Terms and conditions

1. Who we are and how you accept

These terms and conditions (the “Terms”) are a contract between Gwak Labs, which operates Gwak Gwak, contact email support@gwak-gwak.com (“we”, “us” or “Gwak Gwak”), and the person or business that signs up for or uses the Gwak Gwak app and its related services (“you”).

You accept these Terms when you tick and accept them on the sign-in screen, or when you keep using the service after that. Accepting electronically is legally binding under the Electronic Transactions Act B.E. 2544 (2001). If you do not accept them, do not sign up for or use the service. We keep a record of each acceptance — the version of these Terms and of the Privacy policy, the time, the app version and the platform — as the Privacy policy describes, and use it as evidence of which version you accepted and when.

These Terms apply together with our Privacy policy and with the data processing terms in section 11, which form part of these Terms.

2. Words used in these Terms

“Service” means the Gwak Gwak app on iOS, iPadOS and Android, the API servers the app connects to, the web pages we run for it, such as the account deletion page, and every function we provide through them, such as the till, bills, tax invoices, stock, shifts, members, campaigns, reports and file exports.

“Shop account” means one business’s space on our servers, including all of its branches. “Account owner” means the person who created the shop account or holds its owner role.

“User” means anyone who uses the Service on your behalf, including staff with their own accounts, staff who sign in with a staff account, and staff who use a PIN on a device that shares one account. “Staff account” means an account that you, or a user you allow to manage your team, create in your shop account for a member of your staff, who signs in with the shop code, a username and a password.

“Shop data” means the data you or your users record in the Service, such as products, prices, bills, tax invoices, stock, expenses, photos and member records. “Members” means your customers whom you record in the loyalty or marketing features.

“Plan” means the service tier of a shop account, as shown in the app, which sets limits on products, members, branches, team members, promotions and file exports.

3. Who may use the Service, and your authority

The Service is made for running a business, not for personal use, and you confirm that you use it for your business. You must be of full legal age under Thai law (20 years old, or of age through marriage) and able to enter into a contract.

If you use the Service on behalf of a company or someone else’s business, you confirm that you have authority to bind that business to these Terms, and that business is our contracting party. If you do not have that authority, you are personally bound by these Terms.

The information you give us about yourself and your business must be accurate, complete and kept up to date.

If you sign in with a staff account that a shop created for you, you use the Service as that shop’s user: the shop, not you, is our contracting party under these Terms, and you must follow sections 4 and 9 whenever you use the Service.

4. Accounts, users and security

You sign in with a one-time code sent to an email address or mobile number, or with LINE, Google or Apple; a staff account signs in with the shop code, its username and its password. You must keep that email address, mobile number, LINE, Google or Apple account, the shop code, every password and the devices you sign in on safe from anyone you have not authorised.

You decide who your users are, which role or permissions each holds and who knows which PIN. Everything done through your shop account, a user account, a PIN or one of your devices counts as done by you, unless it was caused by our fault. You must remove the access of staff who have left, and make sure every user follows these Terms.

Staff accounts: as the employer, you decide who gets a staff account, and you are responsible for every staff account created in your shop account, whether you or a user you allowed to manage your team created it. The server shows each temporary password only once: give it in private only to the person the account is for, and keep it and the shop code from anyone else. Each account is for one person; staff must keep their password to themselves, must change the temporary password at their first sign-in, and must not use anyone else’s account. When someone leaves, or a password may be known to someone else, switch the account off, delete it or reset its password without delay; a reset ends every session of that account. Everything done under a staff account created in your shop account counts as done by you, as the paragraph above says.

Your staff’s data: for the details of the staff accounts you create, you are the data controller and we are your data processor under section 11. You must have a lawful basis for creating each account, tell your staff how their data is used, and answer their requests about it. A staff member can ask in the app for their account to be deleted; you see the request in the app, and if you have not deleted the account within 30 days, we delete it on your behalf, as you instruct us to by accepting these Terms. Past bills and the shop’s records keep the staff member’s name, as the Privacy policy says.

