Privacy Policy

Frevation Co., Ltd. 682 Moo 1, Sukhaphiban 1 Rd., Borabue, Borabue, Maha Sarakham 44130, Thailand

Personal data enquiries: dpo@frevation.com

We collect only what we need to provide the service:

• Account data: first name, last name, email address and profile picture — from email sign-up, or from your Google account if you choose to sign in with Google.
• Organization data: organization name, members and their roles.
• Taxpayer data for tax invoices: individual or company name, tax ID, national ID or passport number, branch code, address, phone number (optional) and billing email.
• Payment data: amount, VAT, payment method and status. We never receive or store your card number — all payments are processed on our payment provider's checkout page.
• IP address and detected country when you save taxpayer details and when you pay — kept as evidence for how VAT was calculated.
• API usage data: the model called, token counts, cost, latency and status code of each request.
• API keys: we store only a hash of each key, never the full key.

We do not store the content of the prompts you send to a model, nor the model's responses. That content passes through our system to the AI provider and back to you only.

When you sign in with Google we request only your name, email address and profile picture (the openid, email and profile scopes), solely to create your account and verify your identity.

• We do not access your Gmail, files, calendar, contacts or any other data in your Google account.
• We do not sell or rent Google user data, or use it for advertising.
• We do not use Google user data to train AI models.
• Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Creating and maintaining your account, authenticating you and forwarding your requests to AI providers — contract.
• Charging for usage, deducting points and showing your usage history — contract.
• Issuing e-Tax Invoices and e-Receipts, calculating VAT and keeping tax records — legal obligation.
• Emailing you when a tax document is ready to download — contract.
• Preventing fraud and abuse and keeping the service secure — legitimate interest.
• Aggregate, non-identifying website analytics and learning which channel brought you to us, to improve the service — legitimate interest.
• Measuring online advertising — whether an ad click led to a sign-up or a top-up — using the advertising provider's cookies — consent (only after you press "Accept", and you can withdraw at any time; see section 8).

We will not use your data for any other purpose without telling you and, where the law requires it, asking for your consent.

We do not sell personal data. We share it only with service providers we need in order to run the service, who process it on our instructions:

• AI model providers — OpenAI, Anthropic, Google and DeepSeek: receive the content of the requests you send, to process and respond to them. Their storage and use of that content is governed by each provider's API policies.
• Authentication and account management providers.
• Payment processors.
• e-Tax Invoice and e-Receipt issuing providers.
• Email delivery providers.
• Cloud, database and file storage providers, including the relay servers that requests to AI providers pass through.
• Website hosting and cookieless visitor analytics providers.
• Online advertising providers — only if you consent to advertising cookies: they receive ad-click data and sign-up or top-up events (with the amount), never your name or email address.

We may also disclose data where the law requires it or when ordered by a government authority or court.

Some of the providers above are located or process data outside Thailand, including in the United States, Singapore and China (DeepSeek — only when you call a DeepSeek model). We choose providers with adequate data protection standards and transfer only what the service requires, in line with Sections 28 and 29 of the PDPA.

• Account, organization and usage data: for as long as your account is active.
• When an account is deleted: we remove your name, email address and profile picture from the live service immediately, but keep a copy of your identifying details (email, name and the organizations you belonged to) in separate, access-restricted storage for 5 years for audit, fraud prevention and dispute resolution, after which it is deleted automatically. You can sign up again with the same email.
• Taxpayer data, payment records and tax documents: at least 5 years under the Thai Revenue Code and accounting law. This data cannot be deleted on request before that period ends.

Strictly necessary cookies (always on, no consent needed): sign-in cookies for the console at my.wisporta.com, a cookie that remembers your language, and the wp_consent cookie that records whether you accepted or declined advertising cookies. Website visitor statistics are collected in aggregate without cookies.

Advertising cookies (only with your consent): on your first visit to www.wisporta.com we ask for consent. If you press "Accept", we load an online advertising provider's measurement tool, which sets cookies on the wisporta.com domain (covering both www and my) to measure whether an ad led to a sign-up or a top-up. If you press "Decline" or do not answer, the tool is never loaded.

You can change your mind or withdraw consent at any time with the "Cookie settings" link at the bottom of www.wisporta.com. Withdrawing does not affect your use of the service.

All traffic is encrypted with HTTPS. API keys are stored as hashes. Tax documents are kept in private storage and can be downloaded only after signing in. Access to data is limited to people who need it.

Under the PDPA you have the right to:

• access your data and obtain a copy;
• have inaccurate or outdated data corrected;
• have your data deleted, destroyed or anonymised;
• restrict the use of your data;
• object to processing;
• data portability;
• withdraw consent where processing relies on consent;
• lodge a complaint with the Personal Data Protection Committee.

Send requests to dpo@frevation.com. We respond within 30 days and may ask you to verify your identity first. Some data cannot be deleted where we are legally required to keep it (see section 7).

The service is meant for developers and businesses. We do not knowingly collect data from anyone under 20 without the consent of a parent or guardian. If you believe we have, contact us and we will delete it.

We may update this policy from time to time and will show the effective date on this page. We will notify you of material changes by email or in the console.

Frevation Co., Ltd. 682 Moo 1, Sukhaphiban 1 Rd., Borabue, Borabue, Maha Sarakham 44130, Thailand Personal data: dpo@frevation.com General: support@wisporta.com