Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Personal Data We Collect

2.1 Data You Provide Directly

• Account information: name, email address, profile photo (via Google Sign-In)
• Trip information: destinations, travel dates, cities, places of interest
• Preferences: hotel loyalty program memberships, travel style preferences
• User-generated content: logbook entries, expense records, notes

2.2 Data Collected Automatically

• Device & browser information: browser type, operating system, screen resolution
• Usage data: pages visited, features used, session duration, click interactions
• Technical data: IP address, time zone, language settings
• Cookies & local storage: session tokens, onboarding state, user preferences (see Cookie Policy)

2.3 Data from Third Parties

• Google OAuth: when you sign in with Google, we receive your name, email, and profile picture as permitted by your Google account settings
• Weather & mapping APIs: your destination city is sent to open-meteo.com and Nominatim (OpenStreetMap) to display weather — no personal identifier is attached

3. Purposes and Legal Basis for Processing

Under PDPA Section 24, we process your personal data only when we have a lawful basis:

• Contractual necessity — to create and manage your account, store your trip plans, and deliver the core service you requested.
• Consent — to send optional email updates, marketing communications, or use non-essential analytics cookies. You may withdraw consent at any time.
• Legitimate interests — to improve product quality, prevent fraud, and ensure platform security, provided these interests do not override your rights.
• Legal obligation — to comply with applicable Thai and international laws when required.

4. How We Use Your Data

• Authenticating you and maintaining your session
• Generating personalised trip itineraries and hotel recommendations
• Storing and syncing your trip plans, expenses, and logbook entries
• Displaying real-time weather for your destination cities
• Improving and debugging the platform through aggregated analytics
• Communicating important service updates (no marketing without consent)
• Complying with legal and regulatory requirements

5. Data Sharing and Disclosure

We do not sell your personal data. We may share data only in the following circumstances:

• Service providers:Vercel (hosting & infrastructure), Google (authentication), open-meteo.com (weather data), OpenStreetMap/Nominatim (geocoding). These providers act as data processors under contractual obligations.
• Legal requirements: we may disclose data when required by Thai law, court order, or government authority.
• Business transfers: in the event of a merger or acquisition, your data may be transferred; you will be notified in advance.
• With your explicit consent: any other sharing requires your specific, prior consent.

6. International Data Transfers

Grugo is hosted on Vercel infrastructure, which may process data outside Thailand (including the United States and European Union). We ensure such transfers comply with PDPA Chapter VI and, where applicable, the EU Standard Contractual Clauses. Your data is subject to appropriate safeguards at all times.

7. Data Retention

• Active accounts: data is retained for as long as your account is active.
• Deleted accounts: personal data is permanently deleted within 90 days of account deletion, except where retention is required by law.
• Guest / localStorage data: stored only in your browser and never sent to our servers. It is removed when you clear browser storage.
• Logs: server and access logs are retained for a maximum of 12 months for security purposes.

8. Your Rights Under PDPA

As a data subject, you have the following rights under Thailand PDPA Sections 30–43:

To exercise any right, contact us at contact@grugo.app. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS/TLS encryption for all data in transit
• Secure OAuth 2.0 authentication via Google (no passwords stored)
• Environment variable isolation for sensitive credentials
• Access controls limiting data access to authorised personnel only
• Regular security reviews of our codebase and infrastructure

10. Children's Privacy

Grugo is not directed at individuals under the age of 20 (the age of majority in Thailand). We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us and we will delete it promptly.

11. Cookies

We use cookies and similar technologies. For full details, including how to manage or opt out of cookies, please read our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email (if you have an account) and update the “Effective” date at the top. Continued use of Grugo after the effective date constitutes acceptance of the updated policy.

13. Contact Us