Legal

Privacy Policy

Last updated: 13 October 2026

In short

We collect only what we need to run this website and our products.
This website sets no cookies and uses no analytics, advertising or tracking.
Your card details go to Stripe, never to us. We do not sell personal data.
When you use an AI feature, the text, files or images you enter are sent to an AI provider so that it can produce the result. Section 4 says which providers we use.
If you use the message form on this website, we store your name, email and message and email them to our team. We keep them for 24 months and then delete them. Section 2.11 gives the details.
Our other forms (enquiry, access request, consultancy, and teacher and job forms) work in a similar way. Section 2.12 gives the details.
We use a small set of providers to run our products. Section 4 lists them.
Our providers run servers in several countries, so your data may leave your country.
You can ask for a copy of your data, a correction or deletion by emailing [email protected].

1. Who is responsible

1.1 XAGlobal, registered in Thailand (business registration number 8006069000003), of 108/2 Moo. 2, Umphur Chawang, Thambon NaGaCha, Nakorn Sri Thammarat, Thailand, 80150 ("XAG", "we", "us") runs this website and our education apps, business apps and developer tools (together, "the Services").

1.2 We have two roles:

For our own data about visitors, account holders, billing and technical records, we decide why and how the data is used. In the language of Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), we are the "data controller" for that data.
For information that you put into a Service about your own clients, leads, members, staff, contacts or students, you decide why and how it is used, and we process it for you. For that data, we are the "data processor".

1.3 If you are a client or contact of one of our customers and you want to know what that business holds about you, please ask that business first. We will help them answer you.

1.4 This policy says what we commit to doing. It is written with the PDPA as its baseline. We do not claim any certification or approval under any law or scheme.

1.5 Education apps that are for sale are subscribed to from their own Get access pages. Our business apps and developer tools are in private preview: access is by request, and no billing is switched on for them. This policy covers the Services as they run today and will be updated as they change.

2. What we collect

2.1 When you visit this website. We do not ask you to create an account. We do not set cookies. The website loads everything from our own address and makes no requests to other companies. Like any website, our hosting provider handles technical request data such as your IP address, browser type, the page requested and the time. If you send the message form (see 2.11), your browser sends it only to our own address. Our server then passes it on to our database and email providers.

2.2 When you write to us. If you email [email protected], we receive your email address, your name if you give it, and whatever you write. Emails sent to this address reach the person who runs XAG through an email forwarding and inbox service. If you use the message form on the home page instead, see 2.11.

2.3 Account data. When you have an account, we hold your email address, your name if you give it, your workspace or company name, your role, whether you have confirmed your email, and your password as a one-way hash, which means we cannot read it. If you are invited to a workspace, we also hold the invitation (your email address and role).

2.4 Billing data. Stripe handles payments through Stripe Checkout. We keep your Stripe customer and subscription identifiers, your plan status and your trial dates. Your card details go to Stripe and never to us. When you check out, we send Stripe your email address and an identifier for your workspace and product. For our education apps we also keep the email address you gave at checkout, the plan you chose, your subscription status and your access code, which we store as a one-way hash (so we cannot read it). To give only one free trial per customer and card, we keep a one-way hash of an identifier that Stripe gives us for your card (not the card number) and a standard form of your email address.

2.5 Your Data. This is what you or your team put into a Service. In business apps it can include names, email addresses, phone numbers, postal and site addresses, notes, quotes, invoices, deals, memberships, licence and certificate details, review text and reviewer names, and message templates. In education apps it can include the text, files or images that teachers, schools, parents or learners enter, which can include information about learners. In developer tools it can include web addresses and settings you register, such as API endpoints and webhook addresses, headers and signing secrets (stored encrypted), and the events, costs, spending decisions, dispute records and other data that your programs send to our API. Some developer tools are built to avoid storing sensitive values, for example by storing a one-way hash, a data shape or a credential's name instead of the value itself. If you want to know what a tool stores, ask us at [email protected]. Please do not send us secrets or personal data that the tool does not need, and do not enter payment card numbers, passwords or government ID numbers. In education apps, the school, teacher or individual who enters information about students owns and controls it, decides what to enter, and is responsible for having the right to enter it. Please enter the minimum needed; for example, Secure IEP encourages initials rather than full names. We process that content only to provide the feature you ask for, as a service provider acting for you, and we do not use it for our own purposes. It passes through our servers to the AI provider the service uses (section 4).

