SellerTiger Privacy Policy
1. Who we are and what this policy covers
- Data controller: Wellion Enterprise Service (Thailand) Co., Ltd., tax ID 0105566097901, 540 True Digital Park, Sukhumvit 101/1, Bangchak, Phrakhanong, Bangkok 10260, Thailand. Data Protection Officer (DPO): helpdesk@wellion.co.th. Privacy requests: helpdesk@wellion.co.th.
- This policy applies to personal data we process as a controller about: people who use SellerTiger (Founders and Members of Workspaces), people who visit our websites and legal pages, people who contact our support, and contacts at our business customers and prospects ("Account Data").
- It does not cover personal data that our business customers put into SellerTiger about their own buyers, creators, suppliers or staff (for example names, phone numbers and shipping addresses on orders). For that data the business customer is the controller and we act as its processor under the Data Processing Addendum. If you are a buyer of a shop that uses SellerTiger, please contact that shop about your data; we will help the shop respond.
2. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and profile | name, work email, username, phone number, LINE ID, job title, profile photo, language and theme | you, or your Founder when they invite you |
| Sign-in and security | password (stored only as a one-way scrypt hash), sign-in method (Google or Lark ID linked to your account), sessions, IP address, browser and device type (user agent), sign-in times, security and audit logs | you, your browser, Google or Lark when you choose to sign in with them |
| Workspace and billing | company name, company tax ID and billing address, Plan, seats, invoices, payment status and references | the Founder, our payment providers |
| Use of the Service | actions you take (for example creating a task or changing a price), feature usage, AI Credit usage, error reports | the Service |
| Communications | support tickets and chats, emails with us, feedback | you |
| Content you create in a Workspace | comments, chat messages, tasks, calendar events, files | you and your colleagues (this is also Customer Data controlled by your company) |
| AI requests | the text you type into AI features and the context the feature sends with it | you and the Service |
| Approximate location (optional) | rounded coordinates for the weather card on your workbench | your browser, only if you allow it |
| Consent records | which document versions you accepted, your cookie and marketing choices, with time, IP address and user agent | you and the Service |
We do not intend to collect sensitive personal data (such as health, religion, biometric or criminal records data under section 26 of the PDPA). Please do not enter such data into the Service unless it is truly necessary and you have a lawful basis to do so.
3. Why we use personal data and on what legal basis
| Purpose | Legal basis under the PDPA |
|---|---|
| Create and manage your account and Workspace, sign you in, provide the features you use | contract (section 24(3)) |
| Billing, invoices, collecting fees, accounting and tax | contract (section 24(3)); legal obligation (section 24(6)), for example the Revenue Code and the Accounting Act |
| Keep the Service and accounts secure, detect and prevent fraud and abuse, keep traffic and audit logs | legitimate interests (section 24(5)); legal obligation under the Computer Crime Act |
| Answer support requests and communicate about the Service (security notices, changes to terms, billing notices) | contract (section 24(3)); legitimate interests (section 24(5)) |
| Run AI features you ask for | contract (section 24(3)) |
| Log every AI request and check it automatically for misuse (illegal or harmful content, prompt injection, exposure of personal data or secrets, unusual usage); limit or pause AI for an account that repeatedly breaks the rules | legitimate interests (section 24(5)) in keeping the Service safe and lawful; legal obligation (section 24(6)) |
| Improve the Service using usage statistics, preferably aggregated or anonymised | legitimate interests (section 24(5)) |
| Send product news, tips and offers by email | consent (section 19), which you can withdraw at any time |
| Remember interface preferences on your device; use approximate location for weather | consent (see the Cookie Policy) |
| Keep records of consents and of privacy requests; establish, exercise or defend legal claims; comply with orders of authorities | legal obligation (section 24(6)); legitimate interests (section 24(5)) |
Where we rely on legitimate interests, we have balanced our interests against your rights and you may object (see section 8). If you do not provide data that is needed for the contract (for example a valid email address), we cannot create your account.
4. AI features
When you use an AI feature, the Service sends your request and the minimum context needed (for example product names and figures relevant to the question) to an AI model provider selected by the Service or configured by your Workspace. We use providers' business APIs, under which, according to their terms, API data is not used to train their general models by default. We do not ask the providers to keep the data longer than needed to answer, except for short-term abuse monitoring that some providers perform under their own terms. Do not put personal data into AI prompts unless it is needed.
AI request logging and moderation. For security, abuse prevention and billing, we keep a record of every AI request: who made it, the Workspace, the feature, the model, the time, its size and credit cost. We also store the text of the request and of the answer, encrypted at rest (AES-256-GCM), for 90 days (the SellerTiger platform may set a shorter period), after which the text is deleted automatically; the request record without the text (including any moderation flags) is kept for up to 12 months. Each request goes through an automated check — rules, keyword lists and, where available, the moderation service of an AI provider (for example OpenAI's moderation endpoint) — that flags categories such as content unrelated to business use, policy violations (illegal, harassing, sexual, self-harm, malware / hacking or fraud content), prompt-injection attempts, personal data or secrets in the text, and unusual usage spikes. Only authorised SellerTiger platform administrators can read the stored text, only to review a flagged request, and each time they do so is recorded in a tamper-evident audit log. If an account receives several high-severity flags, AI may be limited or paused for that account automatically until a person reviews it; you will be notified and you can contact support to contest the decision (a human always makes the final decision about suspending an account). The Founder of a Workspace can see that Workspace's AI usage and the number of flagged requests, but not the text of other people's requests.
