Privacy policy

1. Who this policy is for

This policy explains how we collect, use and disclose the personal data of shop owners, staff and everyone else who uses the Gwak Gwak app and its related services, under the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”).

For that data we are the data controller. For the customer data a shop records — members, and buyers who ask for a tax invoice — the shop is the data controller and we process it on the shop’s behalf, as section 8 explains. For a staff account that a shop creates for its staff, the shop is the data controller of the account’s details and we process them on the shop’s behalf, while we are the controller of how that account signs in and of its security records, as section 3 explains.

2. Who we are and how to reach us

Gwak Labs, which operates Gwak Gwak, contact email support@gwak-gwak.com (“we” or “us”). If we later set up a company to run the Service, that company becomes the data controller in our place, and we will tell you at least 30 days before that happens; if you do not want that, you can delete your account before then, as section 14 explains.

For anything about personal data, or anything else, write to support@gwak-gwak.com. We have not appointed a data protection officer, because we do not currently meet the legal thresholds that require one.

3. What we collect, and where it comes from

Account data: the email address or mobile number you sign in with, the name you give yourself, the profile picture you upload, the channel you chose for codes, your last sign-in time and whether each address is confirmed. It comes from you.

Staff accounts a shop creates: the display name, a username unique within the shop, the role and branches the shop gives the account, who created it and when, whether it is switched on, whether its password must still be changed and when it was last changed, the last sign-in time, and when the staff member asked for the account to be deleted. These come from the shop, not from the staff member, and a staff account needs no email address or mobile number. The password, including the temporary password the server issues when the account is created or its password is reset, is kept only as a salted, deliberately slow hash (PBKDF2), never as the password itself, and the temporary password is shown only once, to whoever created the account or reset its password. These details are held for the shop; the sign-in data below is held by us as the controller.

Sign-in data: one-time codes (kept only as a hash), each device’s session, IP address, the app and operating system version string (user agent), the device code bound to a branch, and the device name. Each request also carries the app’s version and platform, so the server can tell when the app needs updating. For a staff account, it also includes how many wrong passwords were entered for that account and from each IP address, which is used to lock out repeated attempts.

Data from LINE, Google or Apple when you choose to sign in with them: your user ID there, name, profile picture link (LINE and Google only), email address and, for Google, whether it has confirmed that email. Section 4 has the details.

Shop and team data: the shop’s name, address, phone number, logo, tax ID, branch numbers and PromptPay ID; branches; staff roles and permissions; and the staff names shown on bills, shifts, approvals and expenses.

Sales and operations data: bills, orders, the name called at the counter, tax invoices and credit notes with the buyer’s details, stock, suppliers, expenses, shifts with the place you pinned, and the photos attached to bills, shifts and expenses, which may show people.

Activity and security records: important events in a shop account — sign-ins, voids, refunds, approvals, permission changes, and staff accounts being created, changed, switched off, deleted, asked to be deleted or having their password reset — with who did them, when and from which IP address; an access record of every request to our server (the time, IP address, the app’s name and version (user agent), which function was called, the result, and the account and shop when signed in, never what was sent); and server logs in which email addresses, phone numbers, names and codes are masked.

Records of acceptance: each time you accept the Terms and this policy, we record the version of each, the time, the app version, the platform (iOS, Android or web) and how you accepted (while signing in, or in the app).

Crash reports: when the app hits an error or crashes, it sends our server the error message and the code trail (stack), the screen and part of the app where it happened, whether the app had to restart, the app version and build, the platform, the operating system version, the device model and the time. If you are signed in, our server adds your account and shop ID. Email addresses, phone numbers and tokens are removed before the report is stored.

What you send when you contact us, such as support emails.

4. Signing in with LINE, Google or Apple

LINE, Google and Apple are ways in only if you choose one: on the sign-in screen, or in Profile under How you sign in. Once you allow it there, LINE or Google sends our server your user ID with it, your name, your profile picture and the email address on that account. The user ID links the service to your shop account, or finds the one already linked to it. The name and a link to the profile picture set up your account and are saved with it.

Google also tells our server whether it has confirmed that email address. An address Google has confirmed becomes your account’s email address, and sign-in codes can be sent to it. If another account already uses that email, the Google sign-in stops there and no new account is made: sign in the way you usually do, then add Google in Profile, under How you sign in. An address Google has not confirmed is kept the way LINE’s is, below.

