Privacy Policy

1. Introduction and data controller

This policy explains how HugWeb, operated by บริษัท ซูเปอร์เดฟ จำกัด (Superdev Co., Ltd.) (เลขที่ 89 รามคำแหง 82 แขวงหัวหมาก เขตบางกะปิ กรุงเทพมหานคร 10240, tax ID 0105563058564), collects, uses, and discloses your personal data when you subscribe to our website-building service (“the service”), under Thailand's Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). If you have any question about your personal data, contact us at [email protected].

2. Data we collect

We collect five main categories of data, matching how the service is actually used:

• Account data — Email, password (stored hashed, never as plain text), and username.
• Business data — Shop name, address, services offered, and sales channels (LINE/Shopee/TikTok/IG and so on) that you enter when creating a website, so the AI can build the site and use that information to suggest content.
• Payment data — Payment history and the plan you subscribed to, via the payment provider PaySo (Pay Solutions). We do not store your credit or debit card number ourselves.
• Technical data — IP address, the session cookie (hw_session), and usage logs kept for security and troubleshooting.
• Data from contact forms on the website you publish — When a visitor to your website submits a contact form, you (the website owner) are the data controller for that data under the law. HugWeb acts solely as a data processor on your instructions — the privacy policy shown to visitors of your website is your responsibility, not HugWeb's.

3. Purposes and legal bases for processing

We process each category of data on a different legal basis, per section 24 of the PDPA:

• Performance of a contract — Account data, business data, and payment data, in order to build and maintain your site and bill for the service.
• Consent — Marketing emails and messages (optional, never a condition of using the service).
• Legitimate interest — Security logs, fraud prevention, and the session cookie that the system needs to function.

4. Disclosure to third parties

We share only what is necessary with the following providers, who act as data processors on our behalf:

• PaySo (Pay Solutions) — Processes payments and PromptPay QR.
• ThaiBulkSMS — Sends verification and notification emails (when enabled).
• Cloudflare — Web infrastructure (CDN and file storage for published websites).
• Google Cloud Platform — Servers running the backend system.

We do not sell your personal data to third parties for marketing purposes.

5. Cross-border data transfers

The infrastructure providers we use (Cloudflare, Google Cloud Platform) may store or process data on servers located outside Thailand. Where that happens, we rely on the safeguards set out in sections 28-29 of the PDPA (such as standard data-transfer contracts and the providers' own data-protection policies) so that your data remains adequately protected even when processed abroad.

6. Data retention

• Account and business data — kept for as long as you use the service, and deleted within a reasonable period after your account is closed.
• Payment records and tax invoices — kept for at least 5 years as required by the Revenue Code, even after you request account deletion.
• Technical security logs — kept only for as long as security review requires.

7. Your rights as a data subject

Under the PDPA you have the following rights over your personal data:

• Access your data and request a copy of it.
• Correct inaccurate data and bring it up to date.
• Request erasure or destruction of your data (except where another law requires us to keep it, such as tax records).
• Object to, or restrict, some of the processing.
• Receive your data in a commonly usable format in order to move it to another provider.
• Withdraw marketing consent at any time, without affecting your use of the core service.

You can exercise these rights from your account settings, or by sending a request to [email protected] — we will respond within 30 days.

8. Cookies

The session cookie (hw_session) keeps you signed in — it is strictly necessary for the system to work, so it does not require separate consent. If we later add analytics or marketing cookies, we will show a consent banner with clearly separated categories, never bundled together with the necessary ones.

9. Data security

We apply appropriate technical and organisational measures to protect your data, such as encryption in transit (HTTPS/TLS), restricting data access to those who need it, and reviewing our systems regularly.

10. Changes to this policy

When we make a material change to this policy, we will notify you by email or by an in-app announcement before it takes effect. Each version of the policy carries a version number so it can be traced back to which version you consented under.

11. How to complain

If you are unhappy with how we handle your personal data, you have the right to complain directly to Thailand's Personal Data Protection Committee office (PDPC), in addition to contacting us first.