Privacy notice

For the data a shop keeps about its customers (names, phone numbers, devices, photos, payments, signatures, orders and questions), the shop is the data controller and we are its data processor: we process it only to run aaomm for that shop, on its instructions, never for our own purposes.

For the accounts of shop owners and staff, and for visitors to this website, we are the controller.

If you are a shop's customer, the shop decides what is kept about you, so please ask the shop first. We help shops answer such requests.

Shop owners and staff: name, phone number, a photo if one is added, language, and a password, kept only as a one-way hash that no one can read. Which phone each person signs in on, and a record of who saved what.

A shop's customers: what the shop enters, as above.

Anyone setting up a shop: the answers given while signing up (the shop's name, what it repairs, its size) and the one way to reach them that they type (a phone number, a LINE ID or an email). They are kept even if the sign-up is not finished, so we can help finish it, and deleted after 90 days if no shop is made.

Everyone: for security and to fix problems, the requests a browser makes (the page asked for, the time, the country, the browser and app version) and the errors the app reports. The network address is used only to count wrong sign-in tries, and kept only as a short one-way code, never the address itself.

To provide the service you or your shop signed up for (a contract), to keep it secure and fix problems (our legitimate interest), and to do what the law requires. We don't sell personal data, we show no advertising, and we never use a shop's data for anything but that shop's service.

With Cloudflare: each shop's records in a database of its own (a Durable Object), never shared with another shop, and its photos in Cloudflare R2, in that shop's own folder. Cloudflare has data centres around the world, so data may be processed outside Thailand; Cloudflare is bound by its data processing terms with us, which include safeguards for such transfers. AI features (Ask, reading labels and photos, specs, buyer words and translations) run on Cloudflare Workers AI, only when someone in the shop uses them.

Cloudflare, as our sub-processor. Alerts to staff phones pass through the phone maker's push service (Apple, Google or Mozilla), encrypted so it can't read them. Nobody else, unless the law makes us (a court order, for example). What a shop chooses to show its customers (a repair's status, its web page, its online shop) can be seen by anyone with the link.

Messages to customers (SMS or LINE) are sent from the staff's own phones, not by us.

A shop's records stay while the shop is open. Jobs are kept add-only, so their history stays complete, and an admin can delete a job for good. Request records and error reports are kept for up to 90 days. A copy of each shop's data is made every week so it can be restored, without passwords or keys; the copies go when the shop goes.

An owner can close the shop at any time by asking us (LINE @aaomm or hello@aaomm.com). 30 days after it closes, its records, photos and copies are deleted for good; until then it can be opened again. Download the shop's data before then if you want to keep it.

A demo shop made with Try it is deleted, with everything in it, 24 hours after it was made.

Someone removed by their shop can no longer sign in; what they saved stays in the shop's history, under their name, because those records are the shop's.

Every connection is encrypted (HTTPS). Passwords are kept only as salted hashes. Each person signs in on their own phone, and staff who aren't admins don't see costs or expenses. Each shop's data is kept apart from every other shop's. If personal data is ever breached, we tell the shops affected without delay, and the Office of the Personal Data Protection Committee within 72 hours where the law requires it.

Under the PDPA you can ask to see your personal data or have a copy, to correct it, to have it deleted or its use restricted, to object to its use, to have it moved to another service, and to withdraw consent where we relied on it. You can also complain to the Office of the Personal Data Protection Committee (PDPC).

Shop owners and staff: write to us. A shop's customers: ask the shop, which controls your data; if you can't reach it, write to us and we will pass your request on.

This website sets no cookies. A shop's app sets one, only to keep each person signed in on their phone; the app needs it to work, and it is never used to follow anyone. If we count visits to this website, we use Cloudflare Web Analytics, which sets no cookies.

aaomm: email hello@aaomm.com, LINE @aaomm. We answer requests about personal data within 30 days.