PrivacyPolicy
What we collect, how we use it, and how we look after your data.
Who looks after your data
I C Develop Co., Ltd., the company behind IC Lueur Ai, registered in Thailand.
What data we collect
- Account details
- What we need to open and run your account and organization, such as your name, email address and phone number.
- Identity verification documents
- KYC documents used to verify an account. Stored encrypted, and only staff who need them can open them.
- Payment details
- Your PromptPay top-up history and the details your tax invoice requires.
- API usage data
- Token counts, latency, cost and model for each request — the history behind your usage page and invoices.
- Sign-in data
- Sign-in, failed sign-in, password reset and two-factor events, with IP address and user agent.
- System logs
- Request-level technical records (endpoint, status, error code, latency) used to find and fix problems. They do not include request or response content by default.
- Request and response content
- Your requests and the answers pass through our gateway on the way to the model provider, but we do not store them: they are not written to any log or store of ours, and the usage record kept for each request holds only counts, cost and status — not the text.
How long we keep it
Each kind of data has its own retention period:
- Account data While active + 90 days
- Kept while your account is active. After you close it, personal data is deleted or anonymized within 90 days, except what the law requires us to keep for tax, accounting, audit or disputes.
- Payment data 7 years
- Top-up, payment, refund and credit transactions, matching Thai accounting-record requirements.
- Tax invoices 7 years
- Electronic tax invoices, receipts, debit and credit notes, and their submission records.
- API usage data 2 years
- Token counts, cost, model and status for each request. Request and response content is not included — we do not keep it at all.
- Sign-in data 1 year
- Sign-in, failed sign-in, password reset and two-factor events, with IP address and user agent.
- System logs 90 days – 1 year
- Depending on operational need. No request or response content by default.
- Holding data for legal reasons
- Any of the above can be kept longer during a tax or accounting audit, a legal investigation, or a payment or customer dispute. Deletion resumes once that ends and no other legal requirement applies.
How we use it
- To run the API gateway.
- To issue your tax invoices.
- To help you when you contact support.
- To verify your account.
- To investigate problems with specific requests, using the API usage data above.
We do not use request or response content to train any model, and today we do not keep that content at all. If we ever add optional capture of request content for debugging, this policy will say so — including how long it is kept — before it starts.
How we protect your data
- Sign-in uses an HttpOnly cookie on the same domain, so there is no token for JavaScript to read.
- We never store your API key itself — only a hash — so even a database leak cannot expose a usable key.
- Identity verification documents are stored encrypted, and only staff who need them can open them.
Where your data is processed
- Stored in Thailand
- Account and financial data are stored in Thailand.
- API processing
- API requests may be processed in Singapore, Tokyo or on a global network, depending on the routing you choose.
Models run on AWS, Google and Microsoft infrastructure. Each API key has a routing policy:
- Regional (default) — can switch between Singapore and Tokyo.
- Strict — stays in the nearest region only.
- Available — opt-in; any region that serves the model, including a global network.
Your rights under the PDPA
In short: you can see, correct, delete or get a copy of your data, limit or object to how it is used, withdraw consent, and complain to the regulator.
These rights are yours by law, regardless of anything else in this policy:
- Access — know what personal data we hold about you.
- Correction — have inaccurate data corrected.
- Erasure — ask us to delete it, except what the law requires us to keep (a tax invoice, for instance).
- Restriction and objection — limit or object to certain processing.
- Portability — receive your data in a usable format.
- Withdraw consent — where processing is based on consent.
- Complain — to Thailand’s Personal Data Protection Committee.
To exercise any of these rights, use our contact form or email us at support-d@ic-lueur.ai, stating which right you want to exercise.
We verify your identity via the email address or phone number already on your account before acting on the request, and respond within 30 days.
Data protection contact
We have not appointed a formal Data Protection Officer, so questions about this policy or how we handle your data go to our Data Protection Team, not a named individual — that way this stays reachable even as who's on the team changes. support-d@ic-lueur.ai · support@i-c-develop.com
If we change this policy
We may update this policy when our service or legal requirements change, and we will tell you about important changes.
- Every version states what changed and when it took effect.
- Important changes — ones that affect your rights or how we use your data — are announced by email, an in-app notice, or a banner on this page.
- Where the law requires it, we ask for your consent again.