A staff PIN tells apart the people who share a device; it does not prove who they are to our server. Keep a passcode on every device, turn on the app lock, and use Sign out everywhere at once if a device is lost.

If you know or suspect that someone has accessed your account without permission, tell us at support@gwak-gwak.com without delay.

5. What the Service is

Gwak Gwak is an online point-of-sale tool. Every record is sent to our servers as you make it. The Service is not designed to keep selling without internet access and does not queue records to send later: when there is no signal, a record that has not reached the server does not happen. You are responsible for a working internet connection, devices and printers, and for a fallback way of selling of your own.

The Service is a tool that records and calculates from the data and settings you give it. We are not a tax, accounting or legal adviser, and we do not file anything with, or send anything to, the Revenue Department on your behalf. The e-Tax files the app builds are summaries for your accountant, not a tax filing.

The app sends its version and platform with every request. We may require you to update the app to a supported version to keep using the Service, and an older version may stop working until it is updated. Keep the app and your device’s operating system up to date.

We may improve, add, change or withdraw any feature. If a withdrawal materially removes a core feature, we will give you at least 30 days’ notice, and if you are on a paid plan, you may cancel it and receive a pro-rata refund for the time left.

6. Plans and fees

The Service is currently free of charge. Nothing is sold in the app, and the app has no in-app purchase. The limits of your shop account’s plan are those shown in the app, and our servers enforce them; changing what a device shows does not change what the server allows.

We may introduce paid plans in the future. A paid plan would be offered under its own terms, which we will tell you about in the app or by email at least 30 days before any charge, and we will never charge you unless you explicitly agree by choosing a paid plan yourself. If you do not choose one, nothing is charged.

We may change a plan’s limits with at least 30 days’ notice in the app or by email. Shop data above a new limit is not deleted for that reason.

7. Your responsibilities

You must use the Service for lawful trade and follow the laws that apply to your business, including tax, accounting, consumer protection, price, licensing and personal data protection laws.

You are responsible for the accuracy of what your documents are issued from: the shop’s name, tax identification number, Revenue Department branch number, VAT registration status, tax rate, prices, discounts, and the buyer details on full tax invoices. The Service prints a receipt by default, and prints a receipt/abbreviated tax invoice only when you have set the shop as VAT-registered and entered a cash register number (POS ID) approved by the Revenue Department. You must apply on form ภ.พ.06 and obtain that approval before issuing abbreviated tax invoices from the Service, and you are responsible for entering the approved number correctly; we print what you set. You must check the documents the Service produces, notify the Revenue Department about your cash register where the law requires it, keep documents and records for as long as the Revenue Code and accounting law require, and file your own tax returns, yourself or through your accountant.

You must keep your own copy of the data your legal duties require, using the export features your plan includes or by asking us for a copy under section 18. The Service does not replace the record-keeping the law requires of you.

You must have the right to use what you upload, such as product photos and the shop logo, and must not upload photos showing other people without a lawful basis to do so. Product pictures and the shop logo can be opened by anyone who has their link, because they have to show on receipts and shop pages.

8. Your customers’ data and marketing

For the personal data of members, of buyers who ask for a tax invoice, and of anyone else you record in the Service, you are the data controller under the Personal Data Protection Act B.E. 2562 (2019), and we are the data processor acting on your instructions under section 11.

You must tell your customers the purposes and details section 23 of that Act requires before or when you collect their data, have a lawful basis for every use of it, and answer their requests to exercise their rights within the time the law allows. The app’s member erasure and export features are there to help you do this.

The Service does not currently send news, promotions or campaign messages to members; it records each member’s consent to hear from you. If you send them news or promotions yourself by any means, such as SMS, LINE or email, you must have each member’s express consent beforehand, record it truthfully in the app, and stop at once when a member opts out. Every message must name your shop and give an easy way to opt out. Sending advertising messages without an easy way to refuse them may be an offence under section 11 of the Computer-Related Crime Act B.E. 2550 (2007).