2.6 Usage, audit and notification records. We keep counts of what you use (for example checks, decisions or drafts), a log of important actions in your workspace (such as sign-up, invitations, API key creation and password changes, with details like the email address involved), and the notices we show you in the Service.

2.7 Technical and error records. When something goes wrong, we record an error reference, the error message, the page or path, the request method, the status, the app version and your browser type (user agent). We also record slow responses, rejected sign-in attempts and server health checks. If you press "Report a problem", we record the message you write. We do not write passwords or the contents of requests to our logs. Except for the message form (see 2.11), our application does not save your IP address in our database. It uses it briefly in memory to limit abuse, and our hosting providers may keep it in their logs.

2.8 Emails and texts. We send emails such as email confirmation, access codes, password reset, invitations, alerts, reminders and digests. Some Services also send emails or texts to your own contacts on your behalf, for example review requests, quotes, payment reminders and follow-ups. We use the contact details that you gave us for that purpose.

2.9 Passwords. When you choose a new password, we check it against a public list of leaked passwords without sending the password itself or your email address. Only the first five characters of a one-way hash leave our server. Section 4 gives the details.

2.10 What we do not collect. We do not use advertising identifiers, we do not track your location, and we do not ask for payment card numbers. Education apps let schools, teachers and individuals enter education and special-education information about students: see 2.5 and clause 7.10 of the Terms.

2.11 Message form on this website. The home page has a message form. If you press Send, we receive and store: your name, your email address and your message; a short label for the form you used; the time you ticked the agreement box; your browser type; and a scrambled (hashed) version of your IP address instead of the address itself. We use the scrambled IP address and the browser type only to limit abuse. We use the rest to read and answer your message and to run our service. We store it in our database, which is a cloud database service run for us by Supabase, and we email a copy to [email protected] through the Resend email service. We keep enquiries for 24 months and then delete them (see 6.8). You can ask to see, correct or delete your message at any time by emailing [email protected] (see section 8). The form is for adults. Please do not put a child's name or other details about a child in your message.

2.12 Other forms on our sites and apps. Our other sites and apps have forms too: contact, enquiry, access request and consultancy forms, and teacher and job forms on our education website. They work in a similar way. What you enter is stored in our database, which is a cloud database service run for us by Supabase, and we email a notice to [email protected] through the Resend email service. We keep enquiries and teacher information for 24 months and then delete or anonymise them (see 6.9). These forms are for adults, including parents and guardians. Where a form asks for details about a child (for example the learner information form on our education website), a parent or guardian fills it in, with the parent's consent (see section 10).

2.13 Share and save, and free or test access. If Share and save is switched on in a Service, we may keep:

a share code: a random code that is not linked to your access code;
a one-way (hashed) version of the email address and of the card identifier of the sharer and the friend, which we use only to check for abuse such as self-referral. We keep these for 24 months and then delete them;
the share code in your browser's storage on your device, for up to 30 days;
for free or test access: your email address, the app, the kind of access, the dates, a short note from the owner, and a hash of the code we email you. We keep these while the access is valid and for 24 months after, and we may erase them sooner on request. The audit log holds only a hash of the address.

3. Why we use your data, and our legal basis

3.1 The PDPA requires a legal basis for each use of personal data. These are ours:

To create your account, run the Services and give you support. Legal basis: it is needed to carry out our contract with you.
To take payments, keep accounting and tax records and meet other legal duties. Legal basis: legal obligation, and our contract with you.
To keep the Services secure, prevent abuse, find and fix errors, and keep the Services working. Legal basis: our legitimate interests, which we balance against your rights.
To answer your emails and requests. Legal basis: our legitimate interests, and our contract with you where you are a customer.
To read and answer a message sent through the message form on this website or through one of our other forms (see 2.12), and to limit abuse of those forms. Legal basis: the consent you give by ticking the box on the form (for the learner information form, the consent of the parent or guardian), which can be withdrawn at any time, and our legitimate interests in stopping abuse.
To tell you about changes to the Services or these policies. Legal basis: our contract with you, and our legitimate interests.
To do anything else, we will ask for your consent first. You can withdraw consent at any time. We do not send marketing emails at the moment.

3.2 For Your Data, we use it only to run the Services for you, on your instructions. You are responsible for having a lawful basis to put it in.

3.3 We do not sell personal data and we do not use it for advertising. AI output can be wrong, so a person must review any AI draft before it is used. Some developer tools apply rules that you set, for example to allow or block a spend or to settle a dispute between two parties. They act on your rules, not on ours.

