Privacy Notice

1. Who is responsible for your data

krobjob is software that restaurants use to run their business. Who is responsible depends on whose customer you are.

If you ordered, booked or left your details at a restaurant that uses krobjob, that restaurant decides what happens to your data (it is the "data controller"). krobjob stores and processes it for them, on their instructions (we are the "data processor"). Ask the restaurant first; you can also use the self-service page described in section 6.

If you use krobjob's own website or have a krobjob account (a restaurant owner, staff member or someone who contacted us), krobjob is responsible for that data.

2. What we hold

For a restaurant's customers, only what the order or booking needs:

• Contact details: name, email address, phone number, and a delivery address when you ask for delivery.
• What you bought: orders, bookings, reservations, prepaid packages, gift cards, vouchers, and any message you sent the restaurant.
• Notes the restaurant keeps: for example allergies or a seating preference, if they write them down.
• Payment: we record that a payment was made and for how much. Bank and card details are handled by the payment provider and the restaurant's bank, and are never stored by krobjob.
• Technical records: the pages served, the approximate area your network comes from, and short-lived security logs. We do not track you across other websites and we use only necessary cookies.
• If you sign in with LINE: the ID LINE gives us for your account and the name you use on LINE, so we know it is you next time. We do not receive your LINE password, your chats or your friends. If you add our LINE account as a friend, we can send you messages there; you can block it at any time.

3. Why we may hold it

Under the PDPA, each use needs a basis. Ours are:

• To do what you asked — take an order, confirm a booking, send a receipt.
• Because the law requires it — sales records have to be kept for tax and accounting.
• Our legitimate interest — keeping the service secure and working (for example stopping fraud and abuse).
• Your consent — for anything optional, such as marketing messages or precise location. You can withdraw it at any time.

4. How long we keep it

• Sales records (orders, receipts): kept for at least 5 years, because Thai accounting and tax law requires it. If you ask us to delete your data, your name, email, phone and address are removed from them and only the amounts and items remain.
• Bookings, reservations, guest notes, messages: kept while the restaurant uses krobjob, and deleted when you ask.
• Backups: a copy of the database is taken nightly, encrypted, and kept for 14 days. A deletion reaches the backups as those copies age out.
• Security and delivery logs: up to 12 months.
• Precise location (only if switched on): only the most recent position, deleted as soon as you switch it off and automatically after 90 days.

5. Who else can see it

We use these companies to run the service. They may process personal data on our behalf, and we have not yet signed separate data-processing agreements with all of them; where their standard terms include one, that applies.

We never sell personal data, and we do not use a restaurant's customer data for our own marketing.

• Neon (database, Singapore): where the data lives.
• Vercel (hosting, Singapore): runs the website and apps.
• Cloudflare R2 (backups): holds the encrypted nightly backups.
• Resend (email, Japan): sends order confirmations, codes and receipts.
• Sentry (error monitoring, Germany): receives error reports. Names, emails, phone numbers, ID numbers, addresses, cookies and the contents of requests are removed before anything is sent.
• Post for Me (social posting): used only when a restaurant connects its own social accounts, to publish that restaurant's posts.
• Google and Groq (AI features): used for the restaurant's own content, such as writing a menu description or a promo caption. Customer contact details are not sent to them.
• Payment providers: PromptPay payments go directly to the restaurant's own bank account. Card payments are switched off; if we switch them on, the card provider is named here first.

6. Your rights, and how to use them

You can ask to see the data a restaurant holds about you, to correct it, to delete it, to limit or object to its use, and to withdraw consent you gave.

The quickest way: open the restaurant's own page and tap "Your data" at the bottom (its address ends in /my-data). Enter your email, type the 6-digit code we send you, and you can download everything the restaurant holds or have it deleted straight away.

You can also email us at support@krobjob.com and we will answer within 30 days. If something is still in progress, such as an upcoming booking or an unpaid order, deletion waits until that is finished or cancelled.

If you think we have handled your data wrongly, you can complain to the Office of the Personal Data Protection Committee (PDPC) in Thailand.

7. Where your data is kept

The database is in Singapore, and the companies listed in section 5 are outside Thailand (Singapore, Japan, Germany, the United States). Data is encrypted while it travels, backups are encrypted, sensitive fields such as ID and bank numbers are encrypted in the database, and access is limited to the restaurant that owns the data and to krobjob staff who need it.

8. Cookies

We use only the cookies the service needs, such as keeping you signed in and remembering your basket. See our Cookie Policy.

9. Changes and contact

We update this notice when the service changes. The current version is always at this address.

Questions about your data: support@krobjob.com.