For a member under 20, you must have their parent’s or guardian’s consent before you record consent to hear from you, which satisfies section 20 of the PDPA in every case; for a member aged 10 or under, only the parent’s or guardian’s consent counts. The system keeps only the day and month of a birthday, so it cannot check a member’s age for you.

You are responsible for the content of the news and promotions you send your members and for the recipients you choose, including members you pick with the Service’s help. If the Service later sends campaign messages for you, we may pause or refuse a campaign we believe in good faith lacks consent, breaks the law or has drawn complaints.

9. What you must not do

You and your users must not use the Service to sell illegal goods or services, to defraud, launder money, evade tax, issue false tax documents, or infringe anyone’s rights.

You and your users must not send spam or messages without consent, try to reach another shop’s data or sign in to an account that is not theirs, probe, break or work around our security measures or plan limits, reverse engineer the Service, scrape it, or load our servers beyond normal use.

You must not resell, rent out or provide the Service to others without our written consent.

If you find a security weakness, report it to us at support@gwak-gwak.com and do not use or disclose it.

10. Who owns the data

Your shop data belongs to you. We do not sell shop data or the personal data in it, and we do not use it for advertising.

You allow us to store, use, copy, process and transmit shop data as far as needed to provide the Service, keep it secure, fix problems you report, comply with the law and exercise our rights under these Terms. This permission is free of charge, worldwide as far as providing the Service needs, and ends when the data is deleted under section 18.

We may produce statistics or aggregated data from use of the Service that cannot identify you, your shop or any person, to run, measure and improve the Service. Data that can no longer identify anyone belongs to us.

11. Data processing terms

This section applies to personal data we process on your behalf as a data processor under section 40 of the Personal Data Protection Act B.E. 2562 (2019), such as the member, buyer and staff records you keep in the Service, including the details of the staff accounts you create. It does not cover how a staff account signs in or the security records about it — the password hash, sessions, wrong attempts and lockouts, and sign-in and access records — which we process as a controller to keep the Service secure, as the Privacy policy says.

Instructions: we process that data only on your instructions, which are these Terms and what you or your users tell the app to do. We do not use it for our own purposes unless the law requires us to. If we believe an instruction breaks the law, we will tell you.

Confidentiality and security: we limit access to people who need it and are bound to confidentiality, and apply appropriate security measures, described in our Privacy policy.

Sub-processors: you allow us to use sub-processors, such as server and database, network and file storage, email delivery and SMS delivery providers. The current list of them is published at https://gwakgwak.app/en/subprocessors/. We bind each of them to data protection duties no weaker than this section, and remain responsible to you for their work.

Changes to sub-processors: we will tell you in the app or by email at least 30 days before we add or replace a sub-processor that processes the data this section covers, such as your members’ data. If we have to replace one urgently to keep the Service running or secure, we will tell you as soon as we can. If you have data protection grounds to object, tell us within 30 days of the notice. If we cannot resolve your objection, you may end the contract under section 18, and we will refund any fees paid in advance for the time left, pro rata. Ending the contract is your only remedy for a change of sub-processor.

Transfers abroad: where a sub-processor stores or accesses data outside Thailand, as the list of sub-processors shows, we put in place appropriate safeguards under section 28 or 29 and the Personal Data Protection Committee’s notifications.

Assistance: we help you answer data subjects’ requests through the app’s features, such as correcting, exporting and erasing a member’s data, and changing, switching off and deleting a staff account, and as you reasonably ask beyond that. If a data subject contacts us directly, we pass the request to you and do not answer it for you unless you instruct us to; a staff member’s request in the app to delete their account is handled as section 4 says.

Breaches: when we become aware of a personal data breach affecting data we process for you, we will tell you without undue delay and no later than 48 hours after becoming aware of it, in the app or at the email address or mobile number linked to the owner’s account, which you must keep working. The first notice may hold only what is known at the time, and we will add to it as we learn more: what happened, the kinds and rough number of records and people affected, the likely consequences, the measures we have taken or will take, and who to contact at our end — so that you can notify the Personal Data Protection Committee’s office and the people affected as the law requires. Unsuccessful attempts that do not lead to the loss of, or access to, use, change or disclosure of, the data — such as scans or blocked password guessing — are not breaches to be notified under this section. Notifying a breach is not an admission of fault or liability.