4. Who we share your data with

4.1 We share data only with providers that help us run the Services, and only as needed. At the moment, these are:

Supabase: our database provider. It stores account data, Your Data, technical records and the messages sent through the message form on this website and through our other forms. For our education apps it also stores the records of subscriptions and access codes. Its servers may be outside Thailand.
Render: runs our product servers, in its Singapore region. That is outside Thailand.
Stripe: processes subscription payments, through Stripe Checkout and the Stripe customer portal. Stripe also uses some data for its own legal duties, such as fraud prevention. Our Stripe account is registered in Thailand.
Resend: our email service provider. We send our emails, such as email confirmations, access codes, password resets, invitations and alerts, through it. We also receive the notice of a message sent through the message form on this website, and through our other forms, through it. It handles the addresses and content of those emails.
AI providers: some of our products have an AI feature, which is used only when you use that feature. The text, files or images you enter in the feature are sent to an AI provider so that it can produce the result. The provider is the one whose key the service is set up with. At the moment, in production, this is Google (Gemini). If we change the key, the service may use another provider, for example Anthropic or an OpenAI-compatible provider. The provider's own terms and privacy commitments apply to that data (see 6.10). For example, a review-reply feature sends the review text, the reviewer's name, the star rating, the name of the review site and the business name to draft a reply.
Twilio: sends text messages. Only products with a text feature use it, and only when the feature is switched on. It receives the phone number and the message.
GitHub: hosts our source code and may also hold encrypted backups of our database.
Have I Been Pwned: a public service that checks whether a password has leaked. It receives only the first five characters of a one-way hash of the password, so it cannot tell which password or whose account it is.
Cloudflare: hosts this website, and runs the small program (a Pages Function) that receives the message form. It also hosts our other websites and runs the small programs that receive their forms. It handles request data such as IP address and browser type. Also, where a product's website has a connection check and cannot reach its own server, your browser makes one connection test to a Cloudflare address so that the page can tell whether your internet is down. Cloudflare can see your IP address in that request, like any website you visit.
Our email forwarding and inbox provider, for messages sent to [email protected], including the notices from the message form.

4.2 We may also share data with professional advisers, with authorities when the law requires it, and with a buyer if we sell or reorganise our business, if your data stays protected as this policy describes.

4.3 We expect our providers to use the data only to provide their service to us, under their own terms and privacy commitments.

4.4 Language menu. If you choose a language in the language menu, your browser opens the page through Google’s translation service (translate.goog). Google handles that request under its own privacy policy and may set cookies of its own. We do not receive your language choice, and our own pages set no cookies.

4.5 For Your Data, our Data Processing Addendum lists our sub-processors by type and says how we tell you about changes.

5. Moving data between countries

5.1 Our providers run servers in several countries, which may include the United States and other countries outside Thailand. Our product servers run in Singapore. Your data may therefore be processed outside Thailand and outside your own country.

5.2 When we send personal data abroad, we use only what is needed, we choose providers that publish security and privacy commitments, and we use encrypted connections. We aim to put contractual safeguards in place where the law requires them.

6. How long we keep data

6.1 Account and workspace data: while your account is open. When you ask us in writing to close your account or delete your data, we will do it within 30 days, except for what the law requires us to keep.

6.2 Backups: we may keep encrypted backups of our database. We keep each one for up to 30 days, so deleted data leaves them within that time.

6.3 Billing and tax records: as long as tax and accounting law requires.

6.4 Some developer tools delete old technical data automatically, for example check results after 90 days, a check log after 30 days, and raw cost events after about 40 days, while hourly totals are kept.

6.5 Error, audit and health records: we aim to keep them for no longer than 12 months. If you ask us in writing to delete records about you, we will act on your request within 30 days.

6.6 Emails to [email protected]: as long as needed to deal with your request, and then up to 2 years.

6.7 Sign-in sessions end after 30 days, or when you change or reset your password. Invitation links last 7 days, password reset links last 1 hour and email confirmation links last 2 days.

6.8 Messages sent through the message form on this website: we keep them in our database for 24 months and then delete them. We may delete them sooner if you ask (section 8). The email notice we receive is kept in our inbox as described in 6.6.

6.9 Enquiries and teacher information sent through our other forms (see 2.12): we keep them in our database for 24 months and then delete or anonymise them. We may delete them sooner if you ask (section 8). The email notice we receive is kept in our inbox as described in 6.6.

