Privacy Policy

Data We Collect

• Account information such as name, email address, phone number, and company name.
• Usage data such as activity history, system logs, and technical records.
• Documents you upload and data extracted from those documents to provide the service.

Purposes of Data Use

• To provide and improve the performance of our service.
• To support users and resolve issues.
• To maintain security and prevent inappropriate use.
• To comply with applicable laws and regulations.
• Companies taking part (accounts created on or after 29 October 2026 take part from signup; older accounts only once they opt in; anyone can turn it off or on at any time in the privacy settings without affecting the service): to compile de-identified aggregate statistics of how each type of business usually posts its transactions with another type, and use them to suggest postings to all users. These statistics identify businesses only by their business classification code, use only transactions between juristic persons, and hold no name, tax ID, amount or account code of anyone. No personal data is shared, and the statistics are never published (details in Section 5 of the Data Processing Agreement).

Data Disclosure

We may share data with service providers necessary for our operations, such as hosting, payment processing, and email delivery. These providers are required to comply with security and privacy standards.

If you contact us through an ACCOS conversation channel (such as the ACCOS LINE Official Account), your messages, attachments, and related account details may be read and answered by a Supporter we have assigned, who may be an individual outside the company rather than an employee. Every Supporter acts as a data processor under an agreement made pursuant to section 40 of the Personal Data Protection Act B.E. 2562, can see only the conversations assigned to them, is prohibited from copying or exporting anything out of ACCOS, and has every access logged for audit.

We may also disclose data when required by a legal order or to protect the rights and safety of our users.

Data Retention and Security

We retain data only as long as necessary for its stated purpose and employ technical and organizational measures to protect it, including encryption, access controls, and regular security reviews. Document files on our servers are kept as follows: files that also have a copy in your Google Drive, 90 days from the date they were filed to Drive; files with no Drive copy, up to 7 years or until you delete them; files marked as not a document, 30 days. When you stop using the service, we delete your content within 90 days unless the law requires us to keep it.

Account and personal settings: retained while the service is in use. Erasure starts in the next processing cycle after receipt; it does not wait until day 90. Our response target is 30 days. Eligible erasure requests must be handled without delay and within 90 days of receipt. In-app notifications: 90 days from creation. Document-scan API logs: 90 days from creation. General audit logs: 365 days from the event. Accounting/tax documents and records relevant to disputes follow their specific legal obligations or controller instructions, with reasons communicated if a request cannot be fulfilled. These periods are not universal tax-document retention periods.

Data Subject Rights

• Request access to or a copy of your personal data.
• Request correction of inaccurate or outdated data.
• Request deletion or restriction of data processing as permitted by law.
• Withdraw consent (where applicable) and object to certain types of processing.
• Receive or transfer personal data in the legally required format where the conditions for portability apply
• Lodge a complaint with the Expert Committee through the Office of the Personal Data Protection Committee if you believe data protection law has been violated

Google Services Integration (Google API Services User Data)

ACCOS connects to Google services so that you can store signed accounting documents into your own Google Drive. Our use of data from your Google account complies with the Google API Services User Data Policy, including the Limited Use requirements.

ACCOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Permissions ACCOS Requests from Your Google Account

ACCOS requests only the https://www.googleapis.com/auth/drive.file scope, which allows the application to create, read, update, and delete only the files it creates or that you explicitly open with ACCOS. We cannot see or access any other files in your Google Drive.

Compliance with the Limited Use Policy

ACCOS affirms that data obtained from your Google account via OAuth will:

• Be used only to provide the user-facing features described in this Privacy Policy and the application (storing accounting documents in your Google Drive).
• Not be used to serve advertisements or to build marketing profiles for ACCOS or any third party.
• Not be read by humans, except (a) with your explicit consent, (b) when necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) when the data is aggregated and used for internal operations in a non-identifiable form.
• Not be transferred to third parties except as needed to provide or improve the service, when required by law, or as part of a merger or acquisition with comparable data protection guarantees.
• Not be used to train generalised AI or machine-learning models. Document content is sent to our AI processing provider only at the moment of extraction; under the provider's paid API terms, this data is not used to train or improve the provider's models.

AI Processing of Document Content

ACCOS uses an AI processing provider to classify each document (invoice, receipt, withholding tax certificate, etc.) and extract structured fields (counterparty, amount, tax, line items). Document content is transmitted to the AI provider only at the moment of extraction. The original file is stored on ACCOS servers in Thailand (Amazon Web Services, Thailand region) so you can view, review and import it. If you connect Google Drive, a copy is also filed into your own Drive, and the server copy is deleted on the schedule in "Data Retention and Security". Extracted structured data (text fields, not the original file) is stored in our application database so you can edit it, export it to your accounting software, and audit it later.

ACCOS Inbox — LINE OA Document Intake (Optional Module)

For accounting firms using the optional ACCOS Inbox module, your SME clients can send documents via LINE. The data flow is: (1) LINE delivers the file to ACCOS's webhook; (2) ACCOS uploads the file into your firm's Google Drive (drive.file scope) under a pending folder and records the sender's LINE display name so the firm knows who sent what; (3) by default, ACCOS keeps the original on its servers in Thailand until the firm picks the document type and imports it. AI reads the document only when the firm imports it, unless the firm has chosen automatic reading on arrival; (4) the Drive file is moved into the year/month/document-type folder of the correct SME client; (5) ACCOS posts a summary back to the LINE chat, where members can confirm it or report a correction, which is recorded for the firm to review. Server copies are deleted on the schedule in "Data Retention and Security". If the firm's Drive is temporarily unreachable, the file is held in an encrypted buffer (AES-256-GCM) and uploaded as soon as Drive reconnects.

Sub-processors

ACCOS uses the following service providers to operate:

• Google LLC — Google Drive API (storing your files in your own Google account)
• AI processing provider — document classification and data extraction (content is sent only at the moment of extraction and is not used to train models)
• Amazon Web Services — S3 (temporary file storage), ECS/CloudFront (hosting)
• MongoDB Atlas — Application database (documents and user records)
• Stripe — Payment processing (does not receive your Google data)

Revoking Access

You may revoke ACCOS's access to your Google Drive at any time in two ways: (1) Inside ACCOS, navigate to 'Cloud Storage Connection' and click 'Disconnect'; or (2) In your Google Account, visit https://myaccount.google.com/permissions, select ACCOS, and click 'Remove access'. After revocation, ACCOS will no longer be able to access your Google Drive. Files already created remain in your Drive under your control.

Contact Us

Contact address: 100 J.Press Tower 1, 12th Floor, Nang Linchi Road, Chong Nonsi, Yan Nawa, Bangkok 10120, Thailand

If you have questions about this Privacy Policy, please contact our team ataccos@botnlife.co or accos@botnlife.co