Deletion or return: when the contract ends, we delete the data, or make it impossible to identify anyone from it, under section 18, unless the law requires us to keep it.

Records and audits: we keep the records of processing the law requires, and on your reasonable written request — no more than once a year, unless there has been a breach or an authority requires it — we provide the information needed to show that we comply with this section.

12. Availability

We make reasonable efforts to keep the Service available, but we do not promise that it will be uninterrupted, fast or free of errors, unless we have agreed a service level (SLA) with you in writing.

The Service may pause for maintenance, updates or emergencies. We try to do this outside common trading hours and to give notice when we can.

Because the Service works online, selling stops when your internet, your network provider or the servers are unavailable. We are not responsible for loss caused by your internet connection or your devices not working.

13. Third-party services

Parts of the Service work with third parties’ services, such as LINE, Google and Apple for sign-in, email and SMS providers, map providers, Apple’s and Google’s speech services, the app stores and the crash reports they collect from devices, printers, the banking apps that scan PromptPay QR codes, and the apps you choose to share files to. Those services are governed by their providers’ own terms and policies.

The PromptPay QR codes the app shows are built from the PromptPay ID you set. Money goes straight from the buyer to your account through the banks; we do not receive, hold or transfer money for you, and we do not confirm that a payment has arrived. Check that you have been paid before handing over goods.

We are not responsible for loss caused by third-party services outside our control, but we will help you deal with them where we can.

14. Intellectual property and feedback

The Service, its software, design, the Gwak Gwak name and marks are the intellectual property of us or our licensors. We give you a right to use the app for your business while these Terms are in force; that right is non-exclusive, non-transferable and cannot be sub-licensed. Every right not expressly given stays with us.

If you send us suggestions or feedback about the Service, we may use them without obligation or payment to you.

15. Disclaimer

Apart from what these Terms say, the Service is provided as is and as available. As far as the law allows, we give no express or implied warranty that the Service suits your particular purpose, meets the tax or legal requirements of your business, or produces correct reports and calculations from data or settings you entered incorrectly.

This section does not exclude any right the law does not allow to be excluded.

16. Limits on liability

As far as the law allows, we are not liable for lost profit, revenue, sales, goodwill or business opportunity, or for indirect, special or consequential loss, whether in contract, tort or otherwise, even if we were told such loss was possible.

As far as the law allows, our total liability to you arising from or in connection with the Service, for any cause, is limited to the greater of (a) the fees you paid us in the 12 months before the first event giving rise to liability, or (b) THB 10,000.

These limits do not apply to liability for our fraud, wilful misconduct or gross negligence, for death or personal injury, or for anything else the law does not allow to be limited, and they apply only as far as is fair and reasonable under the Unfair Contract Terms Act B.E. 2540 (1997).

The Service is currently free of charge and is run by an individual. The disclaimer in section 15 and the limits in this section are part of what lets us provide it without charge. They apply to the operator’s personal liability, and equally to anyone who takes over our rights and duties under section 20. We do not promise that any insurance covers your loss.

You must tell us about a claim in writing within a reasonable time of becoming aware of it, and take reasonable steps to limit the loss, such as checking the documents you issue and keeping your own copy of your data.

17. Your indemnity

You will compensate and defend us against claims, fines, losses and reasonable costs, including lawyers’ fees, that a third party or an authority brings against us because of (a) your shop data or what you upload, (b) a breach of these Terms or of the law by you or your users, including tax, personal data protection and computer crime laws, or (c) news, promotions or campaigns you send your members — except where, and to the extent that, the loss was caused by our fault.

We will tell you promptly about such a claim and cooperate reasonably in defending it. You will not settle it, or admit anything, on our behalf without our written consent.