6.10 AI providers: the text, files or images you send to an AI feature are handled by the AI provider under its own terms. We do not control how long it keeps them, and we make no promise on its behalf.

7. How we keep data safe

7.1 These are the main measures we use.

Our websites and servers use encrypted connections (HTTPS), and we tell browsers to always use them.
Passwords are stored as one-way hashes. They must be at least 10 characters and are checked against a list of leaked passwords.
Sign-in tokens are signed, expire after 30 days and stop working when you change your password.
API keys, invitation links, reset links and confirmation links are stored only as one-way hashes. An API key is shown once, when you create it.
Some tools store sensitive settings, such as headers you register, encrypted.
Each workspace's data is kept separate in our application, and browsers cannot read our database directly.
We limit how often sign-in and API calls can be made, to slow down abuse.
Our servers refuse to be pointed at private or internal network addresses.
We do not write passwords or request contents to our logs.
We limit access to our production systems and data to the people who need it to run the Services.

7.2 No online service is completely secure, and we cannot promise that nothing will ever go wrong. If a breach affects your personal data, we will tell you without undue delay and notify the authorities as the law requires.

8. Your rights and how to use them

8.1 Under the PDPA, and under similar laws elsewhere, you may have the right to:

ask for access to your personal data and for a copy of it;
ask us to correct data that is wrong or out of date;
ask us to delete your data;
ask us to limit how we use your data;
object to a use of your data;
ask for your data in a form you can move to another service;
withdraw consent where we rely on it.

8.2 To use any of these rights, email [email protected]. We may need to check that you are who you say you are. We will answer within 30 days. We do not charge for ordinary requests.

8.3 If your request is about Your Data, which we process for a customer, we may pass it to that customer so they can answer.

8.4 If you are not happy with how we handled your data, please tell us first. You may also complain to Thailand's Personal Data Protection Committee, or to the data protection authority in the country where you live.

9. Cookies and tracking on this website

9.1 This website sets no cookies. It has no analytics, advertising or tracking tools, and it loads no scripts, fonts, images or other files from other companies.

9.2 The website uses your browser's session storage for one item, called "xag-intro". It remembers that you have already seen the opening animation during this visit. It stays in your browser, we never receive it, and it is cleared when you close the tab or browser.

9.3 The website reads a few of your device settings, such as reduced motion, data saver and reduced transparency, to adjust its animation. They are used on your device only and are not sent anywhere.

9.4 A small light in the top bar shows whether your connection is working. It does this by asking our own website for one of its own files every 60 seconds while the page is open, and when your connection changes. The request goes only to our own website and carries nothing beyond what every web request carries, such as your IP address.

9.5 Our products' websites set no cookies and have no analytics or advertising tools. They keep your sign-in token or access code and your chosen workspace in your browser's local storage so that you stay signed in, and some keep your language or display currency. You can clear these from your browser settings, which signs you out.

10. Children

10.1 The person who creates an account or subscribes must be an adult aged 18 or over. Some of our education apps are used by children, with a parent, guardian, teacher or school. Forms on children's screens do not collect names or contact details. The exception is a form that a parent or guardian fills in, with the parent's consent, to give details about a child, such as the learner information form on our education website (see 2.12). If you think a child has given us personal data that they should not have given, please tell us and we will delete it. The message form on this website is for adults: please do not put a child's name or other details about a child in a message. We do not claim any certification or approval of any Service under a children's privacy law.

11. If you are in the EU, the UK or Australia

11.1 This part is a short note for people in those places. It does not add to or replace the rest of this policy.

EU and UK: where the GDPR or the UK GDPR applies to you, the controller is the business named in section 1. Our legal bases are those in section 3. You may complain to your local data protection authority. For transfers out of the EU or the UK, we aim to use recognised safeguards such as standard contractual clauses.
Australia: if the Privacy Act 1988 applies, you may complain to the Office of the Australian Information Commissioner. We will notify eligible data breaches as the law requires.

12. Changes to this policy

12.1 We may update this policy. When we do, we change the "Last updated" date at the top.

12.2 For changes that matter, we will tell you by email or in the Service at least 14 days before they take effect.

13. Contact

13.1 Questions, requests and complaints: [email protected].

13.2 XAGlobal, registered in Thailand (business registration number 8006069000003), 108/2 Moo. 2, Umphur Chawang, Thambon NaGaCha, Nakorn Sri Thammarat, Thailand, 80150.