LINE’s email address is saved with your account as a contact address you have not confirmed yet. Nothing is sent to it until you confirm it with a code, and it is never used on its own to sign you in or to link LINE to an account. If another account already uses that email, the LINE sign-in stops there and no new account is made: sign in the way you usually do, then add LINE in Profile, under How you sign in. If another account later confirms that address, we remove the unconfirmed copy from yours.

Apple sends our server your user ID with it and an email address: your own, or a private relay address Apple makes when you choose to hide yours, which Apple forwards to you. We treat an address from Apple as confirmed, so it becomes your account’s email address and can receive sign-in codes, under the same rule as an address Google has confirmed, above. Apple sends your name only on your first sign-in, and only if you choose to share it; it sets up the account that sign-in creates. Apple sends no profile picture.

While you sign in, LINE may also offer to add Gwak Gwak’s LINE Official Account as a friend; that is your choice and does not change how you sign in. The Google sign-in software built into the app on iPhone and iPad may also collect an approximate location, a device identifier and data about how the sign-in is used, which Google uses to run the sign-in and to analyse its use. What LINE, Google and Apple collect and keep on their side is covered by their own privacy policies.

5. Device permissions

The app asks for each permission the first time you use the feature that needs it, and you can turn it off at any time in the device’s settings; everything else keeps working.

Camera and photos — the camera reads barcodes and QR codes while a scan sheet is open; those frames are processed on this device and never stored or uploaded. A photo you take or pick for a product, a shift, a bill, an expense or the shop logo is resized on the device, with its location and camera details (EXIF) removed, before it is uploaded to your shop account. A profile picture you pick yourself is resized and stripped the same way, then uploaded to your account.

Location — the app reads your location only when you ask a shift’s map to find you, never in the background, and the place you confirm is saved with the shift as an exact latitude and longitude. Maps are drawn by a map provider’s service, which receives your IP address and the area shown. On Android, the map provider’s software built into the app also sends that provider the device’s model and operating system version, an identifier the software generates, how you move and zoom the map, and the software’s own crash data, which the provider uses to run and improve its services. The map provider may process this data outside Thailand.

Microphone — the microphone listens only while you search products by voice: the device’s speech service from Apple or Google turns your words into text, helped by your product names, and may send both to that company to do it. The app keeps no recording.

Bluetooth and the shop’s network — used to find and connect to receipt and label printers. The Bluetooth scan is not used to work out where you are.

6. What stays on the device

The device keeps only what the till needs to work: your sign-in session and the accounts that signed in here, a copy of the shop’s settings for the till and its receipts, the team list set up on this device (names, roles and PINs, kept as hashes), the bill being rung up, this device’s activity log, and your printer and display choices. A profile picture kept on this device that has not been saved to your account yet also stays here: it is moved to your account when you sign in, or removed if your account already has one, and it stays on the device if the move does not go through.

It all sits in encrypted storage whose key is held in the device’s secure key store. If that storage cannot be opened, the app stops and asks you to try again; it does not carry on without encryption. The app’s data on the device is not included in iCloud or computer backups, and the app does not allow Android backups. Files you export or share — such as receipts, reports and member data PDFs — are deleted from the device once they are saved or shared, and any left behind for more than an hour are deleted the next time the app opens. Still keep a passcode on the device and the app lock on.

Remove this account from this device deletes what that account left on the device. Deleting the app deletes everything the app kept on the device, but not your account or your shop account on our server; section 14 explains how to delete your account.

7. What we use data for, and our legal basis

Providing the Service under our contract (PDPA section 24(3)): creating and running your account, sending sign-in codes, confirming who you are, linking LINE, Google or Apple, saving and showing shop data, issuing the bills and tax invoices you ask for, applying plan limits, checking that your app version is still supported, recording your acceptance of the Terms and this policy, deleting your account when you ask, and answering your questions.

Legitimate interests (section 24(5)): keeping the Service secure, preventing unauthorised access and fraud, rate-limiting code requests, investigating anomalies, keeping activity records so a shop can look back at what happened, fixing errors from the crash reports the app sends, measuring and improving the Service from data that identifies no one, telling you about your account and the Service (not marketing), and establishing, exercising or defending legal claims, including keeping the records of acceptance and of an account’s deletion after the account is deleted. We have weighed these against your rights, and you may object under section 14.

