Privacy Policy

Expat Law Thailand Ltd. (the “Controller”, “we”, “us”) is responsible for the personal data processed through expatlawthailand.lovable.app. For privacy questions: office@expatlawthailand.com.

• Account data: email and authentication credentials when you sign up.
• Document inputs: the information you enter into a draft — names, addresses, dates, contractual terms, etc.
• Payment data: processed by Stripe; we receive the transaction status and last 4 digits, never the full card number.
• Technical data: minimal server logs (IP address, request path, timestamp) used to operate and secure the service.

• Performance of a contract — to generate and deliver the document you ordered, and to give you access to it from your account.
• Legitimate interests — to prevent fraud, maintain security, and improve the service.
• Legal obligation — to comply with Thai tax, anti-money-laundering, and consumer-protection rules.
• Consent — for optional cookies (see Section 7).

To draft your document we send your form inputs to a third-party large language model accessed through the Lovable AI Gateway. The provider processes the inputs only to produce the response and does not use them to train its public models. Outputs are written back to your account record.

We share personal data only with:

• Stripe — payment processing (Ireland / United States, under EU SCCs).
• Supabase / Lovable Cloud — database, authentication, and hosting (EU region).
• Mekin Lawyer Office — only if you opt into the lawyer review add-on, and only the draft + your contact details.
• Public authorities when required by a valid legal order in Thailand.

Generated documents and order records are kept for as long as you have an account, plus 5 years for tax/audit compliance. Server logs are kept for 30 days. You can request deletion at any time (see Section 8).

We use only strictly necessary cookies (login session, CSRF, cookie-consent state). We do not run advertising trackers or cross-site analytics. If we add optional analytics in the future, we will ask for your explicit consent first.

Under Thailand's PDPA and (where applicable) the EU GDPR you have the right to access, rectify, erase, restrict or object to processing, and to data portability. To exercise any of these rights, email office@expatlawthailand.com. You also have the right to lodge a complaint with Thailand's PDPC or your local supervisory authority.

Data is stored on encrypted infrastructure with row-level access controls. Passwords are hashed; payments never touch our servers. Access is restricted to staff who need it to operate the service.

We will post material updates here and, where required, notify you by email.