Privacy Policy

This Policy explains how Pawjai collects, uses, discloses, transfers, retains, and protects personal data, and describes your rights under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).

1. Data Controller and Scope

The data controller is the operator of the service under the name "Pawjai" from time to time ("Pawjai," "we," or "us"). This Policy applies to Pawjai websites, applications, accounts, subscriptions, AI features, notifications, sharing features, and other online services. Privacy contact: Email: support@pawjai.co Website: https://pawjai.co You may use these channels to ask questions, exercise rights, withdraw consent, or complain. If the operator or controller changes through a transfer or business reorganization, we will provide information about the new controller and material effects as required by law.

2. Personal Data We May Collect

We collect data that is relevant and reasonably necessary for the stated purposes. Categories may include: (a) Account and identity data: account identifier, display name, email, profile image, age range, gender, country, language, and identity data returned by a sign-in provider. (b) Pet and care data: pet name, image, species, breed, sex, age, weight, behavior, food, medication, symptoms, treatment history, activity records, appointments, and information a user uploads or types. (c) Chat and AI data: messages, prompts, images, documents, conversation context, AI output, feedback, and information needed to generate, review, or improve a response. Users should not submit another person's personal data or human sensitive data unless necessary and lawful. (d) Preference and personalization data: units, timezone, language, interests, pet environment, budget, lifestyle, experience, and care priorities. (e) Transaction data: plan, price, currency, payment status, receipt, refund, and transaction identifiers. Payment providers generally receive card details directly; Pawjai does not ordinarily store full card numbers. (f) Technical, security, and usage data: IP address, approximate IP-derived country, device and operating-system type, browser, device or installation identifiers, event logs, access times, pages and features used, errors, performance, referral data, and feature interactions. (g) Notification and sharing data: device tokens, notification status and delivery/open/click data, reminder type and schedule, share-link code and expiry, view count, and last-viewed time.

3. Sources of Data

We receive data directly from you; automatically from a device or browser when the service is used; from authentication, payment, hosting, analytics, and notification providers; from recipients using a sharing link you authorized; and from inferences produced by the service, such as an approximate country or AI recommendation. If you provide another person's information, you should have appropriate authority or another legal basis and should give that person an appropriate notice. Do not upload another person's human health data, national identification data, financial data, or other sensitive information unless genuinely necessary and lawful.

4. Mobile Application and Device Data

When you use Pawjai through an application, we may process information necessary to provide and secure the service, such as device type, operating system, application version, language, time zone, installation or notification identifiers, authentication events, crash information, and application performance. We will access the device's camera, photos, microphone, location, notifications, or other capabilities only when necessary for a feature you select and after permission has been granted through the operating system. You may refuse or withdraw a permission through device settings, but a feature that depends on that permission may no longer function fully. We may disclose necessary information to app-store, payment, infrastructure, notification, security, analytics, and error-monitoring providers only to the extent necessary for downloads, payments, notifications, fraud prevention, troubleshooting, or operation of the service. App-store and operating-system providers may independently process certain information under their own privacy policies. We will use analytics that are not necessary for the service only after obtaining consent or where another appropriate legal basis applies. You may change the analytics preference within the service. Disabling notifications through the operating system stops notifications on that device but does not automatically withdraw marketing consent for other communication channels.

5. Purposes and Legal Bases

We may process data for the following purposes and legal bases: (a) Contractual necessity, PDPA Section 24(3): to create and maintain accounts and provide pet records, AI chat, reminders, sharing, subscriptions, payments, support, and necessary service communications. (b) Legitimate interests, Section 24(5): to secure the service, prevent fraud, diagnose errors, measure availability, improve the service, analyze aggregated or de-identified information, enforce terms, and establish, exercise, or defend legal claims. We consider necessity and the effect on your rights. (c) Consent, Section 19: direct marketing, marketing notifications, identified or account-linked behavioral analytics, and other activities expressly presented as consent-based. You may refuse or withdraw without losing the core service. (d) Legal obligations, Section 24(6): tax, accounting, regulatory orders, preservation duties, and other legal compliance. (e) Other grounds allowed by law, such as preventing or suppressing danger to life, body, or health where necessary. Pawjai is not an emergency or veterinary service.

6. AI, Inferences, and Automated Decisions

We may provide necessary data to AI processors to generate answers, summaries, or pet-care recommendations. Output may be wrong and must not replace a veterinarian. Pawjai does not ordinarily use solely automated decisions that produce legal or similarly significant effects on a user without appropriate review. We may use genuinely anonymized or aggregated information to evaluate quality and improve systems. Using account-linked conversation content for a purpose beyond service delivery, security, or troubleshooting requires an appropriate legal basis and notice.

