Privacy Policy

1. Who this covers

• Shop owners and team members who use ChatMai ("merchants").
• People who message a merchant through a channel the merchant has connected to ChatMai ("the merchant's customers").
• Shop owners who link their LINE account to receive ChatMai notifications.

A merchant decides which channels to connect and how to talk to its customers. If you are a merchant's customer, you can contact that merchant or us about your data.

2. What we collect

• Account: your name, email address, profile picture, workspace and role, received from your ContentVelo account when you sign in.
• Connected channels: the identifiers and names of the Facebook Pages, Instagram accounts, LINE Official Accounts and shops you connect, and the access tokens those platforms issue so ChatMai can receive and send messages.
• Conversations: for each person who messages a connected channel, their identifier on that platform, display name and profile picture, their messages, images and files, and the replies sent. Notes, labels and contact details (such as an email or phone number) are stored only when a member of the merchant's team adds them.
• Business content you enter: shop profile, AI settings, knowledge entries, answers to queued questions, quick replies and, if you use it, product information from your ContentVelo catalog.
• AI keys: if you add your own OpenAI, Anthropic or Google API key, we store it encrypted and only ever display its last four characters.
• LINE notifications: if you link LINE, your LINE user ID, display name, profile picture and whether you have added the ChatMai account as a friend. We request only the profile and OpenID permissions; we do not receive your email address or phone number from LINE, and we revoke the LINE access token as soon as the link is made instead of keeping it.
• Billing: the package, amount, VAT, status and payment reference of each purchase. Card and bank details are entered with our payment provider; ChatMai does not store card numbers.
• Technical data: the sign-in cookie, your language choice, browser notification settings if you turn them on, records of incoming platform events, and server logs used for security and troubleshooting.

3. Why we use it

• To run the inbox: receive messages from connected channels, show them to the merchant's team and send the replies they or the AI write.
• To produce AI replies and summaries when the merchant turns AI on.
• To tell shop owners, through the ChatMai LINE account, about questions the AI could not answer, customers who asked for a person, and channels or AI keys that stopped working.
• To check that connected channels are still working.
• To bill for paid packages and keep accounting records.
• To keep the service secure, prevent abuse and fix problems.
• To meet our legal obligations.

We do not sell personal data, and we do not use conversation content for advertising.

4. AI processing

When a merchant turns AI on, the recent messages of a conversation, together with the merchant's relevant knowledge entries, shop profile and product information, are sent to an AI provider to draft a reply or a summary. Which provider depends on the merchant's setting:

• ChatMai AI: the AI provider ChatMai uses, currently OpenAI.
• The merchant's own key: OpenAI, Anthropic or Google, under the merchant's own account with that provider.
• The merchant's own AI system (webhook): the address the merchant configures.

AI providers may process this data outside Thailand, under their own terms. ChatMai does not train AI models on your data. AI answers are limited to the merchant's own information; when the AI cannot find an answer it tells the customer the shop will check and asks the owner instead of guessing.

5. Who we share it with

• The messaging platforms a merchant connects (Meta for Facebook and Instagram, LINE, Shopee, Lazada, TikTok Shop), to deliver messages.
• The AI provider selected as described in section 4.
• Our payment provider, to process payments.
• The infrastructure that hosts ChatMai and stores images and files sent in conversations.
• A merchant's own sales system, only if the merchant connects one through Sales Hub.
• Authorities, when the law requires it.
• Meta, only for visitors of the public introduction page who allow advertising measurement, as described in section 9.

Merchants and team members see the conversations of the workspaces they belong to, according to the permissions the workspace owner gives them.

6. How long we keep it

• Account, channel and conversation data: while the merchant's workspace uses ChatMai, or until deletion is requested.
• Lazada buyer messages and identity: removed after 30 days.
• Shopee buyer messages and data: removed after 90 days.
• The owner's LINE link: until the owner disconnects it in ChatMai, which deletes it.
• AI keys: until the merchant removes them, which deletes them.
• Accounting records of payments: five years, as Thai accounting law requires, even after an account is deleted.

7. Security

ChatMai is served over HTTPS. Access to each workspace's data is limited to its members and their permissions. AI keys and other stored credentials are encrypted. No system is completely secure; if an incident affects your data, we will notify you and the authorities as the law requires.

8. Your rights

Under the PDPA you can ask to access or receive a copy of your personal data, have it corrected, deleted or transferred, restrict or object to its use, and withdraw consent where we rely on consent. You can also complain to the Personal Data Protection Committee.

To make a request, email [email protected] or use the deletion request page at contentvelo.com/chatmai/data-deletion. We may need to confirm your identity first. If you are a merchant's customer, we may pass your request to that merchant, who manages the conversation.

9. Cookies

The ChatMai app uses only the cookies it needs to work: the sign-in cookie, security (anti-forgery) cookies and your language choice. The app does not use advertising or analytics cookies.

Advertising measurement, on the public introduction page only: on chatmai.contentvelo.com/start we ask whether ChatMai may use the Meta pixel to see which ads bring visitors. Nothing is loaded from Meta until you press Allow, and your answer is kept in the cm_ad_consent cookie for 180 days. If you allow it, Meta sets its _fbp cookie (and _fbc if you came from a Meta ad) and receives that page visit and a click on Start free. If you then create a ChatMai workspace in the same browser, ChatMai's server may tell Meta that a workspace was created, with those Meta cookies, your IP address, your browser details and a code that does not reveal which workspace. Your name, email, chats and workspace content are never sent. Meta processes this under its own terms, possibly outside Thailand. You can withdraw at any time with "Advertising measurement settings" on that page, which removes these cookies.

10. Changes to this policy

We may update this policy when ChatMai changes. The date at the top shows the latest version. We will tell merchants about significant changes in the app or by email.