Delete your Gwak Gwak account

From the Privacy Policy, section 14

14. Your rights

Under the PDPA you have the right to access your data and get a copy, to have it corrected, to receive it in a machine-readable format or have it sent to someone else, to object to processing, to have it erased or made anonymous, to have its use restricted, to withdraw consent, and to complain to the Office of the Personal Data Protection Committee.

In the app you can change your name, add or confirm an email address or number, change where codes are sent, sign out everywhere and delete your account yourself. For anything else, send a request from the email address or number linked to the account to support@gwak-gwak.com.

In the app, delete your account from Settings or Profile, and prove it is you with a code sent to your email address or number, or by signing in with LINE, Google or Apple again. Without the app, go to https://gwakgwak.app/delete-account/ and enter your account’s email address or number: we send a code there, and the account is deleted when you enter it. Deletion takes effect at once and cannot be undone; there is no waiting period.

We may ask for information to confirm who you are before acting, and we answer within 30 days of receiving a request. If we refuse a request — for example because tax law requires bills to be kept — we will tell you why.

Deleting your account signs you out on every device at once, erases your email address, number, name, profile picture and sign-in details, and removes your LINE, Google and Apple links. Your name may remain where the shop’s bills and activity records copied it, because they are the shop’s evidence. The records of acceptance and of the deletion are kept as section 11 says.

In a shop where you are staff, or that has another owner, your access ends and the shop stays open. If you are a shop’s only owner, the shop account closes with your account, but only after you confirm it; to keep the shop open, make someone else an owner first. A closed shop’s data is handled as section 11 says, with no time to export it afterwards, so export what you need before you delete your account.

If you sign in with a staff account a shop created for you, that shop is the controller of the account’s details: ask the shop to see, correct or delete them, or to exercise your other rights over them; if you ask us instead, we pass the request on to the shop. In the app you can change your password and ask for your account to be deleted: the shop sees the request in the app, and if it has not deleted the account within 30 days, we delete it. Deleting a staff account ends its sessions and erases its name, username and password; the name on bills, shifts and the shop’s activity record stays, as section 11 says. For the sign-in and security records we hold as the controller, send your request through the shop or to support@gwak-gwak.com; a staff account has no email address or number, so we may ask the shop to confirm who you are.

If you sign in with Apple, deleting in the app asks you to confirm with Apple once more, and we then ask Apple to revoke Gwak Gwak’s access to your Apple ID. Deleting on the web page cannot do this: remove Gwak Gwak yourself in your Apple ID settings.

From the Privacy Policy, section 11

11. How long we keep data

One-time codes expire after 3 minutes and are deleted within an hour of expiring or being used. Sessions expire within 7 days unless renewed, and are deleted within 2 hours of expiring. Counts of wrong staff passwords expire within an hour. Temporary data the system uses to deliver codes and to stop duplicate requests is deleted within 14 days.

Your account data is kept while your account is open. When you delete your account under section 14, it is erased at once.

A staff account a shop creates is kept while the shop keeps it, including while it is switched off. It is deleted when the shop deletes it, or 30 days after the staff member asks in the app for it to be deleted if the shop has not deleted it by then. Deletion erases the account’s name, username, password and sessions at once; the name stays where bills, shifts and the shop’s activity record copied it, for as long as those are kept. The records of acceptance, sign-ins and security of a deleted staff account are kept as for any deleted account, below.

Shop data is kept while the shop account is open. If a shop account closes because its last owner deleted their account, there is no time to export its data. Within about a day its members’ details are erased, and suppliers’ phone numbers, the names called at the counter, products and their pictures, campaigns, staff accounts and the shop’s profile are deleted. Its bills, tax invoices, credit notes and the records behind them — orders, shifts, expenses, stock movements and the activity record — are kept, with no one able to sign in to see or change them, until 1 January of the sixth year after the year the shop closed, Thai time: a shop closed in 2026 keeps them until 1 January 2032. We then delete them, unless a tax audit or the law requires us to keep them longer.

