Legal · Draft
PrivacyPolicy
What we collect and why. Exactly how long we keep it is still an open decision — see below.
This is a working draft, not yet in effect. It states what is already true of how the service handles data today; retention periods and a few other items are explicitly listed as undecided rather than filled in.
Who controls your data
I C Develop Co., Ltd., operating IC Lueur Ai, a company registered in Thailand.
What we collect
- Account & contact details
- The information needed to provision and operate an account and its organizations.
- Business verification documents
- Identity/KYC documents collected as part of account verification, stored encrypted with access restricted to staff who need them.
- Payment & billing records
- PromptPay top-up records and the data your tax invoice requires.
- API usage metadata
- Per-request token counts, latency, cost and model — the operational history behind your usage and invoices.
- Prompt & completion content
- The request and response content itself, which necessarily passes through this gateway on its way to the model provider that generates the answer. We do not currently store it: the proxy is configured to strip message content before any logging path sees it, and the usage record kept alongside your request holds only the counts and cost described above, not the text.
- How we use it
- To operate the gateway, generate your tax invoices, provide support, verify your account, and investigate problems with specific requests using the usage metadata described above. We do not use prompt or completion content to train a model, and today we do not retain that content at all — the proxy strips it before any logging path sees it. If we later introduce optional capture of request content for debugging, this policy will say so, and will state how long it is kept, before that starts.
- Who it is shared with
- To generate a response at all, your request necessarily reaches the model provider your routing policy allows — AWS Bedrock, Google Vertex AI or Azure AI Foundry. Beyond that, request and response content is not copied into any observability or debugging store we operate, and is not sold or shared with anyone else.
- Security
- Sessions use an HttpOnly cookie on a same-origin architecture, so there is no token for JavaScript to read. An API key secret is never stored — only a hash of it — so a database compromise cannot expose a usable key.
- Where processing happens
- Model inference runs on AWS, Google and Microsoft infrastructure. By default, a request is routed no further than Bangkok, Singapore or Tokyo; you can set a stricter routing policy on your key that keeps requests closer still, or opt in to a wider one.
Your rights under Thailand's PDPA
The Personal Data Protection Act gives you these rights over your own personal data as a matter of law, independent of anything above:
- Access — to know what personal data we hold about you.
- Correction — to have inaccurate data corrected.
- Erasure — to request deletion, subject to what we are legally required to keep (a tax invoice, for instance).
- Restriction and objection — to limit or object to certain processing.
- Portability — to receive your data in a usable format.
- Withdraw consent — where processing is based on consent.
- Complain — to Thailand's Personal Data Protection Committee.
Still being finalized
- Exact retention periods for account, billing and usage-metadata records — currently an open internal decision, not yet set. Prompt and completion content is not retained at all today; if that ever changes, a retention period will be decided and published here before it does.
- A full PII/KYC data inventory (what the blueprint calls for, not yet written).
- A Data Processing Agreement template for enterprise customers who are themselves data controllers.
- A published channel and process for exercising the PDPA rights listed above.
- A named contact for data protection questions.
- How and when this policy may change, and how you will be notified.