1. General

HX Lab Co., Ltd. ("the Company", "we") operates the Puccha platform ("the Service"), an AI knowledge base for organizations. This policy is prepared in accordance with the Personal Data Protection Act B.E. 2562 (PDPA).

2. Data we collect

Account data: name, email, profile picture (from Google/Microsoft SSO)
Organization data: organization name, plan, widget settings
Documents: files you upload to build your knowledge base — stored isolated per organization
Query logs: only a hash of the query, mode, response time, and hit count — never the raw query text
Technical data: IP address, user agent, timestamps

3. How we use data

Provide the Puccha platform as agreed
Authenticate identity and manage access rights
Analyze usage to improve the Service
Send member invitations and receipts
Comply with applicable law

4. Per-organization isolation

Each organization's data and documents are stored fully isolated from one another (logical tenant isolation). Organization A's documents can never be accessed by Organization B under any circumstances.

5. Disclosure

We do not sell or share your personal data with third parties, except the service providers required to operate:

Cloudflare: infrastructure (Workers, D1, R2, Vectorize)
Anthropic: language processing (Claude AI) — only relevant document chunks are sent, no personal data
Stripe: payment processing
Resend: transactional email

6. Your rights

Under the PDPA, you have the right to:

Access and request a copy of your personal data
Correct your data
Erase your personal data
Object to or restrict processing
Port your data to another provider

7. Security

We apply appropriate security measures, including encryption in transit (TLS), storage on the Cloudflare edge network, and role-based access control (RBAC).

8. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with the updated date.

9. Contact us

HX Lab Co., Ltd.
Email: privacy@hxlab.io