท ก้าวกล้าโฮม จำกัด) — company registration no. 0455569001588
- Contact address: บ้านเลขที่ 311 หมู่ที่ 13 ตำบลรอบเมือง อำเภอเมืองร้อยเอ็ด จังหวัดร้อยเอ็ด 45000
- Personal-data contact: [email protected]
This policy applies to the website www.kaoklahome.com, our mobile applications, and all related services (the "Service"). It is prepared in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).
2. Information We Collect
| Category | Data | When collected |
|---|---|---|
| Account data | Email, hashed password, Google user ID (if you sign in with Google) | When you register |
| Usage data | Last login time, number of AI tokens used, number of images generated, subscription status | While using the Service |
| Content you create | AI conversations, the numbers/conditions you enter in the calculators, projects and task lists, images you upload | When you use that feature |
| Payment data | Stripe customer ID and subscription ID, status and billing cycle — no credit-card numbers | When you subscribe to a plan |
| Contact data (Leads) | Name, contact channel, budget, area, message, and the sender's IP address | When someone submits the contact form on a shared project page |
| Security logs | IP address (used to rate-limit logins/registrations to prevent attacks) | Temporarily only (a few minutes) |
We do not request access to your device's camera or microphone — image uploads use only the standard file picker, with files you select yourself.
3. Purposes and Legal Bases
| We use data to | Legal basis (PDPA s.24) |
|---|---|
| Create and maintain your account so you can access the services you subscribed to | Performance of a contract |
| Process the calculation requests and questions you submit to the AI | Performance of a contract |
| Collect payment and manage subscriptions | Performance of a contract |
| Send identity-verification and password-reset emails | Performance of a contract |
| Prevent misuse, rate-limit requests, and monitor security | Legitimate interest |
| Keep accounting and tax records | Compliance with the law |
4. AI and Content You Submit
Our AI services work by sending your data for processing to external model providers located outside Thailand:
- The text you type to the AI, including the engineering numbers and conditions you provide → sent via OpenRouter to the DeepSeek model
- The house/room images you upload for the AI to generate images → sent via OpenRouter to the FLUX (Black Forest Labs) model
- Document/drawing images used with the text-reading feature (restricted to administrators) → sent via OpenRouter to Google Gemini
We send only the content necessary for processing — we do not attach your email or user ID.
Recommendation: Do not type trade secrets, other people's personal data, or information you are obliged to keep confidential into the AI chat box.
We keep conversations in our system so you can review your history. You can delete your own conversations at any time from within the app.
We cannot control how long those model providers retain request logs — please also refer to each provider's own policy.
5. Disclosure to Third Parties
We do not sell or rent your personal data. We disclose it, only as necessary, to the following data processors:
| Recipient | Role | Data sent |
|---|---|---|
| Cloudflare | Web hosting, database, and network | All data stored in the Service |
| OpenRouter | Intermediary for calling AI models | Chat content, uploaded images (see section 4) |
| DeepSeek / Black Forest Labs / Google (Gemini) | AI model providers | Content sent via OpenRouter |
| Stripe | Payment processing | Email, internal reference ID — card numbers are entered on Stripe's own pages directly |
| Resend | Sending system emails | Recipient email and the content of verification/password-reset emails |
| Google account sign-in (only if you choose to use it) | The data Google returns: email, user ID |
We may also disclose data where required by law, or where necessary to protect rights, safety, and property.
6. Cross-Border Data Transfers
The providers above have servers outside the Kingdom, so your data is transferred and processed abroad, where data-protection standards may differ from Thailand's (PDPA s.28). By continuing to use the Service you acknowledge this. We choose providers with reasonably appropriate data-protection measures.
7. Data Retention Periods
| Data | How long we keep it |
|---|---|
| Your account and content | For as long as the account is active, until you delete it |
| Data after you request account deletion | Permanently deleted within 30 days (recoverable during this period, see section 8) |
| Accounting/tax records | Kept as required by Thai law, even after you delete your account |
| IP for rate-limiting | A few minutes |
| IP in contact data (leads) | Deleted together with that contact record |
8. Account and Data Deletion
Works from both the app and the web — you can still request deletion even after uninstalling the app.
When you request account deletion:
- The account is closed immediately (you can no longer access the tools) and the subscription is cancelled immediately (no charge for the next cycle)
- We wait 30 days before permanent deletion — during this time you can restore your account by logging in and clicking the "Restore my account" button at /account/delete (to guard against accidental clicks or impersonation) — we do not automatically cancel the deletion for you, because your deletion request must be respected
- After restoring your account you must subscribe to a new plan, because the subscription was cancelled at the time you requested deletion
- Once 30 days have passed, the system permanently deletes: account data, all AI conversations, calculation history, projects and images, contact data linked to you (including IPs), and usage-quota data
- Exception: Accounting and tax records that the law requires us to keep, and records necessary for fraud prevention, are retained for as long as the law requires
- Data previously sent to AI providers is subject to those providers' own log-retention policies, which we cannot delete on your behalf
If you want to delete only part of your data, you can delete individual conversations and projects yourself from within the app without deleting your account.
9. Your Rights Under PDPA
You have the following rights, which you can exercise by contacting [email protected] — we will respond within 30 days:
- Right of access — request a copy of your data
- Right to rectification — keep your data accurate and up to date
- Right to erasure — delete your data (you can do this yourself at /account/delete)
- Right to restrict processing — have us temporarily stop using your data
- Right to object — object to certain types of processing
- Right to data portability — request your data in a machine-readable format
- Right to withdraw consent — withdraw at any time, without affecting processing already carried out
- Right to complain — you may lodge a complaint with the Personal Data Protection Committee (PDPC) office
10. Cookies
We use only cookies strictly necessary for the Service to work — no advertising or tracking cookies:
| Name | Purpose | Lifetime |
|---|---|---|
kh_truss_session | Remembers that you are logged in (digitally signed, HttpOnly, Secure) | 8 hours |
kh_google_state | Prevents request forgery during Google sign-in | 10 minutes |
11. Security
- Passwords are stored as a hash using PBKDF2-HMAC-SHA256, 100,000 rounds, with a per-account salt — the actual password is never stored
- Email-verification and password-reset tokens are stored only as hashes
- Session cookies are digitally signed and set with HttpOnly / Secure / SameSite
- All connections are encrypted with HTTPS
- Login and registration attempts are rate-limited to prevent password guessing
Although we use reasonable measures, no system is 100% secure — please use a password that you do not reuse on other services.
12. Minors
This Service is designed for professionals and adults. We do not aim to collect data from persons under 20 years of age. If we learn that a minor's data has been collected without the parental consent required by law, we will delete it.
13. Changes to This Policy
If we make material changes, we will notify you via the website or email and update the date below. Continued use of the Service after a change means you acknowledge the new version of the policy.
Last updated: 2 August 2026 · See the Terms of Service