Privacy Policy

Last updated: July 12, 2026

This Privacy Policy explains how SPACE B CO., LTD. (บริษัท สเปซบี จำกัด), a company registered in Thailand (“CloseMaster”, “we”, “us”, or “our”), collects, uses, discloses, and protects personal data in connection with the CloseMaster platform available at closemaster.ai(the “Service”).

CloseMaster is an AI sales-assistant platform that lets businesses connect their Facebook Pages and LINE Official Accounts so that an AI assistant can respond to customer chats, recommend products, take orders, and help collect payment, with human staff able to supervise and take over at any time.

We comply with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and, where applicable, other data protection laws such as the EU General Data Protection Regulation (“GDPR”).

1. Who this policy covers, and our role

This policy covers two groups of people:

Merchants — businesses and their staff who create a CloseMaster account and use the Service. For Merchant account data, we act as the data controller.
End Customers— people who chat with a Merchant’s Facebook Page or LINE Official Account. We process End Customer data on behalf of the Merchant, who is the data controller of that data; we act as a data processor. If you are an End Customer, the business you chatted with is primarily responsible for your data, but you can also contact us directly using the details in Section 13 and we will help.

2. Personal data we collect

2.1 Merchant account data

Name, email address, and profile photo, collected through our authentication provider (Clerk) when you sign up or sign in.
Workspace (organization) details: business name, team members and their roles, language and currency preferences.
Payment-receiving settings you configure so the Service can generate payment instructions for your customers: bank name, account holder name, account number, and/or PromptPay ID (which may be a mobile number, national ID number, or e-wallet ID), and an optional payment QR image.

2.2 Business content Merchants provide

Product catalog, prices, knowledge-base documents, reply templates, AI assistant configuration, and internal notes.

2.3 Connected platform data

Facebook:when a Merchant connects a Facebook Page via Facebook Login, we receive the list of Pages the Merchant manages (Page ID, name, and picture) and a Page access token that allows us to receive and send messages on that Page’s behalf.
LINE: when a Merchant connects a LINE Official Account, we store the channel credentials (channel ID, channel secret, and channel access token) needed to receive and send messages.

2.4 End Customer data (processed for the Merchant)

Platform identifiers: the page-scoped Facebook user ID (PSID) or LINE user ID, display name, and profile picture provided by the platform.
The full content of chat messages exchanged with the Merchant’s Page or LINE account, including attachments.
Contact and order details shared during a conversation, such as phone number, email address, delivery address, items ordered, amounts, shipping carrier, and tracking number.
Payment evidence: bank-transfer slip images uploaded by the End Customer, and the data extracted from them for verification (bank, account holder name, partially masked account number, amount, and transfer reference).
AI-generated conversation summaries kept for the Merchant’s reference, such as sentiment, interests, and notable facts mentioned in chat.

2.5 Technical data

Server logs (IP address, browser type, timestamps, pages visited) and essential cookies (see Section 10).

3. How we use personal data

To provide the Service: receive and deliver chat messages, generate AI replies, maintain the shared inbox, manage orders, generate payment QR codes, and verify payment slips.
To operate accounts: authentication, workspace management, billing, and customer support.
To keep the Service safe: security monitoring, abuse prevention, and debugging.
To improve the Service: aggregate, non-identifying usage statistics.
To comply with law: responding to lawful requests and keeping records we are legally required to keep.

We do not sell personal data. We do not use message content or End Customer data for advertising, and we do not use it to train our own or third-party AI models.

Under the PDPA/GDPR, our legal bases are: performance of a contract (providing the Service to Merchants), legitimate interests (security, service operation, support), legal obligation, and consent where required.

4. AI processing

To generate suggested and automatic replies, chat messages and relevant business content (such as the product catalog) are processed by large language models operated by third-party AI providers (currently Anthropic’s Claude models accessed via OpenRouter). These providers process the data solely to generate the response and, under the API terms we use, do not use it to train their models. AI replies are always attributed to the Merchant’s account, and Merchant staff can pause the AI and take over any conversation.

