นโยบายความเป็นส่วนตัวPrivacy Policy

This Privacy Policy ("Policy") sets out how personal data of users of Story AI (the "Service"), comprising the website storyai.cloud and the application app.storyai.cloud, is collected, used, disclosed, and protected, in accordance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other applicable law. By using the Service, you acknowledge that you have read and understood this Policy.

1. Data Controller

The data controller under this Policy is BIT ARCADE (THAILAND) CO., LTD., a company incorporated under the laws of Thailand and the operator of Story AI ("we", "us", "our"). Data protection contact: support@storyai.cloud

2. Personal Data We Collect

We collect only the data necessary to provide the Service:

• Account data: email address, password (stored as a salted hash using industry-standard algorithms), page or brand name, and your PDPA consent records.
• Brand and content data: business details, target audience, tone and style preferences, brand assets you upload (such as logos and product images), and the posts, captions, prompts, and images generated through the Service.
• Facebook / Instagram connection data: when you connect an account, we receive the ID and name of the Page or Instagram account you manage, Page access tokens (stored securely and used solely to publish content you have approved), and publishing results. We request only the permissions strictly necessary to operate the Service: pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, and instagram_content_publish.
• We do not access or store your friends list, private messages, or personal profile data beyond what is required for publishing.
• LINE data (optional): your LINE user ID, used solely to deliver post notifications if you choose to link LINE.
• Payment data: payments are processed by Omise (Opn Payments), a licensed payment service provider. We do not store full card numbers; we retain only transaction references and credit balances.
• Usage data: action logs (approve / skip / edit), device and browser information, and cookies strictly necessary to maintain your login session.

3. Purposes and Legal Bases of Processing

We do not use your data for automated decision-making that produces legal effects concerning you, and we do not use your data for third-party advertising.

4. AI Processing

Content you request may be processed by third-party AI service providers solely for generating, improving, or formatting the content you request. This may include text generation, caption generation, creative direction, image prompt generation, and image generation. We transmit only the data necessary for each request, such as your prompt, selected brand profile, uploaded brand assets, and relevant content context.

5. Disclosure to Third Parties

We do not sell, rent, or trade your personal data. Disclosure is limited to data processors essential to operating the Service, under appropriate data processing arrangements:

We may also disclose data where required by law, court order, or a lawful request from a competent authority.

6. International Transfers

Certain providers operate servers outside Thailand. Cross-border transfers are made only to destinations with adequate data protection standards or subject to appropriate safeguards as required under the PDPA, such as contractual data protection clauses.

7. Data Retention

• Account and content data — retained while your account remains active, and deleted or anonymized within 30 days of a verified deletion request or account closure.
• Page access tokens — revoked immediately upon disconnection.
• Payment records — retained for the period required under accounting and tax law (generally no more than 10 years), in access-restricted form.

For the deletion procedure, see the Data Deletion page.

8. Your Rights (PDPA)

You have the right to access and obtain a copy of your data, rectify inaccurate data, erase or destroy data, restrict processing, object to processing, withdraw consent, and request data portability.

To exercise any right, contact support@storyai.cloud. We will respond within 30 days of receiving and verifying your request. You also have the right to lodge a complaint with Thailand's Personal Data Protection Committee (PDPC) if you believe our processing does not comply with the law.

9. Security Measures

We use appropriate technical and organizational measures, including TLS/HTTPS encryption in transit, need-to-know access control, password hashing, and secure token storage.

Where a personal data breach creates a risk to your rights and freedoms, we will notify Thailand's PDPC within 72 hours after becoming aware of the breach and notify you without undue delay as required by law.

10. Minors

The Service is intended for persons at least 20 years of age or persons authorized to act on behalf of a business or page. We do not knowingly collect personal data from minors. If we discover that minor data has been collected without valid consent, we will delete it promptly.

11. Cookies

We use only cookies and browser storage strictly necessary for login and Service functionality. We do not use third-party advertising tracking cookies.

12. Changes to this Policy

We may update this Policy from time to time. The latest version will be published on this page with its updated date. Where material changes are made, we will notify you through the Service or by email with reasonable advance notice.

13. Contact

Questions about this Policy or the exercise of your PDPA rights: support@storyai.cloud