Staff accounts a shop creates: the shop, as the employer, decides who gets an account and relies on its own lawful basis for that, such as the employment contract; we keep the account’s details on the shop’s behalf to perform our contract with the shop. Checking passwords, locking out repeated wrong attempts, ending sessions when a password is reset, and keeping that account’s sign-in and security records are in our legitimate interest in keeping the shop’s account and the Service secure (section 24(5)), and the staff member may object under section 14.

Legal obligations (section 24(6)): keeping records tax or other laws require, keeping computer traffic data as computer crime law requires, answering orders from authorities or courts, and notifying data breaches.

Consent (section 19): only where consent is needed, such as Gwak Gwak’s own marketing messages if we ever send them. We would ask for it separately from accepting the Terms, and saying no would not affect your use of the Service. You could withdraw it at any time, as easily as you gave it, through the contact in section 2 or the opt-out in the message; withdrawing does not affect what was done before. We do not send marketing messages today and ask you for no consent.

We do not collect the sensitive data listed in section 26, such as health, religion or biometric data, and ask shops not to record it in notes or photos.

If you do not give us data the contract needs, such as an email address or mobile number to sign in with, we cannot create an account or provide the Service. A staff account a shop creates is the exception: it needs only the details the shop enters and a password.

8. A shop’s own customers

A shop may record members’ names, phone numbers, birthdays (day and month), notes, points, purchase history, and when they gave or withdrew consent to hear from the shop. It may also record the name, address and tax ID of a buyer who asks for a full tax invoice — for an individual, that is the national ID number.

For this data the shop is the data controller and we are the data processor acting on its instructions. We do not use it for our own purposes, do not contact a shop’s customers, and do not sell it.

If you are a shop’s customer and want to see, correct or erase your data, or withdraw consent, contact that shop directly. The shop can export everything it holds about you as a PDF and can erase a member: erasure removes the name, phone number, birthday and note, clears the points and records the withdrawal of consent. Earlier bills and tax invoices stay, because they are tax records the shop must keep. If you contact us instead, we pass your request on to the shop.

The system does not currently send campaign messages or any other marketing to members; it records whether each member has agreed to hear from the shop, so the shop can respect that choice. Changing a member’s phone number cancels their earlier consent, and a member can opt out at any time by telling the shop.

9. Who we share data with

We do not sell personal data or disclose it for advertising. We share it only with service providers who work for us under contracts that bind them to confidentiality and security, in these categories:

• Server and database providers — the servers that run the Service, the database and some encrypted backup copies, located in Thailand.

• Network, data delivery, and file and backup storage providers — every request between the app and our servers passes through their network; they store photos and encrypted backups and deliver product pictures and logos to whoever opens them, and may process data outside Thailand.

• Email delivery providers — send sign-in code and account notice emails, and may process data outside Thailand.

• SMS delivery providers — send sign-in code and account notice text messages, processing data in Thailand.

• LINE, Google and Apple — confirm your sign-in when you choose them; each is a controller of the data on its own side.

• The map provider and the device’s speech service — receive what section 5 describes when you use the map or voice search; each uses it under its own policy, as a controller of the data on its own side.

We may also disclose data to authorities or courts when the law requires it, to lawyers, auditors or advisers bound to confidentiality, and to whoever acquires our business in a merger or sale, who must protect it no less than this policy does.

Data you send out of the app yourself — printing, sharing a receipt or a campaign message, exporting a file — goes to the printer, app or place you pick, where the recipient’s own rules apply, not ours.

The current list of our service providers (sub-processors), with what each does, the data it receives and where it processes it, is published at https://gwakgwak.app/en/subprocessors/. We update that list before adding or replacing a provider that receives personal data.

10. Transfers outside Thailand

Our main database and servers are located in Thailand. Some providers may store or process data outside Thailand: network and file and backup storage providers, email delivery providers, and LINE, Google and Apple when you choose to sign in with them — as well as the map provider and the device’s speech service in section 5. Those countries’ data protection standards may differ from Thailand’s. Where each provider processes data is given in the list in section 9.

We send or transfer data abroad only as sections 28 and 29 of the PDPA allow — for example where it is needed to perform the contract you are party to, or under appropriate safeguards such as standard contractual clauses or provider terms that meet the Personal Data Protection Committee’s notifications. You can ask for details of these safeguards through the personal data contact in section 2.

11. How long we keep data

One-time codes expire after 3 minutes and are deleted within an hour of expiring or being used. Sessions expire within 7 days unless renewed, and are deleted within 2 hours of expiring. Counts of wrong staff passwords expire within an hour. Temporary data the system uses to deliver codes and to stop duplicate requests is deleted within 14 days.

