นโยบายความเป็นส่วนตัว

1Who we are and our role

The Xaze service (the xaze.ai website, Xaze Console and the API) is provided by BABEL LEGACY Co., Ltd. (company registration no. 0805569002211), 189/87 Zen Villa Village, Moo 4, Tha Sak Subdistrict, Mueang Nakhon Si Thammarat District, Nakhon Si Thammarat 80000, Thailand ("Xaze", "we"). Contact us about personal data at support@xaze.ai.

We are the data controller for the account data of stores and their team members. For the data of customers who message a store through a channel the store connects, the store is the data controller and we are its data processor, acting on the store's instructions and settings.

This policy describes our processing under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and Meta's requirements for apps that use Messenger and Instagram.

2Data we collect

What we hold depends on whether you are a store using Xaze or a customer chatting with a store.

• Store and team accounts: email, display name, password (stored only as a hash), roles and permissions in the store, and sign-in sessions.
• Data a store adds: store details, knowledge base, products, orders, reply persona, Flows and channel settings.
• Payments: amount, status and receipts for packages and credit. Card payments happen on Stripe's checkout pages; we never receive or store card numbers.
• A store's customers: messages and images they send, their user ID on each platform, the name and profile picture the platform provides, memory notes the AI summarises from the conversation for later replies, and orders created in chat.
• Payment slips: the slip image or QR data and the check result, which contain the payer's and payee's names and partly masked account numbers.
• Technical data: IP address and access logs, for security and abuse prevention.
• Cookies and browser storage: the Console uses cookies needed to sign in, a cookie for your chosen language and one that remembers a referral code when you open a referral link, and keeps preferences such as notification sounds in your browser. A store's website chat keeps its session token in that tab's sessionStorage. We use no advertising cookies or third-party trackers.

3Data from Facebook Messenger and Instagram

When a store connects a Facebook Page or an Instagram professional account to Xaze with Facebook Login for Business, we receive the following from Meta:

• Page and Instagram account details: Page ID, Page name, Instagram account ID and Instagram username.
• The Page access token Meta issues, stored encrypted and used only to receive and send that Page's or account's messages.
• The app-scoped user ID of the person who connected, and the permissions granted, used for Meta deauthorization and data deletion requests.
• Messages, images and attachments customers send to the store's Page or Instagram account, with the sender ID (PSID or IGSID) and the time sent.
• Customers' name, username and profile picture where Meta allows access. We copy the picture into private file storage because Meta's picture links expire.
• Replies the store's team sends from Meta Business Suite or the Instagram app, so the chat history in Xaze is complete.

The user access token obtained while connecting is used only to list the Pages the store can choose from and is not kept after the connection step expires (15 minutes).

We use Meta data only to provide the chat service the store has set up: showing messages in the Inbox, letting the AI answer from the store's knowledge base, handing conversations to the team and checking slips customers send. We do not sell this data, use it for advertising or marketing profiles, or use one store's data for another store.

Xaze sends messages within the windows Meta sets: the AI replies only within 24 hours of the customer's latest message, and Xaze sends no promotional messages to customers.

4How we use data

• To provide the service under our contract with the store: creating and verifying accounts, connecting channels, receiving and sending messages, AI drafts and replies, handoff to the team, slip checks and order handling.
• To charge for packages and usage-based credit and keep financial records as the law requires (contract and legal obligation).
• To keep the service secure, prevent spam, fraud and overuse, and investigate and fix problems (legitimate interests).
• To send emails an account needs, such as email verification, store invitations, password resets and notices that a channel must be reconnected.

For a store's customer data, the store decides the purposes and legal basis; we process it only to provide the service to the store, and we do not use conversations or store data to train AI models of our own.