5. Who we share personal data with
We do not sell personal data. We share it only as follows:
- Your Workspace: the Founder and administrators of your Workspace can see your profile, role, activity and content in that Workspace, as part of managing it.
- Service providers (our processors) that help us run SellerTiger, under contracts that require confidentiality and security: cloud hosting and storage ([HOSTING — to be completed]); email delivery; AI model providers (Anthropic, OpenAI, Google, DeepSeek) and web search (Tavily) when you use AI features; payment providers (for example Opn Payments, 2C2P, Stripe, banks for PromptPay) for payments.
- Services you or your Workspace connect: Google and Lark (sign-in, calendar, tasks and mail sync), LINE, marketplaces (Shopee, Lazada, TikTok Shop and others), ERPs and accounting software. Data is exchanged with them only when you or your Workspace connect them, and their own privacy policies apply.
- Authorities and advisers: when required by law, court order or a lawful request of a government authority, and to our auditors, lawyers and advisers under confidentiality.
- Business transfer: if Wellion is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, which must keep protecting it under this policy.
6. International transfers
Some of the providers listed above store or process data outside Thailand (for example in Singapore, the United States, the European Union, Japan or China, depending on the provider). When we transfer personal data abroad we do so in line with sections 28 and 29 of the PDPA: to countries with adequate protection standards as determined under the PDPA; or under appropriate safeguards such as contractual data protection commitments of the recipient (including standard contractual clauses) or binding group rules; or where the transfer is necessary to perform our contract with you or your Workspace, or where you have given consent after being told about the lack of adequate standards. Founders can choose which AI providers their Workspace uses where the Service allows. You may ask us for more information about the safeguards for a specific transfer.
7. How long we keep personal data
| Data | Retention |
|---|---|
| Account and profile data | while your account is active; deleted or anonymised within 90 days after the account or Workspace is closed, unless needed longer for a reason below |
| Deleted Workspaces | restorable for 30 days, then deleted from live systems; removed from backups as they rotate within a further 35 days |
| Invoices, payment and tax records | at least 5 years from the end of the accounting period, or longer where the law requires |
| Security, sign-in and traffic logs | at least 90 days as required by the Computer Crime Act, and normally not more than 1 year unless needed for an investigation |
| AI request text (prompts and answers, encrypted) | 90 days, or a shorter period set by the platform, then deleted automatically |
| AI request records and moderation flags (without the text) | up to 12 months |
| Support tickets | up to 3 years after the ticket is closed |
| Consent records and privacy requests | while the consent or account is in use and up to 10 years afterwards, as evidence of compliance and for legal claims |
| Marketing preferences | until you withdraw consent; we then keep a record that you opted out so we do not contact you again |
When the retention period ends we delete or anonymise the data.
8. Your rights
Under the PDPA you have the right to:
- withdraw consent at any time, for processing based on consent, without affecting processing before the withdrawal (section 19);
- access your personal data and obtain a copy, and ask how we obtained data you did not consent to (section 30);
- data portability: receive your data in a commonly used machine-readable format and ask us to send it to another controller where technically feasible (section 31);
- object to processing based on legitimate interests, and to direct marketing at any time (section 32);
- erasure: ask us to delete, destroy or anonymise your data in the cases set out in section 33;
- restriction: ask us to suspend the use of your data in the cases set out in section 34;
- rectification: ask us to correct inaccurate, incomplete or misleading data (sections 35 and 36);
- complain to the Office of the Personal Data Protection Committee (PDPC), Thailand, if you believe we have breached the PDPA.
How to exercise them: in SellerTiger go to Settings → My data, where you can download a copy of your data (JSON), withdraw optional consents and send a deletion or other privacy request; or email helpdesk@wellion.co.th or our DPO at helpdesk@wellion.co.th. We may ask you to verify your identity. We will respond without undue delay and within 30 days of receiving the request. Requests are normally free of charge. We may refuse or limit a request where the PDPA allows, for example when we must keep the data by law or to defend legal claims, and we will tell you why.
If your request concerns data in your company's Workspace (Customer Data), we will forward it to the Workspace Founder, who controls that data, and help them respond.
9. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), one-way hashing of passwords, encryption of stored API keys and secrets, role-based access controls within Workspaces, separation of Workspaces, session management that lets you sign out other devices, audit logs, backups, and confidentiality obligations and need-to-know access for our staff. No system is completely secure; please use a strong password and keep your sign-in methods safe.
10. Personal data breaches
If a personal data breach occurs, we will notify the PDPC without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. If the breach is likely to result in a high risk, we will also inform the affected people without delay, together with the measures taken to remedy it. Where we process data for a business customer, we will notify that customer without undue delay so it can meet its own obligations.
11. Children
SellerTiger is a service for businesses and is not intended for people under 20 years of age (minors under Thai law). We do not knowingly collect personal data from minors. If we learn that we have done so without the consent required by section 20 of the PDPA, we will delete it.
12. Cookies
We use strictly necessary cookies and, only with your consent, preference storage on your device. See the Cookie Policy. You can change your choice at any time via "Cookie settings" in the page footer or your profile menu.
13. Changes to this policy
We may update this policy. The current version, its version number and effective date are shown at the top of /legal/privacy, and earlier versions remain available there. If we make material changes, we will tell you in the Service or by email and, where required, ask you to review and accept the new version when you next sign in.
14. Contact
Wellion Enterprise Service (Thailand) Co., Ltd., 540 True Digital Park, Sukhumvit 101/1, Bangchak, Phrakhanong, Bangkok 10260, Thailand. Privacy requests: helpdesk@wellion.co.th. Data Protection Officer: helpdesk@wellion.co.th. Telephone: +66 2-125-3262.