Your account data is kept while your account is open. When you delete your account under section 14, it is erased at once.

A staff account a shop creates is kept while the shop keeps it, including while it is switched off. It is deleted when the shop deletes it, or 30 days after the staff member asks in the app for it to be deleted if the shop has not deleted it by then. Deletion erases the account’s name, username, password and sessions at once; the name stays where bills, shifts and the shop’s activity record copied it, for as long as those are kept. The records of acceptance, sign-ins and security of a deleted staff account are kept as for any deleted account, below.

Shop data is kept while the shop account is open. If a shop account closes because its last owner deleted their account, there is no time to export its data. Within about a day its members’ details are erased, and suppliers’ phone numbers, the names called at the counter, products and their pictures, campaigns, staff accounts and the shop’s profile are deleted. Its bills, tax invoices, credit notes and the records behind them — orders, shifts, expenses, stock movements and the activity record — are kept, with no one able to sign in to see or change them, until 1 January of the sixth year after the year the shop closed, Thai time: a shop closed in 2026 keeps them until 1 January 2032. We then delete them, unless a tax audit or the law requires us to keep them longer.

If a shop account closes any other way, under section 18 of the Terms, the shop has 30 days to export its data, and we then delete it, or make it impossible to identify anyone from it, within 90 days, unless the law requires us to keep it longer.

Bills, tax invoices and credit notes are not deleted while the shop account is open, because the Revenue Code requires them to be kept for at least 5 years, extendable to 7. Photos attached to bills, shifts and expenses are deleted 5 years after the end of their record’s calendar year, whether or not the shop has closed. Your profile picture is kept until you replace it or delete your account; the earlier picture is deleted when you change it.

A shop account’s activity records, including IP addresses (except as described below for deleted accounts), are kept while the shop account is open, and after it closes for as long as its bills are kept. Access records (the time, IP address and request) are kept for 120 days, no shorter than the 90 days the Computer Crimes Act requires, and one person’s for longer only when a competent official orders it under that Act, for up to 2 years. Other server logs and crash reports are kept for 7 days, deployment logs for up to 90 days, system metrics for 30 days, and encrypted database backups for 14 days before they rotate out.

Records of acceptance (section 3), and the record that an account was deleted — when, through the app or the web page, and from which IP address — are kept while the account is open and for 10 years after it is deleted, so that the agreement can be proved if a claim arises. After the deletion they no longer carry your name, email address or number. Other access records of a deleted account — such as the time and IP address of sign-ins or of changes to sign-in methods — are kept for 1 year after the account is deleted, which is no shorter than the Computer Crimes Act requires, so that security incidents can be investigated, and are then deleted. Where a shop’s activity record shows something a deleted account did in that shop, the record stays with the shop for the period described above, but its IP address is removed 1 year after the account is deleted. We keep a record in this paragraph longer than stated only when a competent official orders it under the law, or where it is needed to establish, exercise or defend legal claims.

Data that is erased — a member a shop erases, an account you delete, or what a closed shop loses — leaves the live system as described above, and leaves the encrypted backups when they rotate out after 14 days.

12. How we keep data secure

Data travelling between the app and our servers is encrypted with HTTPS. Each shop’s data is separated in the database by Row Level Security, so each request sees only its own shop’s data, and every staff role’s permissions are checked on the server.

One-time codes and session refresh tokens are stored as hashes; staff account passwords are stored only as salted PBKDF2 hashes, a temporary password must be changed at the first sign-in, repeated wrong passwords lock out the account and the IP address they came from for a wait that grows each time, and resetting a password ends every session of that account; code requests and attempts are rate-limited; changing how you sign in requires proving who you are again and sends a notice to the old address; deleting your account requires proving who you are again, with a code or the service you sign in with; logs mask email addresses, phone numbers, names and codes, and crash reports have email addresses, phone numbers and tokens removed before they are stored; backups are encrypted before they leave the server; and access to our systems is limited to those who need it.

Product pictures and shop logos are kept in public file storage so they can show on receipts and shop pages; anyone with the link can open them, so keep personal data out of them. Photos attached to bills, shifts and expenses are kept in private storage and open only through short-lived links issued to people with access. Your profile picture is kept in the same private storage, and a link to it is issued only to you and to members of a shop you belong to.