5Service providers and disclosure

To generate replies we send the relevant messages, part of the chat history, knowledge from the store's knowledge base and images the customer sent (for that request only) to AI model providers through OpenRouter, using the models the store selects. The providers we use are:

• OpenRouter and the model providers the store selects: AI replies and knowledge-base indexing.
• Cloudflare: private image storage (R2) with no public links, and bot protection at sign-up (Turnstile).
• HippoPay: payment slip verification.
• Stripe: payments and receipts.
• Resend: system emails.
• Railway: servers and databases for the service.
• Meta, LINE and Telegram: the messaging platforms of the channels a store connects, each under its own privacy policy.

Some providers process data outside Thailand: the service's servers and databases are in Singapore (Railway), and Cloudflare, OpenRouter and the AI model providers, Stripe and Resend may process data in the United States or other countries. Details and safeguards are in the next section.

We do not sell personal data. We disclose it only when needed to provide the service above, when the store instructs us, or when the law or a competent authority requires it.

6Transfers abroad

Xaze serves stores in Thailand, but personal data is stored and processed outside Thailand as follows:

• Singapore: the service's servers, main database, knowledge-base search database and queues run in Railway's data centre in Singapore. Account data, messages, chat history, memory, orders and the channels' tokens (encrypted) are stored there.
• Cloudflare: images are kept privately in R2, for which we have not set a storage country, so they may be held in data centres outside Thailand. The website and the Console run on Cloudflare's network, which receives requests in a data centre near the user.
• OpenRouter and AI model providers: the data used to generate replies is sent to OpenRouter in the United States and to the model providers the store selects, which may be in the United States or other countries.
• Stripe, Resend and HippoPay: payment data, system emails and slip data are processed in the countries where each provider runs its systems, which may be outside Thailand.
• Meta, LINE and Telegram: messages sent through these platforms are processed by the platform under its own terms and privacy policy.

Destination countries may have data protection standards different from Thailand's. We transfer data abroad only as needed to provide the service under our contract with the store, and protect it with these measures: providers bound by their service terms and data protection terms, encrypted connections to providers, encrypted storage of channel tokens, private image storage with no public links, and access limited to each store and its users' permissions.

For more about transfers abroad, contact support@xaze.ai.

7How long we keep data

• Customers' conversations, images, memory and profiles: kept while the store uses that channel. When the store deletes the channel, intake stops at once, and these customer data and the channel's token are erased within 7 days.
• Names and account numbers in slip results: removed automatically after 30 days; only the amount, time, check results and transaction ID remain.
• Webhook data received from Meta before it is routed to each store: deleted within 3 days after processing, or 7 days if it cannot be passed to a store.
• Page access tokens: deleted when the store deletes the channel. When the person who connected removes the app in Facebook, we stop using that token immediately.
• Store accounts and payment history: kept for the life of the account; financial records for the period accounting and tax law requires.
• Backups: deleted data may remain in backups for up to 30 days before the backups are deleted or overwritten; until then we use backups only to restore the service.

8Your rights

Under the PDPA you have the right to:

• access your personal data and obtain a copy;
• have inaccurate or incomplete data corrected;
• have your data deleted, destroyed or anonymised;
• object to, or restrict, the use of your data;
• receive your data, or have it sent to another controller;
• withdraw consent where processing relies on consent;
• complain to the Office of the Personal Data Protection Committee.

Send requests to support@xaze.ai. We verify the requester's identity and answer within the time the law sets.

If you are a customer who chatted with a store, the store is the controller of your data: contact the store directly, or contact us and we will coordinate with the store. Step-by-step deletion options are on the data deletion page.

9Security

• Each store's data is isolated in the database with row-level security.
• Channel tokens are stored encrypted; passwords are stored as hashes.
• Images are kept in private file storage with no public links and can be viewed only by people with access to the store.
• Store members see data according to the roles and permissions the owner sets, and all connections use HTTPS.

10Changes to this policy

When we update this policy, the date at the top of the page changes. We tell stores about material changes by email or in the Console before they take effect.

11Contact us

BABEL LEGACY Co., Ltd. (company registration no. 0805569002211), 189/87 Zen Villa Village, Moo 4, Tha Sak Subdistrict, Mueang Nakhon Si Thammarat District, Nakhon Si Thammarat 80000, Thailand. Email: support@xaze.ai