If a shop account closes any other way, under section 18 of the Terms, the shop has 30 days to export its data, and we then delete it, or make it impossible to identify anyone from it, within 90 days, unless the law requires us to keep it longer.

Bills, tax invoices and credit notes are not deleted while the shop account is open, because the Revenue Code requires them to be kept for at least 5 years, extendable to 7. Photos attached to bills, shifts and expenses are deleted 5 years after the end of their record’s calendar year, whether or not the shop has closed. Your profile picture is kept until you replace it or delete your account; the earlier picture is deleted when you change it.

A shop account’s activity records, including IP addresses (except as described below for deleted accounts), are kept while the shop account is open, and after it closes for as long as its bills are kept. Access records (the time, IP address and request) are kept for 120 days, no shorter than the 90 days the Computer Crimes Act requires, and one person’s for longer only when a competent official orders it under that Act, for up to 2 years. Other server logs and crash reports are kept for 7 days, deployment logs for up to 90 days, system metrics for 30 days, and encrypted database backups for 14 days before they rotate out.

Records of acceptance (section 3), and the record that an account was deleted — when, through the app or the web page, and from which IP address — are kept while the account is open and for 10 years after it is deleted, so that the agreement can be proved if a claim arises. After the deletion they no longer carry your name, email address or number. Other access records of a deleted account — such as the time and IP address of sign-ins or of changes to sign-in methods — are kept for 1 year after the account is deleted, which is no shorter than the Computer Crimes Act requires, so that security incidents can be investigated, and are then deleted. Where a shop’s activity record shows something a deleted account did in that shop, the record stays with the shop for the period described above, but its IP address is removed 1 year after the account is deleted. We keep a record in this paragraph longer than stated only when a competent official orders it under the law, or where it is needed to establish, exercise or defend legal claims.

Data that is erased — a member a shop erases, an account you delete, or what a closed shop loses — leaves the live system as described above, and leaves the encrypted backups when they rotate out after 14 days.

From the Terms and Conditions, section 18

18. Suspension, ending the contract and your data afterwards

You may stop using the Service at any time: delete your account in the app, from Settings or Profile, or at https://gwakgwak.app/delete-account/, as section 14 of the Privacy policy explains, or ask us to close your shop account at support@gwak-gwak.com from the email address or number linked to the owner’s account. Deleting the app does not delete your account or close the shop account.

Deleting your account takes effect at once. If you are a shop’s only owner, its shop account closes with it once you confirm; if the shop has another owner, it stays open and only your access to it ends. A shop account closed this way has no export period, so export the data you need before deleting. Within about a day its members’ details, products, product pictures, staff accounts and shop profile are deleted, while its bills, tax invoices, credit notes and the records behind them are kept, with no one able to sign in to them, until 1 January of the sixth year after the year it closed, and then deleted, as section 11 of the Privacy policy says.

We may suspend all or part of your access at once where needed to prevent serious harm to the Service, other shops or other people, for unlawful use or a breach of section 9, or when an authority orders it. In other cases we will tell you why and give you at least 14 days to fix it before suspending. We lift a suspension once its cause is gone.

We may end the contract if you materially breach these Terms and do not fix it within 30 days of notice, or if we stop providing the Service altogether, with at least 60 days’ notice and a pro-rata refund of any fees paid in advance.

When the contract ends any other way, you have 30 days to export your shop data, or to ask us for a copy in a machine-readable file, whether or not your plan includes exports — unless it ended because of unlawful use. After that we delete your shop data, or make it impossible to identify anyone from it, within 90 days. Backup copies are deleted as the backup cycle rotates them out.

We may keep some data for as long as the law requires or as needed to establish, exercise or defend legal claims, such as evidence that you accepted these Terms and security logs.

Sections that by their nature must survive the end of the contract continue to apply, including sections 10, 11, 14 to 18, 20 and 21.