On the device, data sits in encrypted storage as section 6 says, and staff PINs and the app-lock PIN are kept only as salted hashes, never as the digits; a PIN set before an app update is converted to a hash the next time it unlocks successfully.

No system is perfectly secure. You can help by protecting your email, mobile number and devices, keeping the shop code and staff passwords from anyone who does not need them, turning on the app lock, and using Sign out everywhere if a device is lost.

13. If there is a data breach

If there is a breach of personal data we control, we check the facts without delay and, where there is reason to believe a breach has happened, notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, unless it is unlikely to put anyone’s rights and freedoms at risk; where the risk is high, we also tell the people affected, with what is being done about it, without delay.

If it affects a shop’s customer or staff data that we process for the shop, we tell the shop without undue delay and no later than 48 hours after becoming aware of it, as section 11 of the Terms says, so that the shop, as the controller, can notify the authority and its customers as the law requires.

14. Your rights

Under the PDPA you have the right to access your data and get a copy, to have it corrected, to receive it in a machine-readable format or have it sent to someone else, to object to processing, to have it erased or made anonymous, to have its use restricted, to withdraw consent, and to complain to the Office of the Personal Data Protection Committee.

In the app you can change your name, add or confirm an email address or number, change where codes are sent, sign out everywhere and delete your account yourself. For anything else, send a request from the email address or number linked to the account to support@gwak-gwak.com.

In the app, delete your account from Settings or Profile, and prove it is you with a code sent to your email address or number, or by signing in with LINE, Google or Apple again. Without the app, go to https://gwakgwak.app/delete-account/ and enter your account’s email address or number: we send a code there, and the account is deleted when you enter it. Deletion takes effect at once and cannot be undone; there is no waiting period.

We may ask for information to confirm who you are before acting, and we answer within 30 days of receiving a request. If we refuse a request — for example because tax law requires bills to be kept — we will tell you why.

Deleting your account signs you out on every device at once, erases your email address, number, name, profile picture and sign-in details, and removes your LINE, Google and Apple links. Your name may remain where the shop’s bills and activity records copied it, because they are the shop’s evidence. The records of acceptance and of the deletion are kept as section 11 says.

In a shop where you are staff, or that has another owner, your access ends and the shop stays open. If you are a shop’s only owner, the shop account closes with your account, but only after you confirm it; to keep the shop open, make someone else an owner first. A closed shop’s data is handled as section 11 says, with no time to export it afterwards, so export what you need before you delete your account.

If you sign in with a staff account a shop created for you, that shop is the controller of the account’s details: ask the shop to see, correct or delete them, or to exercise your other rights over them; if you ask us instead, we pass the request on to the shop. In the app you can change your password and ask for your account to be deleted: the shop sees the request in the app, and if it has not deleted the account within 30 days, we delete it. Deleting a staff account ends its sessions and erases its name, username and password; the name on bills, shifts and the shop’s activity record stays, as section 11 says. For the sign-in and security records we hold as the controller, send your request through the shop or to support@gwak-gwak.com; a staff account has no email address or number, so we may ask the shop to confirm who you are.

If you sign in with Apple, deleting in the app asks you to confirm with Apple once more, and we then ask Apple to revoke Gwak Gwak’s access to your Apple ID. Deleting on the web page cannot do this: remove Gwak Gwak yourself in your Apple ID settings.

15. No tracking or ads

We collect no analytics or advertising data through the app, do not track you across apps or websites, and show no ads. The sign-in software in section 4 and the map software in section 5 collect usage data for their own providers; we do not receive it.

When the app hits an error or crashes, it sends the crash report described in section 3 to our own server. It is kept in our own logging system on our server for 7 days and used only to find and fix the fault; no outside crash-reporting or analytics service receives it.

Apple and Google may also collect crash reports and diagnostics about the app themselves, as your device settings allow, and show them to us; that is under their own policies, and you can turn it off in the device’s settings.

16. Minors

The Service is made for adults running a business and is not intended for minors. A shop that has minors working as staff must have their parent’s or guardian’s consent where the law requires it. If we learn that we hold a minor’s data without a lawful basis, we will delete it.

17. Changes to this policy

We may update this policy when the Service or the law changes. For an important change — a new type of data, a new purpose, or a new provider that receives data — we will tell you in the app or by email before it takes effect, and ask for consent again where the law requires it.

This version: 2026-10-19, effective from 2026-11-16, published at https://gwakgwak.app/en/privacy/.