Privacy Policy

บริษัท โฮโลแกรม จำกัด · Notice No. 03/2569

1. Introduction

บริษัท โฮโลแกรม จำกัด (the "Company"), which provides Checkslip, takes the protection of personal data seriously and manages data under the Personal Data Protection Act B.E. 2562 (2019). This policy explains how the Company collects, uses and discloses personal data, and what rights you have.

2. Scope

This policy applies to

people and companies who sign up for and use Checkslip
visitors to checkslip.com and anyone who contacts us through LINE OA @checkslip.com
partners and outside service providers involved

3. Definitions

"Personal data" is information about a natural person that identifies that person, directly or indirectly, excluding information about the deceased.
"Sensitive data" is data under section 26 of the PDPA, such as race, religion, health, biometric data and criminal records. Checkslip does not collect sensitive data.

4. Data the Company collects

4.1 Account and contact data: first name, last name, email, phone number, and the company name, address and taxpayer ID for issuing documents
4.2 Payment data: the amount, date and proof of payment for a package, paid through Stripe by card or PromptPay (the Company does not store bank passwords or card details)
4.3 Data of the slips you send: the transfer details the bank returns, namely the amount, time, the sending and receiving banks, the reference number, your own reference (client_reference), the sender's and recipient's names partly masked, part of the account number, and the text in the QR (names, account numbers and QR text are stored encrypted with a key per account). The Company does not keep slip images: the system reads the QR in memory and discards the image at once. Retention periods are in section 8
4.4 Technical data: IP address, time of each API call, the result of the call, error logs and cookies on the website, including visits to the website checkslip.com measured with Google Analytics 4 when you accept analytics cookies (details in the Cookies Policy)
4.5 Sign-up source: the utm_source, utm_medium, utm_campaign and utm_content of the link you opened your account from, and the time it was recorded. For this the Company does not collect the referrer, IP address, cookies or a device fingerprint

5. Where the data comes from

From you directly: when you sign up, verify your phone number, buy a package or contact the team
From our systems automatically: when you use the website or call the API (cookies and logs)
From the slips you send, from the banks the Company fetches transfer data from, and from the payment provider (Stripe)

6. Purposes and legal bases

6.1 To provide the service under contract: create and verify accounts · check slips and return the result · detect duplicate slips · count credits, take payment and issue financial documents · contact you about the service
6.2 For legitimate interests: keep our systems secure, prevent misuse and cyber attacks, fix system problems
6.3 To comply with the law: keep computer traffic data under the Computer Crime Act, and keep accounting and tax records
6.4 For marketing (only with your consent): send news or promotions. You may withdraw consent at any time
6.5 To measure and improve the website (only with your consent): count visits with Google Analytics 4. You may withdraw consent at any time under "Cookie settings" at the foot of every page
6.6 For legitimate interests: see which pages or campaigns bring sign-ups, from the sign-up source in 4.5. The team sees totals only, never single accounts

7. Disclosure

The Company does not sell, rent or trade your data, and does not use slip data for advertising. It discloses data only as far as needed to

cloud providers that store and process the data, which may be in Thailand or abroad
banks or bank data providers, to fetch transfer data at your request
the payment provider (Stripe) and the providers that send email and SMS
Google (Google Analytics 4), to measure visits to the website, only when you accept analytics cookies. Google may process this data outside Thailand
government bodies, such as the Revenue Department, or any authority with a legal order

If data must be sent abroad, the Company does so as personal data protection law requires.

8. How long data is kept

Slip images: not kept
Lookup history you can see in your account (amount, time, banks, reference numbers, partly masked names, part of the account number and the encrypted QR text): 90 days
Data used to catch duplicate slips (reference numbers already looked up): 24 months
The bank's answer for one transfer (with the sender's and recipient's names and part of the account number), kept so the bank is not asked again: 90 days. It is tied to the bank and the reference number, not to a user account, answers every account that sends the same transfer, and can stay until its 90 days are up even if you close your account
Account data after the account is closed: deleted within 6 months · names, account numbers and QR text in the lookup history, which are encrypted with the account's key, are destroyed the moment the account is closed, by deleting that key
System usage logs: 90 days (under the Computer Crime Act)
Support cases and messages: 24 months after the case is closed · attachments in a case, including images you attach: 30 days after the case is closed
Conversations with the AI assistant: 90 days
Audit records, which hold no direct personal data: 60 months
Financial and accounting documents: as accounting and tax law requires
Sign-up source (4.5): kept while the account is open and deleted with it
Website visit data in Google Analytics: Google keeps it for 14 months, as the Company has set, then deletes it
After these periods, data is deleted or made anonymous in a secure way; the actual deletion may run up to about 4 months later

9. Security

Connections over HTTPS · authentication with an API key · team access to data limited to what is needed · slip images not kept
If a data breach happens, the Company notifies the Office of the Personal Data Protection Committee within 72 hours as the law requires, and tells the users affected.

10. Your rights as a data subject

You have the right to access and get a copy · correction · deletion or destruction · restriction of use · objection · withdrawal of consent · data portability, and to complain to the Office of the Personal Data Protection Committee.
Make a request by email as set out in section 4 of this center. The Company answers within 30 days of receiving it.
Anyone under 20 needs a parent's or guardian's consent before signing up.

11. Our team and this policy

Directors, employees and contractors of the Company who break this policy commit a serious disciplinary offence and may be liable under the law for any damage caused.

12. Contact

Data controller: บริษัท โฮโลแกรม จำกัด
Address: 629 Moo 6, Ban Pet, Mueang Khon Kaen, Khon Kaen 40000
Email: support@checkslip.com
LINE OA: @checkslip.com
Data Protection Officer (DPO): วราพงศ์ มะโนมัย · phone 090-270-1908 · email support@checkslip.com

13. Effective date

Effective from 7 November 2026. The Company may change this policy and will publish the new version on the website.