This policy explains how LoanXsist ("LoanXsist" or "we") collects, uses and discloses personal data under Thailand's Personal Data Protection Act B.E. 2562 (PDPA). The Thai version prevails if the two versions differ.
1. Who is the controller
For data about shops and their users, such as the owner's name, email and billing details, we are the data controller.
For data about a shop's customers (borrowers, pawners, hire-purchase customers, guarantors) that the shop enters, the shop is the data controller. We are a data processor that stores and processes it only on the shop's instructions to provide the service. We do not use it for our own purposes, sell it, or use it for marketing.
2. What we collect
What we hold depends on how you use the service.
- Account data: name, email, phone, role, shop name and address, and documents sent for shop verification
- Billing data: plan, amount, payment date and receipt. Card details stay with Stripe, and we don't store card numbers
- Usage data: sign-in records, IP address, device and browser type, and audit logs of who did what
- Messages you send us: name, email and the message
- Data the shop records: names, national ID numbers, addresses, phone numbers, photos and documents, collateral details, contracts, schedules and payment history of the shop's customers, plus the shop's staff records such as time, leave and payroll
3. Why we use it
- To provide the service under our contract: open accounts, run the system, send the notifications the shop sets up, and bill for the service
- To keep it secure: prevent unauthorised access, detect abuse, and investigate breaches of the terms (legitimate interest)
- To meet legal duties: keep accounting and tax records, and respond to orders from competent authorities
- To answer questions and tell you important things about the service. We send marketing only with your consent
4. Service providers we use
We share data with these providers only as far as needed to run the service, under agreements that require them to protect it.
- Server and network providers, to store data and run the system
- Stripe, to take payments by card and PromptPay
- LINE and Telegram, to send notifications to the shop's accounts when the shop turns them on
- Expo, to deliver push notifications to the mobile app
- An email provider, to send account emails and replies
5. Transfers outside Thailand
Some providers process data outside Thailand. We transfer data only to countries or recipients with adequate protection as the PDPA requires, or under agreements that give equivalent protection.
6. How long we keep data
- Account data and data the shop records: while the account is open. After closure we delete or anonymise it within 90 days, unless the law requires longer
- Demo shops: deleted entirely after 24 hours
- Billing records: for the period accounting and tax law requires
- Security logs: no longer than needed for investigation, or as the law requires
7. Security
Data travels over HTTPS. Each shop's data is kept separate. Passwords are stored as one-way hashes. Shop staff can reach only what the owner allows. Repeated failed sign-ins are rate limited, and the system logs who did what. Our team accesses shop data only when needed to run the system or when the shop asks for help.
If a personal data breach risks people's rights, we will tell the affected shops without delay and notify the Personal Data Protection Committee office as the law requires.
8. Your rights
Data subjects have the right to access and get a copy, correct, delete, restrict, object to processing, receive or transfer their data, and withdraw consent, under the conditions in the law, and to complain to the Personal Data Protection Committee office.
If you are a customer of a shop that uses LoanXsist, contact the shop directly, because the shop controls your data. If you contact us, we will pass the request to the shop and help it respond.
For data we control, send requests to info@loanxsist.com. We reply within 30 days.
9. Cookies
We use only cookies the site needs to work, such as keeping you signed in and remembering your language. We do not use advertising or third-party tracking cookies.
10. Changes to this policy
We may update this policy, and the latest version is always on this page. For significant changes we will notify you in the system or by email before they take effect.
11. Contact
LoanXsist, email info@loanxsist.com