5. Facebook Platform data

Our use of data received from Meta Platforms complies with the Meta Platform Terms and Developer Policies. We request the following permissions, and use them only as described:

Permission	Why we need it
pages_show_list	To show the Merchant the Pages they manage so they can choose which Page to connect.
pages_messaging	To receive messages sent to the connected Page and send replies (AI or human) on the Page’s behalf.
pages_manage_metadata	To subscribe the connected Page to our webhook so messages are delivered to the Service.
business_management	To list Pages owned through the Merchant’s Meta Business portfolio during connection.

Page access tokens are stored securely and used only to operate messaging for the connected Page. We do not use Facebook data for any purpose other than providing the Service to the Merchant who connected the Page. When a Merchant disconnects a Page or deletes their workspace, we stop using the associated token. You can request deletion of data obtained from Facebook at any time — see our Data Deletion page.

6. LINE platform data

Our use of data received from the LINE Messaging API complies with LINE’s terms and policies. We use LINE user IDs, display names, profile pictures, and message content solely to operate chat for the connected LINE Official Account, in the same way as described for Facebook above.

7. When we share personal data

We share personal data only with the service providers (data processors or sub-processors) needed to run the Service:

Provider	Purpose
Clerk	Account authentication and workspace membership.
Amazon Web Services (AWS)	Application hosting, database, and file storage (including payment slip images and knowledge documents).
OpenRouter / Anthropic	AI language models that generate chat replies.
EasySlip	Verification of Thai bank-transfer slips: the slip image is submitted for verification and the extracted transfer details are returned.
Meta Platforms / LINE Corporation	Delivery of messages on Facebook Messenger and LINE, per your use of those platforms.

We may also disclose personal data if required by law or valid legal process, to protect the rights and safety of users or the public, or as part of a merger, acquisition, or sale of assets (in which case this policy continues to apply to the transferred data).

8. International transfers

Some of our service providers process data outside Thailand (for example, in the United States). Where personal data is transferred internationally, we ensure appropriate safeguards consistent with the PDPA, such as contractual data-protection commitments with each provider.

9. Data retention

Merchant account and workspace data is kept for as long as the account is active.
End Customer data is kept for as long as the Merchant’s workspace retains it; Merchants can delete contacts and conversations from their workspace.
When a workspace (organization) is deleted, its data — contacts, conversations, messages, orders, payment records, and stored files — is deleted from our systems, and residual copies in backups and file storage are purged within 90 days.
We may retain limited records where required by law (for example, tax and accounting records).

10. Cookies

The Service uses only essential cookies: authentication/session cookies set by our sign-in provider, and a cookie remembering your language preference. We do not use advertising or third-party analytics cookies.

11. Security

We protect personal data with industry-standard measures, including encryption in transit (HTTPS/TLS), encrypted storage with our cloud providers, access controls limiting data access to authorized personnel, and secure storage of platform credentials such as Page access tokens. No system is completely secure; if we become aware of a personal data breach that is likely to result in a high risk to you, we will notify affected parties and the relevant authority as required by the PDPA.

12. Your rights

Subject to applicable law, you have the right to:

access and obtain a copy of your personal data;
correct inaccurate or incomplete personal data;
delete your personal data;
receive your data in a portable format;
object to or restrict certain processing;
withdraw consent where processing is based on consent; and
lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand or your local supervisory authority.

To exercise these rights, email us at support@closemaster.ai. If you are an End Customer, we may refer your request to the Merchant (the data controller) and will assist in fulfilling it. We respond to requests within 30 days.

13. Data deletion

Step-by-step instructions for requesting deletion of your data — including data obtained from Facebook or LINE — are on our Data Deletion page.

14. Children

The Service is intended for business use and is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new “last updated” date, and for material changes we will notify Merchants through the Service or by email.

16. Contact us

SPACE B CO., LTD. (บริษัท สเปซบี จำกัด)
Registered in Thailand
Email: support@closemaster.ai