Privacy Policy

1. Introduction and data controller

This policy explains how HugWeb, operated by บริษัท ซูเปอร์เดฟ จำกัด (Superdev Co., Ltd.) (เลขที่ 89 รามคำแหง 82 แขวงหัวหมาก เขตบางกะปิ กรุงเทพมหานคร 10240, tax ID 0105563058564), collects, uses, and discloses your personal data when you subscribe to our website-building service (“the service”), under Thailand's Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). If you have any question about your personal data, contact us at [email protected].

2. Data we collect

We collect four main categories of data, matching how the service is actually used:

• Account data — Email, password (stored hashed, never as plain text), username, and — if you sign in with Google — basic identity information from your Google account.
• Business data (onboarding) — Shop name, address, phone number, services offered, sales channels (LINE/Shopee/TikTok/IG and so on), your shop's story, and customer reviews/testimonials you enter (which may contain other people's names), so the AI can build and suggest website content.
• Payment and tax data — Payment history and the package you subscribed to, via the payment provider PaySo (Pay Solutions) — we do not store your credit or debit card number ourselves — and, if you request a tax invoice, the buyer's name, tax ID, and address.
• Consent and security data — Consent records (the type, the policy version, and the IP address and user-agent at the time of consent), audit logs, IP address, and the session cookie, kept for security and troubleshooting.

3. Purposes and legal bases for processing

We process each category of data on a different legal basis, per section 24 of the PDPA:

• Performance of a contract — Account data, business data, and payment data, in order to build and maintain your site and bill for the service.
• Consent — Marketing emails and messages (optional, never a condition of using the service).
• Legitimate interest — Security logs, fraud prevention, and the session cookie that the system needs to function.

4. Disclosure to third parties

We share only what is necessary with the following providers, who act as data processors on our behalf:

• PaySo (Pay Solutions) — Processes payments and PromptPay QR.
• AI provider — When the system builds a website with AI, the business brief you entered is sent for processing to select and write content. This function can be turned on or off by system configuration, and its servers may be located outside Thailand (see section 5).
• Unsplash / Pexels — Stock image libraries (only the search term you type is sent; no personal data).
• Magnific — AI image-editing service (special users only), to which the link to the image you upload is sent for processing.
• Cloudflare — Web infrastructure (CDN, file storage for published websites, and domains you connect), plus Cloudflare Email Routing and Email Sending, which we use to send and forward system emails (such as verification emails and the notice sent to our accounting team when you request a tax invoice) to our company mailbox on Microsoft 365 (Exchange Online).
• Google — (a) Sign-in with a Google account (if you choose to use it); (b) the Google Maps embed on the website you publish, which a visitor's browser contacts directly (the visitor's IP address is sent to Google).
• Google Cloud Platform — Servers running the backend system.

We do not sell your personal data to third parties for marketing purposes.

5. Cross-border data transfers

The infrastructure and AI providers we use (Cloudflare, Google Cloud Platform, an AI provider, and Microsoft 365 (Exchange Online)) may store or process data on servers located outside Thailand. Where that happens, we rely on the safeguards set out in sections 28-29 of the PDPA (such as standard data-transfer contracts and the providers' own data-protection policies) so that your data remains adequately protected even when processed abroad.

6. Data retention

• Account and business data — kept for as long as you use the service, and deleted within a reasonable period after your account is closed.
• Payment records and tax invoices (including copies sent by email to our accounting team) — kept for at least 5 years as required by the Revenue Code, even after you request account deletion.
• Technical security logs — kept only for as long as security review requires.

7. Your rights as a data subject

Under the PDPA you have the following rights over your personal data:

• Access your data and request a copy of it.
• Correct inaccurate data and bring it up to date.
• Request erasure or destruction of your data (except where another law requires us to keep it, such as tax records).
• Object to, or restrict, some of the processing.
• Receive your data in a commonly usable format in order to move it to another provider.
• Withdraw marketing consent at any time, without affecting your use of the core service.

You can exercise these rights from your account settings, or by sending a request to [email protected] — we will respond within 30 days.

8. Cookies

• hw_session — A session cookie that keeps you signed in (HttpOnly). It is strictly necessary for the system to work, so it does not require separate consent.
• hw_oauth_state — A cookie that protects against request forgery during sign-in with Google (single-use, short-lived).

We currently have no analytics or marketing cookies. If we add any in future, we will show a consent banner with clearly separated categories, never bundled together with the necessary ones.

9. Data security

We apply appropriate technical and organisational measures to protect your data, such as encryption in transit (HTTPS/TLS), restricting data access to those who need it, and reviewing our systems regularly.

10. Changes to this policy

When we make a material change to this policy, we will notify you by email or by an in-app announcement before it takes effect. Each version of the policy carries a version number so it can be traced back to which version you consented under.

11. If you have a concern

If you have any question or concern about how we look after your personal data, please contact us first at [email protected] — we are glad to listen and put things right as quickly as we can. You also retain the right to complain to Thailand's Personal Data Protection Committee office (PDPC) at any time.