Effective June 25, 2026
Compliant with Thailand's Personal Data Protection Act B.E. 2562 (PDPA)
Pinkora acts as the data controller under the PDPA for the collection, use, and disclosure of your personal data as described in this policy.
Data Protection Officer (DPO) contact: privacy@pinkora.com
Data you provide directly:
Data generated by usage:
Data collected automatically:
| Purpose | Legal basis |
|---|---|
| Providing the AI chat platform | Performance of a contract (§24(3)) |
| Processing payments | Performance of a contract |
| Sending essential notification emails | Performance of a contract |
| Improving AI service quality | Legitimate interest (§24(5)) |
| Preventing fraud and misuse | Legitimate interest |
| Sending news and promotions (marketing) | Consent (§19) — withdrawable anytime |
| Complying with legal requirements | Legal obligation (§24(6)) |
We do not sell your personal data. We disclose data only in the following cases:
Your chat data is not read by our team, except where necessary for a legal investigation or system security.
As a data subject, you have the following rights:
Right of access
Request a copy of the data we hold about you
Right to rectification
Request correction of inaccurate data
Right to erasure
Request deletion of your personal data
Right to object
Object to certain processing of your data
Right to portability
Receive your data in a transferable format
Right to withdraw consent
Unsubscribe from marketing email instantly
Exercise these rights via My Profile or contact privacy@pinkora.com — we respond within 30 days.
| Data type | Retention period |
|---|---|
| Account data | Lifetime of the account + 90 days after deletion |
| Chat history (messages) | Lifetime of the account (deletable in Settings) |
| AI photos sent in chat | 45 days, then the file is auto-deleted (message stays) |
| Payment records | 5 years (accounting & tax law) |
| Access logs | 90 days |
| Marketing data | Until consent is withdrawn |
We use industry-standard security measures, including:
While we use best-in-class measures, no system is 100% secure. In the event of a data breach, we will notify you within 72 hours as required by the PDPA.
We use cookies to:
You can decline analytics cookies in Settings without affecting core functionality.
Our service uses infrastructure from international providers, so your data may be processed in the United States and the European Union.
Every provider we use meets international security standards (SOC 2, ISO 27001 or equivalent) and has a Data Processing Agreement (DPA) with us.
If we make material changes to this policy, we will notify you via your registered email at least 30 days in advance. Continued use constitutes acceptance of the updated policy.
For questions, complaints, or to exercise your PDPA rights, contact privacy@pinkora.com — we respond within 30 days.
If you do not receive a response, you may lodge a complaint with Thailand's Personal Data Protection Committee (PDPC).