Home › Privacy Policy · Terms of Service
Privacy Policy
Who we are
TUNGKAO (tungkao.com) is operated by [not set: company name], [not set: address]. Contact: [not set: contact email]. This policy follows Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
Two roles
For your account (the merchant) we are the data controller.
For slip data you send us to verify (names and masked account numbers of payers and receivers, amounts, times) you are the controller and we process it only on your instructions, to give you the result. You must have a lawful basis to send it to us.
What we collect
Google account data when you sign in: email, name, Google account ID. We never receive your Google password.
Usage data: API keys (stored only as one-way hashes), IP address, request time and result, security events.
Data in slips you verify, deposit records, top-up records, webhook delivery logs.
Crypto service: deposit addresses issued to you, deposits, withdrawal requests and destination addresses, and identity documents if KYC is required before your first withdrawal.
One session cookie needed to keep you signed in. No advertising or tracking cookies.
Why we use it (legal basis)
To provide the service you signed up for (contract).
To prevent fraud, abuse and attacks, and to keep records of credits and payments (legitimate interest and legal obligation).
To verify identity and screen withdrawals where anti-money-laundering rules apply (legal obligation).
Who we share it with
Slip verification providers (Slip2Go, SlipOK, EasySlip) receive only the QR text of the slip to look it up.
Infrastructure: Google (sign-in), Cloudflare (network protection), DigitalOcean (servers in Singapore). Data may therefore be transferred outside Thailand to providers with adequate safeguards.
Authorities when the law requires it. We do not sell personal data.
How long we keep it
Account and credit records: while your account is active and up to 10 years after closing, for accounting and legal duties.
Slip and deposit records: up to 5 years unless you ask us to delete them earlier where the law allows.
Security logs: up to 1 year. KYC documents: as long as anti-money-laundering law requires.
Security
All connections are encrypted (TLS). Secrets are encrypted at rest (AES-256-GCM). API keys and sessions are stored only as hashes. Admin access needs Google sign-in plus two-factor codes. Crypto funds are held in hardware wallets whose keys never touch our servers.
Your rights
Under the PDPA you can ask to access, copy, correct, delete, restrict or object to processing of your data, withdraw consent, and request data portability. Write to [not set: contact email]. We answer within 30 days. You may also complain to the Personal Data Protection Committee (PDPC).
Changes
Effective date: [not set: effective date]. We will announce material changes in the merchant portal before they take effect.