The data actually accessed depends on the feature you use, the permissions (scopes) requested, and the permissions you grant on Google, Meta/Facebook, TikTok, LINE, or another platform. We do not request extra permissions merely to “future-proof” access where no corresponding feature exists.
Scope and data controller
This policy applies to hostdrift.com and to websites, applications, digital tools, forms, account features, and services operated by HostDrift that link to this policy. For these activities, HostDrift may act as a data controller under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA).
For systems developed or operated for clients, HostDrift may instead act as a data processor/service provider on the client's documented instructions, depending on the project, contract, and actual processing arrangement.
Personal data we may collect
- Identity and contact data: name, email address, phone number, company, role, and information you submit through forms.
- Account and profile data: username, profile photo, email, account/platform identifiers, and information you authorise through social login or OAuth.
- Connected-service data: account, page, channel, content, selected files, calendar items, messages, analytics, or events only where needed for a feature you request and authorise.
- Technical data: IP address, browser, device, operating system, referrer, timestamps, logs, security events, and system usage information.
- Project and transaction data: business requirements, project information, billing details, and records necessary to perform a contract or service request.
Google, Meta/Facebook, TikTok, LINE and other integrations
When you connect an external account, we request only the permissions reasonably required for the feature you choose. The platform normally presents its own authorisation screen before HostDrift receives relevant data or access tokens.
May include Google Sign-In/OAuth and enabled Google or Google Workspace APIs, such as basic profile information, email, account identifiers, or specific data you select and authorise for a visible feature.
HostDrift's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google API user data is not sold and is not used by HostDrift for advertising or unrelated secondary purposes.
Meta / Facebook
May include Facebook Login, Page, Business, or other Meta tools you connect, such as account/page identifiers, permitted profile data, page data, content, insights, or other data covered by the permissions you grant.
Meta Platform Terms apply to Platform Data made available through Meta products.
TikTok
May include Login Kit, Content Posting, Display, or other enabled TikTok APIs, such as TikTok account identifiers, authorised profile data, content/posting information, or analytics within the granted scope.
Use of TikTok developer services remains subject to the TikTok developer terms and policies.
LINE
May include LINE Login, Messaging API, LIFF, or other LINE services, such as LINE user ID, display name, profile image, content a user sends to an Official Account, and events/webhooks necessary for the requested feature.
LINE-derived user data is handled in accordance with the LINE User Data Policy and applicable LINE developer terms.
Where multiple LINE services are operated, LINE-derived user data is not combined across separate services except where LINE policies and applicable notice/consent requirements permit it.
If HostDrift adds a platform or materially changes how connected-service data is used, we will update this policy and provide additional notice or consent where required by law or the applicable platform.
How we use personal data
- Authenticate users and connect accounts they choose to authorise.
- Provide requested features such as sync, publishing, dashboards, automation, messaging, reporting, and workflows.
- Respond to enquiries, provide support, and deliver system-development projects.
- Maintain security, prevent fraud, spam, abuse, and investigate suspicious activity.
- Measure system performance, troubleshoot, and improve services.
- Perform contracts and comply with legal, tax, accounting, regulatory, or lawful authority requirements.
- Conduct marketing or measurement only where an appropriate legal basis and, where required, consent exists.
Legal bases under the PDPA
Depending on the activity, we may rely on consent, performance of a contract or steps requested before entering a contract, legitimate interests, and compliance with legal obligations. If sensitive personal data must be processed, we will rely on an appropriate legal basis and obtain explicit consent where required.
International data transfers
Global providers such as Google, Meta, TikTok, LINE, or cloud infrastructure providers may process or store data outside Thailand. Where cross-border transfer occurs, we will handle the transfer in accordance with the PDPA and use an appropriate transfer mechanism or safeguard where required or permitted by law.
Data retention
We retain personal data only for as long as reasonably necessary for the relevant purpose, the life of a contract/account/connection, legal obligations, security needs, and applicable dispute or limitation periods. When data is no longer required, we delete, destroy, or anonymise it as appropriate.
OAuth/access tokens are retained only as needed to maintain an authorised connection and are revoked or deleted when the connection is removed or no longer needed, subject to any legal requirement to retain particular records.
Security measures
We use reasonable technical and organisational measures such as access controls, credential/token management, encryption where appropriate, security logging, backups, vulnerability management, and contractor controls. No system can guarantee absolute security. If a personal data breach occurs, we will assess and make notifications to the competent authority and affected individuals where required by the PDPA.
Your personal data rights
Subject to the conditions of the PDPA, you may have rights to access and obtain a copy of your data, rectify it, request erasure, restrict processing, object, request data portability, withdraw consent, and lodge a complaint with Thailand's Personal Data Protection Committee/Office. Withdrawal of consent does not affect processing that was lawful before withdrawal.
Data deletion and disconnect requests
You may revoke platform permissions through Google, Meta/Facebook, TikTok, or LINE account settings where the platform provides that control. To delete data retained by HostDrift, submit a request through our Contact page with the subject Data Deletion Request, identify the relevant service/platform, and provide enough information for us to verify the request and locate the relevant records.
- Open the Contact page.
- Select the most relevant enquiry type or Other Inquiry.
- Use the subject Data Deletion Request.
- Identify the connected platform and necessary account details, but never send a password or access token.
We will process valid requests within the period required by applicable law, subject to lawful retention needs for security, contractual obligations, legal claims, or other legal requirements.
Client systems developed by HostDrift
Where a client determines the purposes and means of processing in a system HostDrift develops or operates, the client may be the data controller and HostDrift may act as a processor. That processing should be further governed by the project agreement, data processing agreement (DPA), statement of work, and the client's own privacy notice.
Children and minors
HostDrift's general services are not intentionally designed to collect personal data from children or minors. Where a specific service requires such processing, appropriate consent/guardian mechanisms and safeguards will be applied as required by applicable law.
Policy changes and contact
We may update this policy when our services, applicable law, or platform requirements change. Material changes will be communicated through an appropriate channel. For privacy questions, rights requests, or deletion requests, please use the HostDrift Contact form.