18. Suspension, ending the contract and your data afterwards

You may stop using the Service at any time: delete your account in the app, from Settings or Profile, or at https://gwakgwak.app/delete-account/, as section 14 of the Privacy policy explains, or ask us to close your shop account at support@gwak-gwak.com from the email address or number linked to the owner’s account. Deleting the app does not delete your account or close the shop account.

Deleting your account takes effect at once. If you are a shop’s only owner, its shop account closes with it once you confirm; if the shop has another owner, it stays open and only your access to it ends. A shop account closed this way has no export period, so export the data you need before deleting. Within about a day its members’ details, products, product pictures, staff accounts and shop profile are deleted, while its bills, tax invoices, credit notes and the records behind them are kept, with no one able to sign in to them, until 1 January of the sixth year after the year it closed, and then deleted, as section 11 of the Privacy policy says.

We may suspend all or part of your access at once where needed to prevent serious harm to the Service, other shops or other people, for unlawful use or a breach of section 9, or when an authority orders it. In other cases we will tell you why and give you at least 14 days to fix it before suspending. We lift a suspension once its cause is gone.

We may end the contract if you materially breach these Terms and do not fix it within 30 days of notice, or if we stop providing the Service altogether, with at least 60 days’ notice and a pro-rata refund of any fees paid in advance.

When the contract ends any other way, you have 30 days to export your shop data, or to ask us for a copy in a machine-readable file, whether or not your plan includes exports — unless it ended because of unlawful use. After that we delete your shop data, or make it impossible to identify anyone from it, within 90 days. Backup copies are deleted as the backup cycle rotates them out.

We may keep some data for as long as the law requires or as needed to establish, exercise or defend legal claims, such as evidence that you accepted these Terms and security logs.

Sections that by their nature must survive the end of the contract continue to apply, including sections 10, 11, 14 to 18, 20 and 21.

19. Changes to these Terms

We may change these Terms when the Service, the law or our business changes. For a change that materially affects your rights, we will tell you in the app or by email at least 30 days before it takes effect, unless the law or security requires a faster change. Minor changes, or changes in your favour, may take effect at once.

If you do not accept the new version, you may stop using the Service before it takes effect. Using the Service after that date, or accepting the new version, means you accept it. We may ask you to accept the new version in the app before you carry on. A new version does not apply to events that happened before it took effect.

This version: 2026-10-19, effective from 2026-11-16.

20. General

Notices: we may notify you in the app, by email, or at the mobile number linked to the owner’s account. You can notify us at support@gwak-gwak.com. An electronic notice counts as received when it reaches the recipient’s system.

Force majeure: neither of us is liable for delay or failure caused by events beyond reasonable control, such as natural disasters, widespread power cuts, failures of networks or cloud providers, cyber attacks that could not reasonably be prevented, or government orders. This does not excuse a duty to pay.

Assignment: you may not transfer your rights or duties under these Terms without our written consent. You agree in advance that we may transfer all of ours to a company we set up or control to run the Service, or to whoever acquires the relevant business, with at least 30 days’ notice to you. The transferee must take on our duties under these Terms and protect data no less than they do. If you do not want the transfer, you may stop using the Service or delete your account before it takes effect.

Severability: if a provision is invalid or unenforceable, the rest stays in force, and that provision applies as far as the law allows.

No waiver: not using a right, or using it late, does not waive it.

Entire agreement: these Terms, the Privacy policy and any additional written agreement are the whole agreement between you and us about the Service. Where an additional written agreement conflicts with these Terms, it prevails.

Language: these Terms are written in Thai and English. If the two versions conflict, the Thai version prevails.

21. Governing law and disputes

These Terms are governed by Thai law.

Before taking a dispute to court, tell us about it in writing at support@gwak-gwak.com, and both of us will negotiate in good faith for at least 30 days.

If negotiation fails, the competent Thai courts decide the dispute. This does not stop either of us from asking a competent court for interim relief.

22. Contact us

Gwak Labs, email support@gwak-gwak.com.