Privacy Policy
Last updated:
This policy explains how BahtTap (“BahtTap”, “we”, “us”) handles personal data when you use the BahtTap app and website (the “Service”). We’re the data controller for the data described here, under Thailand’s Personal Data Protection Act B.E. 2562 (“PDPA”).
BahtTap is not yet generally available. This is our interim policy for early access, and we’ll update it before launch. It takes effect on 19 October 2026.
How to contact us
Email support@bahttap.com with any question about your data or this policy.
What we collect
When you sign in
- Your name, email address and account ID from Google, or from Apple on iPhone. We never see your Google or Apple password.
When you set up your shop
- Your shop’s name and what it sells.
- Your full name as it appears on your ID card.
- Your mobile number.
- Your PromptPay details, read from the QR code you scan: the PromptPay ID (such as a phone number, national ID number or e-wallet ID) and the account name shown on it. We use these to pay you.
- The referral code you entered, if any.
When you take payments
- For each sale: the amount, date and time, status, the card brand (such as Visa or Mastercard) and the last 4 digits of the card.
- We never receive full card numbers, security codes or PINs. Card details are read and handled by our licensed payment partner’s software.
- Refunds you make, and the payouts we send you.
About your phone
- A random ID we create when you install the app (it isn’t linked to your phone’s hardware IDs), the app version and the phone’s language.
- Results of Google Play Integrity checks, which tell us whether the app is genuine and running on an unmodified phone. We use them to keep payments secure and to stop one phone from being used to farm referral rewards.
- Our servers record the IP address and time of each request, to keep the Service secure and fix problems.
How you use the app
- Basic usage events, such as which screens you open and whether a payment succeeded, so we can improve the app. We remove anything that looks like personal data (names, phone numbers, IDs, card details) before storing these.
When you contact us
- What you send us by email: your name, email address and message.
On our website
- The website doesn’t use cookies, analytics or tracking.
- Our hosting provider processes your IP address and browser details to deliver the site and protect it from attacks.
Why we use your data, and our legal basis
| Purpose | Legal basis under the PDPA |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Taking, recording and refunding payments | Performance of contract |
| Paying out your sales to PromptPay, and checking payout names | Performance of contract; legal obligation |
| Checking phones, preventing fraud and securing the Service | Legitimate interests; legal obligation where applicable |
| Running the referral programme and preventing abuse | Performance of contract; legitimate interests |
| Improving the app from usage events | Legitimate interests |
| Answering your messages | Performance of contract; legitimate interests |
| Keeping financial and tax records | Legal obligation |
| Sending service messages (such as security notices and changes) | Performance of contract |
We don’t use your data for advertising, and we don’t send marketing messages.
Who we share data with
Only as needed to run the Service:
- Our licensed payment partner, to process card payments and refunds.
- Google, for sign-in and Play Integrity checks, and for our email.
- Apple, for Sign in with Apple on iPhone.
- Our cloud hosting providers, where our website, servers and database run.
- Authorities and regulators, when the law requires it, or to prevent fraud.
We don’t sell personal data.
International transfers
Some of these providers process data outside Thailand, for example in Singapore or the United States. When data leaves Thailand, we transfer it in line with the PDPA, using safeguards such as contractual commitments from the recipient.
How long we keep data
- Account and shop details: while your account is open. When you delete your account, we delete your sign-in, name, email address and mobile number, and close your shop.
- Sales, refund and payout records: for at least 5 years, as Thai accounting and tax law requires, even after you delete your account.
- Phone checks and fraud-prevention data: for up to 2 years after a phone was last used, so we can stop repeat abuse.
- Server logs: for up to 90 days.
- Usage events: for up to 2 years.
- Messages you send us: for up to 2 years after we’ve dealt with them.
Security
We protect data with encryption in transit, access controls, phone integrity checks and an audit log of actions that move money. Only people who need data for their work can access it.
Your rights
Under the PDPA you can:
- get a copy of your personal data;
- ask us to correct data that’s wrong or incomplete;
- ask us to delete or anonymise your data;
- ask us to restrict how we use it, or object to how we use it;
- get your data in a portable format, or have it sent to someone else; and
- complain to the Office of the Personal Data Protection Committee (PDPC).
To use any of these rights, email support@bahttap.com. Some data we have to keep by law, even if you ask us to delete it. To delete your account yourself, see Delete your account.
Children
The Service is for businesses and isn’t meant for anyone under 20. We don’t knowingly collect data from children.
Changes to this policy
We may update this policy. We’ll tell you about significant changes in the app or by email before they take effect.