Privacy Policy
Chill&Co Works is committed to protecting your privacy. We comply with PDPA (Thailand), Meta Platform Policy, LINE Platform Policy, and GDPR.
Last Updated: May 19, 2025
Introduction & Scope
This Privacy Policy describes how Chill&Co Works collects, uses, and protects personal data from users of our system, which integrates with LINE OA and Meta (Facebook/Instagram).
Service Name
Chill&Co Works — AI Sales Assistant for LINE OA and Meta (Facebook Page / Instagram)
Service Provider
Chill&Co Works, operated by a Thai development team. Contact: [email protected]
Compliance Standards
This policy complies with Thailand's Personal Data Protection Act (PDPA), Meta Platform Policy, LINE Platform Policy, and GDPR (for EU users).
Data We Collect
We collect only the minimum data necessary to provide our services, categorized by source:
Data from LINE Platform
LINE profile name, LINE User ID, profile photo, and message content sent by users in authorized LINE OA channels.
Data from Meta (Facebook/Instagram)
Facebook Page name, Page ID, Access Token (stored encrypted), messages from Messenger and Instagram DM, User IDs of message senders, and the list of Pages the admin has authorized for our app.
Merchant Account Data
Email, store name, and Dashboard configuration data such as Knowledge Base content and product information.
Payment Data
Payments are processed via a PCI-DSS-compliant third-party Payment Gateway. We do not store credit or debit card information directly.
Technical Data
IP addresses, browser types, and usage logs for diagnostics and security.
How We Use Your Data
Data collected is used exclusively for the following purposes:
Automated AI Chat Replies
Customer messages are processed via Google Gemini API to generate automated responses, sent back to LINE OA or Facebook Messenger/Instagram DM.
Human Handover (Handover Protocol)
When AI cannot respond or a customer requests human support, conversations are passed to a Human Agent via Meta's Handover Protocol or LINE Official Account.
Page & Account Management
Meta Page data is used to display information in the Dashboard, allowing Merchants to monitor conversation status and history.
Service Improvement
Aggregated, anonymized data is used to analyze usage and improve service quality.
Third-Party Disclosure
We do not sell, trade, or exchange your personal data with third parties, except as follows:
Meta Platform (Facebook/Instagram)
Data received via the Meta Graph API is used only within the scope of approved Permissions: pages_messaging, pages_read_engagement, and instagram_manage_messages. We do not share Meta user data with any other third parties.
LINE Corporation
Data from the LINE Messaging API is used under LINE Developers Policy. We only send replies via the LINE Reply API.
Google (Gemini AI)
Message content is sent to Google Gemini API for processing under Google Cloud's Privacy Policy. Google does not use this data to train models without authorization.
Legal Requirements
We will only disclose data when required by a court order or applicable law.
Meta Permissions We Request
We request only the Meta permissions strictly necessary for our core features:
pages_messaging
Used to read and send messages via Facebook Messenger on behalf of Pages authorized by the Merchant.
pages_read_engagement
Used to read basic Page information (name, status) for display in the Dashboard.
instagram_manage_messages
Used to read and reply to Instagram Direct Messages (DM) on behalf of the connected Instagram Business Account.
Access Token Storage
Meta Page Access Tokens are stored encrypted on our servers and are never exposed to other users.
Data Security
We implement appropriate technical and organizational measures to protect your data.
Encryption
All data transmitted through our systems uses HTTPS/TLS. Meta and LINE tokens are stored encrypted.
Access Control
Database access is strictly restricted to authorized personnel. Each Dashboard account can only view its own data.
Retention Period
Conversation data is retained for the lifetime of your account and deleted within 90 days of cancellation or upon your request.
Your Rights & Data Deletion
You have full rights to control your personal data under PDPA, Meta Platform Policy, and LINE Platform Policy.
Right to Access or Delete Data
Send your request to [email protected] with your account name. We will respond within 30 business days.
Revoking Facebook App Access
Go to Facebook Settings → Security and Login → Apps and Websites → Find Chill&Co and click Remove to immediately revoke all permissions.
Revoking LINE Access
Block or unfollow our LINE OA at any time directly through the LINE app.
Data Deletion Callback (Meta Requirement)
As required by Meta, users may request data deletion via [email protected] or through Facebook Settings. We will process the deletion within 30 days and provide a confirmation.
Right to Complain
If you believe your data rights have been violated, you may file a complaint with Thailand's PDPC or the relevant authority in your jurisdiction.
Contact Information
If you have questions about this Privacy Policy, contact us via:
Website
https://www.chillandcostudio.com
LINE OA
Contact us directly via our LINE OA. We aim to respond within 1 business day.