1. About This Policy

This Privacy Policy ('Policy') describes how CAIKU collects, uses, discloses, and protects your personal data when you use our services, including caiku.ai, the CAIKU AI Agent platform, and related services (the 'Services').

By using our Services, you accept this Policy. If you do not accept it — please stop using the Services.

This Policy complies with Thailand's Personal Data Protection Act B.E. 2562 (2019) ('PDPA') and other applicable Thai laws.

2. Data Controller

2.1 Data Protection Officer (DPO)

CAIKU has appointed a DPO to oversee privacy compliance:

3. Information We Collect

We collect four main categories of personal data:

3.1 Account Data

• Full name
• Email address
• Phone number
• Company name and job title (if provided)
• Password (stored as encrypted hash)

3.2 Usage Data

• Conversation logs (chat and voice transcripts)
• Lead data you upload to the system
• Knowledge base content
• Configuration and settings
• Activity logs (login, actions performed)

3.3 Technical Data

• IP address
• Browser type and version
• Device type and OS
• Cookies and similar tracking technologies
• API request logs

3.4 Payment Data

• Payment details — stored by our payment processor (Stripe / Omise), not by CAIKU
• CAIKU only retains: transaction ID, date, amount, and status
• Tax invoice information — as required by Thai law

3.5 What We Do Not Collect

4. Purposes & Legal Basis

We process your data for the following purposes and on the following legal bases:

5. Disclosure & Data Transfers

We may disclose your data to the following recipients:

5.1 Service Providers (Data Processors)

5.2 International Data Transfers

Your data may be transferred to countries with privacy protection standards lower than Thailand (e.g., USA). We apply the following safeguards:

1. Standard Contractual Clauses (SCCs) in our DPAs with all vendors
2. Encryption in transit (TLS 1.3+)
3. Access control and audit logs
4. Vendor selection limited to providers with privacy compliance certifications (SOC 2, ISO 27001)

5.3 Disclosure Required by Law

We may disclose your data when:

• Required by court order or government authority
• Necessary to prevent crime or protect lives
• Necessary to protect CAIKU's or another user's rights

5.4 What We Do Not Do

6. Your Rights (Data Subject Rights)

Under PDPA Sections 30-39, you have seven rights:

6.1 Response Time

6.2 Fees

The first request is free. For repeated or excessive requests, we may charge a fee based on actual cost (e.g., admin processing) — but we will inform you in advance.

6.3 Right to Complain

If you believe CAIKU has violated PDPA, you may file a complaint with the Personal Data Protection Committee (PDPC):

We encourage you to contact our DPO first so we can resolve the issue as quickly as possible.

7. Data Security

We implement the following data protection measures:

7.1 Technical Measures

• Encryption in transit (TLS 1.3+)
• Encryption at rest (AES-256)
• Multi-factor authentication (MFA) for admin access
• Role-based access control
• Audit logs retained for 5 years
• Annual vulnerability scanning and penetration testing
• Backup and disaster recovery — RPO 1 hour, RTO 4 hours

7.2 Organizational Measures

• DPO appointed and registered with PDPC
• Annual privacy training for all staff
• Vendor due diligence with signed DPAs
• Documented incident response plan
• Privacy by Design in feature development

7.3 Data Breach Notification

In the event of a data breach affecting you:

1. We will notify the PDPC within 72 hours (as required by PDPA)
2. We will notify you directly as soon as practical, via email and in-app notification
3. We will explain what happened, which data was affected, and remediation steps taken
4. We will recommend actions you should take (e.g., change password)

8. Data Retention

8.1 After Retention Period Ends

1. Data is deleted from production systems
2. Data is deleted from backups in the next rotation cycle (up to 90 days)
3. A deletion certificate is issued upon request

9. Cookies & Tracking

caiku.ai uses cookies to enable our services and analyze usage. See our Cookie Policy for details.

10. Policy Changes

We may update this Policy from time to time. For material changes, we will notify you 30 days in advance via email and in-app notification. Continued use of the Services after an update constitutes acceptance of the new Policy.

10.1 Version History

11. Contact Us