Privacy policy

Our role

For shop owners and staff who use the system (user accounts), we are the data controller.

For the shop’s customers that a shop records in the system, the shop is the data controller and we process the data on the shop’s behalf, only as the shop instructs. If you are a customer of a shop and want messages to stop or your data deleted, please contact the shop directly, or tell us and we will work with the shop.

What we collect

• User accounts: name, email, password (stored as a one-way hash we cannot read), role in the shop.
• If you sign in with Google: your Google account ID, email and name only. We do not access your Gmail, Drive, Calendar or contacts.
• Shop details: shop name, phone, opening hours, branches, logo, SMS sender name.
• Customer data the shop records: name, phone, email, birthday, vehicle or service details, appointments, notes and marketing consent.
• Messages sent: recipient phone or email, content, time and delivery result.
• Usage data: IP address, sign-in times and a log of important actions, for security and auditing.
• Plan and credit purchases: amount and payment reference.

How we use it

We do not sell data, we do not use a shop’s customers for our own marketing, and one shop never sees another shop’s data.

• To provide the service: sign-in, job records, the reminders a shop sets up, and reports.
• Promotional messages go only to customers who opted in. The system never sends to people without consent or marked do-not-text.
• To prevent misuse, for example by filtering links and banned words and limiting sending volume.
• For billing, credit accounting and legally required bookkeeping.
• To contact you about your account, such as approval or delivery problems.

Who we share it with

We share only what is needed with these providers, who work on our behalf:

• SMS gateway (THSMS): recipient number, sender name and message content, to pass the message to mobile networks.
• Google Workspace: sends email reminders to customers without a phone number, and system email.
• Google: verifies your identity when you choose to sign in with Google.
• Cloudflare: serves the website and protects it from attacks.

How long we keep it

• Account and shop data are kept while the shop uses the service and deleted within 90 days after cancellation.
• A shop can delete a customer at any time. Pending messages are cancelled and that customer’s number and past message content are cleared immediately.
• Records the law requires us to keep, such as financial and tax records, are kept for the legally required period.

Cookies

We only use cookies needed for the site to work, such as the sign-in cookie (30 days) and a short-lived cookie during Google sign-in. We do not use advertising or cross-site tracking cookies.

Security

• Every page is served over HTTPS.
• Each shop’s data is separated in every database read and write.
• Passwords are stored as one-way hashes, and failed sign-in attempts are limited.
• Important actions, such as sending messages, deleting customers or changing numbers, are logged for auditing.

Your rights

You may request access to and a copy of your data, correction, deletion, restriction or objection, data portability, and you may withdraw consent at any time. Withdrawing consent does not affect what was done before.

Send requests to [email protected]. We reply within 30 days. If you believe we handled your data wrongly, you may complain to Thailand’s Personal Data Protection Committee (PDPC).

Changes to this policy

We announce significant changes in the shop back office in advance and show the update date at the top of this page.

Contact

Mr. Weraphol Wangchan, operator of smsforme.com. Email [email protected]