Privacy Policy

How Lawdee Co., Ltd. collects, uses, shares, and protects personal data when you use the Lawdee Legal A.I. Platform (web application and LINE Official Account) and our marketing site at lawdee.ai, and the rights you have under the Personal Data Protection Act B.E. 2562 (PDPA).

1. Data Controller

The data controller is Lawdee Co., Ltd. (บริษัท ลอวดี จำกัด), company registration number 0205568036665, registered in Chonburi, Thailand. When you engage a lawyer through the Service, that lawyer is a separate controller of the personal data you share with them for that engagement.

2. Scope

This Policy covers personal data we collect when you (a) visit our marketing site at lawdee.ai, (b) create or use an account on the Lawdee web application or LINE Official Account, (c) communicate with us, or (d) interact with us at events. It does not cover the privacy practices of third-party sites or services we link to.

3. Personal Data We Collect

Information you provide

• Account data: name, email, phone number, password (hashed), and, if you sign in with LINE, your LINE user ID, display name, and profile picture.
• Lawyer verification data (professional accounts): lawyer licence number, licence documents, practice areas, and payout bank account.
• Legal matter content: questions you ask the A.I. advisor, case details, documents, deadlines, and notes you record in the Service.
• Billing data: billing contact, address, tax ID, and payment details (processed by our payment provider; we receive only a tokenised reference).
• Support data: messages, attachments, and metadata you send to our support channels.

Information collected automatically

• Device & log data: IP address, browser type and version, operating system, referring URL, pages visited, timestamps, and crash logs.
• Usage data: features used, subscription events, and aggregated interaction metrics.
• Cookies & similar technologies: see our Cookies Policy for the categories used and your choices.

Information from third parties

• LINE Platform: authentication and messaging metadata when you use the Lawdee LINE Official Account.
• Payment provider: payment status and tokenised payment references.

4. Sensitive Personal Data

Legal questions and matter records can reveal sensitive personal data under section 26 PDPA, such as criminal records, health information, or religious beliefs, of you or of other people involved in your matter. We collect such data only when you choose to include it, on the basis of your explicit consent collected at account creation and manageable at any time in Settings > Privacy. Sensitive personal data is encrypted, access to it is restricted, and it is never used for analytics or marketing.

5. How We Use Personal Data

6. Legal Basis (PDPA)

Depending on the personal data and the purpose, we rely on:

• Performance of a contract (section 24(3) PDPA): to provide the Service you have signed up for.
• Legitimate interests (section 24(5) PDPA): to operate, secure, and improve the Service, where our interests are not overridden by your rights.
• Consent (sections 19 and 26 PDPA): for non-essential cookies, marketing communications, and sensitive personal data; you may withdraw consent at any time.
• Legal obligation (section 24(6) PDPA): to comply with tax, accounting, and law-enforcement requirements.

7. Sharing & Subprocessors

We do not sell personal data. We share it only in the following circumstances:

• Service providers (subprocessors) who process data on our behalf: cloud hosting and GPU infrastructure in Thailand, email delivery, error tracking, and payment processing, bound by written agreements that meet PDPA standards. The current list is published at lawdee.ai/subprocessors.
• Lawyers you engage, who receive the matter information you choose to share with them for the engagement.
• Legal & safety, when required by law, court order, or to protect the rights, property, or safety of Lawdee, our users, or the public.
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to the protections of this Policy.

8. Data Residency & International Transfers

The Service is hosted in Thailand: application infrastructure in the AWS Asia Pacific (Bangkok) region and A.I. models on GPU infrastructure located in Thailand. Your legal matter content is not sent to overseas A.I. model providers. Limited personal data may be processed abroad by specific subprocessors (for example, email delivery and error tracking); where that happens we use recognised transfer safeguards under section 28 PDPA.

9. Retention

We retain personal data only as long as necessary for the purposes described, to comply with legal obligations, to resolve disputes, and to enforce agreements:

• Account data: for the lifetime of your account, plus 90 days after closure.
• Legal matter content: for the lifetime of your account, plus 30 days for export, then deleted from active systems and purged from backups within 90 days.
• Billing records: for at least 5 years to comply with Thai tax law.
• Audit & security logs: for up to 18 months.

10. Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control, secret rotation, employee security training, and an incident-response programme. No system is perfectly secure; you can help us by using a strong password and enabling multi-factor authentication.

11. Your Rights

Subject to the PDPA and other applicable laws, you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your personal data, subject to legal exceptions.
• Restrict or object to certain processing.
• Port your data to another controller in a structured, machine-readable format.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand.

To exercise any of these rights, contact privacy@lawdee.ai. We will respond within 30 days.

12. Children

The Service is not directed to children and is intended for users who meet the eligibility requirements in our Terms and Conditions (20 years of age, or younger with the consent of a parent or legal guardian). If you believe a child has provided us personal data without the required consent, contact privacy@lawdee.ai so we can delete it.

13. A.I. & Your Legal Matter Content

The A.I. legal advisor runs entirely on models hosted on infrastructure controlled by Lawdee in Thailand. We do not use your legal matter content to train any general-purpose model, and we do not share it with third-party model providers. Aggregated, de-identified telemetry (for example latency, error rates, and feature usage) may be used to improve the Service.

14. Changes to This Policy

We may update this Privacy Policy. The “Last updated” date at the top reflects the most recent change. Material changes will be notified by email or LINE message and surfaced in-app at your next sign-in.

15. Contact & Data Protection Officer

For privacy questions, requests, or to contact our DPO:

Lawdee Co., Ltd. Attn: Data Protection Officer. dpo@lawdee.ai / privacy@lawdee.ai. 16/27 Moo 5, Tambon Samet, Amphoe Mueang Chonburi, Chonburi 20000, Thailand.

Supervisory authority: Personal Data Protection Committee (PDPC), Thailand (pdpc.or.th).