Privacy Policy

This Policy covers bunchee.cloud, the marketing website you are currently reading, together with the account, authentication, and organization-management data processed by accounts.bunchee.cloud, and the sign-in data shared with web.bunchee.cloud when you use accounts.bunchee.cloud to log in to it. It does not separately restate the privacy terms of third-party identity providers (such as your employer's SSO system) that you may use to sign in — those providers have their own privacy notices.

For account and identity data — your name, email, password, passkeys, two-factor settings, session and device history, and organization membership, all processed through accounts.bunchee.cloud — Decoding Co., Ltd. is the data controller. For the business records your organization enters into web.bunchee.cloud — such as ledgers, invoices, bills, assets, contacts, and employee records used for bookkeeping — your organization is the data controller and we act only as a data processor, handling that data solely on your organization's instructions and for the purpose of operating the service. bunchee.cloud itself does not collect personal data beyond what is described in our Cookie Policy.

Account information you provide: name, email address, and password (stored as a salted hash, never in plain text). Authentication data: passkey (WebAuthn) credentials, two-factor authentication settings and one-time codes, your last-used sign-in method, and — if you sign in with Google or through your organization's SSO provider (SAML/OIDC) — the identity claims (such as name and email) shared by that provider. Organization data: the organizations you belong to, your role and IAM permissions within them, custom domains, and SCIM-provisioned identities when your organization uses automatic user provisioning. Security and device data: IP address, browser user-agent, session and sign-in history, and API keys you generate (stored hashed, never in recoverable form). Support data: any information you send us when contacting support. Billing and usage data: your organization's subscription plan and status, billing interval, the number of paid seats, any add-ons enabled, storage consumption measured against your plan's allowance, and the customer and subscription identifiers issued to your organization by Stripe, our payment processor. Payment-card numbers and other payment-instrument details are entered directly with Stripe and are never received or stored by Bunchee. Where you use accounts.bunchee.cloud to access web.bunchee.cloud, we also facilitate storage of the business and financial data your organization enters there, as described under "Our Role: Controller and Processor" above.

We use your information to create and secure your account, authenticate sign-ins across the Bunchee product family, issue and validate session and access tokens, enforce two-factor authentication and passkey checks, detect compromised passwords (via a breach-check on sign-up and password changes) and suspicious sign-in activity, manage your organization memberships and IAM roles, provision users via SSO/SCIM when your organization enables it, send account-related email — including address verification, one-time sign-in codes, and notifications of security-relevant events such as enabling two-factor authentication, registering a passkey, creating an API key, setting or changing a password, accepting an organization invitation, and changes to a member's role — meter your organization's seat count and storage consumption against its subscription plan and pass the resulting quantities to our payment processor so that your subscription can be billed, and maintain and improve the reliability of the service.

Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), we process account and identity data primarily to perform our contract with you (providing the service you signed up for), to comply with legal obligations (such as bookkeeping-related retention rules that apply to accounting records), and on the basis of our legitimate interests in keeping the service secure and reliable. Where required, such as for optional marketing communications, we rely on your consent, which you may withdraw at any time.

We do not sell your personal data and we do not use it for advertising. We share data only with service providers who help us operate the platform, under confidentiality and data-processing terms: Google, when you choose to sign in with a Google account; Cloudflare, which hosts our infrastructure and provides the Turnstile bot-verification challenge shown on certain forms; our email-delivery provider, used to send verification and one-time-code emails; Stripe, our payment processor, which receives your organization's billing contact details together with the subscription, seat, and storage-usage quantities we report, in order to charge your subscription and issue invoices, and which collects payment-card details directly from you on its own hosted pages under its own privacy policy; and, when your organization enables enterprise SSO or SCIM, your organization's own identity provider, which you and your organization control independently of us. We may also disclose data where required by law or to protect the rights, safety, or property of Bunchee, our users, or the public.

Some of our service providers, including Cloudflare, Google, and Stripe, operate infrastructure outside Thailand. Where personal data is transferred internationally, we take reasonable steps — including contractual safeguards with our providers — to ensure it continues to receive a level of protection consistent with the PDPA.

We retain account and identity data for as long as your account or organization remains active, and for a reasonable period afterward to comply with legal, security, and dispute-resolution obligations. Business and accounting records entered into web.bunchee.cloud are retained for the duration of your organization's subscription and, where Thai accounting and tax law requires it, for at least five years as mandated for bookkeeping records. Billing records — including subscription history, invoices, and the seat and storage-usage quantities used to calculate charges — are retained for the period required by Thai tax and accounting law, and equivalent records are held independently by Stripe under its own retention policy. You may request deletion of your personal account data at any time, subject to our ability to retain records we are legally required to keep.

We protect your data with encrypted connections (HTTPS/TLS), Argon2 password hashing, hashed storage of API keys and SCIM tokens, short-lived signed access tokens with automatic key rotation, rate limiting on sensitive endpoints, breach-check screening of new passwords, and support for two-factor authentication and passkeys. Access to your data within Bunchee is restricted through our own role-based permission system and limited to personnel who need it to operate the service.

Under the PDPA, you have the right to access, correct, or delete your personal data, to withdraw consent, to object to or restrict certain processing, and to request that we transfer your data to you in a portable format. To exercise these rights over your account data, contact us at privacy@decoding.co.th. If your organization's business or accounting data is involved, we will generally direct that request to your organization, as they act as the data controller for that data. You also have the right to lodge a complaint with Thailand's Office of the Personal Data Protection Committee (PDPC).

Bunchee is a business service intended for use by organizations and their authorized personnel. It is not directed at, and we do not knowingly collect personal data from, individuals under the age required to enter into a binding contract under Thai law.

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. We will update the "Last updated" date above and, for material changes, provide additional notice such as an email or in-app notification.

Decoding Co., Ltd. (Head Office) · Tax ID 0135566034216 · 68/274 Moo 6, Bless City Park Lamlukka Klong 6, Bueng Kham Phroi Sub-district, Lam Luk Ka District, Pathum Thani 12150, Thailand · Tel. (66) 21245741 · privacy@decoding.co.th