This Privacy Policy explains how Expat Shield AI™ ("we", "us", "the app") collects, uses, stores and protects your personal information when you use our website and mobile application. We comply with Thailand's Personal Data Protection Act B.E. 2562 (PDPA) and the EU General Data Protection Regulation (GDPR).
1. Data we collect
- Account data: email address, display name, language preference.
- Payment data: processed by Stripe; we receive only a payment confirmation, the last four digits of the card and a transaction reference. We never store full card numbers.
- App content: documents you upload to the encrypted vault, notes, and emergency contacts. This data is encrypted at rest using AES-256.
- Usage data: anonymous usage statistics (page views, feature usage, crash reports) used only to improve the product.
2. How we use your data
- To provide and maintain the service you paid for.
- To process your one-time payment and grant lifetime access.
- To send essential service notifications (security, regulation changes you opted in to).
- To improve product quality and fix bugs.
We do not sell, rent or share your personal data with advertisers.
3. Legal basis
We process your data based on (a) the contract you enter when purchasing lifetime access, (b) your explicit consent for optional features (push notifications, analytics) and (c) our legitimate interest in keeping the service secure.
4. Data storage and security
Data is stored on secure cloud infrastructure with end-to-end encryption. Document vault content is encrypted client-side with AES-256 before being transmitted. Access requires authentication and, where supported, biometric verification.
5. Your rights
- Access — request a copy of the data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — delete your account and all associated data.
- Portability — receive your data in a machine-readable format.
- Withdraw consent at any time for optional processing.
To exercise any of these rights, contact us at privacy@expatshield.ai. We respond within 30 days.
6. Third-party processors
- Stripe — payment processing.
- Supabase — authenticated database and storage.
- Lovable AI Gateway — large-language-model responses for the AI assistant.
All processors are bound by data-processing agreements and GDPR-compliant safeguards.
7. International transfers
Some processors may be located outside Thailand or the EU. Transfers rely on Standard Contractual Clauses or equivalent safeguards.
8. Children
The service is not intended for users under 18.
9. Changes to this policy
We may update this policy. Material changes will be notified in-app or by email at least 14 days before they take effect.
10. Contact
Questions? Email privacy@expatshield.ai.