7. Disclosures and Service Providers

We may disclose necessary data to categories of recipients including hosting and database providers, authentication providers, AI processors, payment providers, email and notification providers, analytics and error-monitoring providers, professional advisers, authorities where legally required, a lawful business transferee, and persons with whom you choose to share information such as a veterinarian, carer, or family member. Examples within a category may change as our technical and business needs evolve. You may request additional information that can reasonably be provided without compromising security or third-party confidentiality. We impose processor obligations concerning confidentiality, security, processing instructions, and deletion or return where required by law. We do not sell personal data to third parties for their independent marketing. A person holding a sharing link may access its contents without identity verification; send links only to trusted recipients and revoke them when no longer required.

8. International Transfers

Some service providers may process data outside Thailand, and processing locations may change with providers and network routing. For international transfers we will follow PDPA Sections 28 and 29 and use an appropriate mechanism, such as assessing destination protection, contractual data-protection terms, binding internal safeguards, or a legally permitted exception. You may contact us for further information about recipient categories, general countries or regions, and safeguards. We may limit disclosure where reasonably necessary for security or another person's confidentiality.

9. Retention and Deletion

We retain data no longer than reasonably necessary for the stated purpose, using the following criteria: (a) Account and pet data: while the account remains active and the data is needed to provide the service. (b) AI messages and conversations: no more than one (1) year from creation, unless deleted earlier, a shorter product setting applies, or a specific legal hold or dispute requires retention. (c) After account cancellation: a user may request an export for thirty (30) days, after which account data will be permanently deleted. (d) Transaction, tax, and accounting records: for the legally required period, generally at least five (5) years and longer where a law, order, or dispute requires. (e) Security and audit records: for a period reasonably necessary to investigate incidents, prevent fraud, and establish or exercise legal claims. (f) Account-linked analytics: no more than twelve (12) months before deletion or anonymization, unless consent is withdrawn earlier. (g) Sharing links: expire within seven (7) days unless the feature displays a shorter period. At the end of a retention period we delete, destroy, or irreversibly anonymize data unless it must instead be restricted and retained for a legal obligation or claim.

10. Minors and Users of All Ages

People of all ages may benefit from the service, but processing a minor's data must comply with PDPA Section 20 and applicable capacity rules. Where a minor cannot consent independently, consent must be obtained from a parent or legal representative; consent for a child under ten must be obtained from the person exercising parental power. A parent or guardian may contact us to ask about, access, correct, delete, or object to processing of a minor's information where the law permits. If we learn that child data was collected without required authority or consent, we may limit the account, request parental verification, or delete the data as appropriate.

11. Data Subject Rights

Subject to PDPA conditions and exceptions, you may have rights to withdraw consent; obtain access and a copy; ask for disclosure of a data source; receive or transfer portable data; object; request deletion, destruction, or anonymization; restrict use; correct inaccurate data; and complain to the Personal Data Protection Committee. Submit requests to support@pawjai.co. We may request proportionate information to verify identity and representative authority. We will respond without undue delay and within the period required by law, and will explain a lawful refusal or restriction, including where needed for legal duties, another person's rights, security, or legal claims. Requests are ordinarily free unless the law permits a charge for manifestly excessive or repetitive requests.

12. Consent, Marketing, Cookies, and Analytics

Cookies or storage required for sign-in, security, language, sessions, and core operation are used as appropriate for contract performance or legitimate interests. They cannot all be disabled while using the related feature. Direct marketing and identified or account-linked behavioral analytics are performed only after a separate consent choice. You may select necessary technologies only, reject analytics, withdraw consent, or change a preference without affecting prior lawful processing or access to the core service. Marketing and notification choices can be managed in notification settings or by contacting us. Analytics choices can be managed in privacy settings. Disabling device-level notification permission may stop both user-created reminders and other notifications on that device.

13. Security and Personal Data Breaches

We use technical and organizational measures appropriate to risk, such as encryption in transit, access controls, separation of duties, event logging, backups, vulnerability management, and provider obligations. No system can be guaranteed completely secure or continuously available. If a personal data breach occurs, we will assess its scope, risks, and effects; contain and remediate it; maintain required records; and notify the Personal Data Protection Committee without undue delay within the legally required period where the reporting threshold is met. If a breach is likely to result in a high risk to rights and freedoms, we will notify affected data subjects with appropriate guidance without undue delay as required by law.

14. Changes and Contact

We may update this Policy when the service, law, or our processing changes. We will display the version and effective date and provide appropriate notice of material changes. If a new purpose requires consent, we will obtain that consent before processing. Questions, rights requests, withdrawals, or complaints may be sent to support@pawjai.co or through https://pawjai.co. If you believe we have not complied with the PDPA, you may complain to Thailand's Office of the Personal Data Protection Committee.