naka-ai.
ภาษาไทย
← Back to home
Last updated: 18 October 2026
naka-ai Privacy Policy
This policy applies to the naka-ai app and website (naka-ai.com and Naka Studio), operated by NAKA-AI Tech. It explains what personal data we collect, where it comes from, why we use it, which service providers receive it, how long we keep it, and how you can exercise your rights under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA). The Thai version is available at ภาษาไทย.
1. Data controller
The data controller for this service is Nattapong Yothaphai (ณัฐพงษ์ โยธาไพ), an individual who operates naka-ai under the name NAKA-AI Tech ("naka-ai", "we", "us"). Contact: phone +66 89 278 8587 · +66 99 656 7792 · address 112/417 Pracha Ruam Mit Road, Nong Yat Subdistrict, Mueang Nakhon Phanom District, Nakhon Phanom 48000, Thailand · email [email protected]
Data Protection Officer (DPO): Nattapong Yothaphai (owner)
2. Data we collect and why
| Data | Where it is stored | Purpose |
|---|---|---|
| Phone number (verified by OTP) | Accounts table in our database | Create your account, sign you in and contact you about the service |
| Email address and basic name from your Google account (if you sign in with Google) | Accounts table | Create your account and show your name in the app |
| Email, shop name and password (if you sign up with email) | Accounts table — passwords are stored only as salted hashes (PBKDF2), never in plain text; our staff cannot read your password | Create your account and sign you in |
| LINE user ID and display name (if you sign in with LINE — we do not request your email) | Accounts table | Create your account and show your name in the app |
| OTP codes | Stored as hashes, expire after 5 minutes — the code itself is never stored | Verify your identity at sign-in |
naka_session cookie | Your browser (HttpOnly) and a hash of the session in our database | Keep you signed in for about 30 days |
| Product details and briefs you enter (product name, selling points, price, sales channels) | Jobs table, as text | Generate clips, scripts and content for your shop |
| Product photos you pick on the review-clip page | Stay on your device only — not uploaded to our servers and not sent to any AI | Assemble the video in your browser |
| Clips and media you create and schedule for posting | Private file storage (Cloudflare R2) | Hold your work until it is posted to your pages |
| Connected Facebook/Instagram pages (page name, ID, and an encrypted token) | social_accounts table (tokens encrypted with AES-GCM) | Post automatically and reply to comments/messages on your pages |
| Customer messages in the Inbox (comments/chats, draft replies, status) | Inbox tables in our database | Let the assistant draft replies and let you answer your customers |
| Shop knowledge base and reply tone | inbox_kb / inbox_settings tables | Make the assistant’s replies match your shop’s information |
| Payment details (plan, amount, payment method, transaction ID) | payments table — we never store card numbers (you enter card details directly on Stripe’s checkout page; we only receive the payment result and transaction ID) | Issue receipts, renew plans and keep accounting records |
| Receipts / tax invoices | receipts table | Kept as required by accounting and tax law |
| Credits and credit history | credit_ledger table | Track your credit balance and allow audits |
| Chat messages through your shop’s LINE Official Account (if you use the LINE sales assistant) | conversations / orders tables | Let the assistant help sell and reply to your customers |
Legal bases: performance of our contract with you (creating content, posting, replying to chats, issuing receipts), compliance with legal obligations (tax, accounting), and our legitimate interests (preventing abuse of the service).
To protect the service from abuse, such as many accounts being opened from one network to collect sign-up credits, each time you sign up or sign in we record the time, whether it was a sign-up or a sign-in, and two signals from your connection: your IP address and your browser’s User-Agent. Both are stored only as keyed hashes (HMAC), never as the address or browser details themselves. We use them only to spot unusual patterns: nothing is decided automatically, and a person on our team reviews a flag before taking any action on an account. These records are deleted after 90 days, or immediately when your account is deleted. This is done under our legitimate interest in preventing abuse.
3. Social and marketplace platforms (Facebook, Instagram, TikTok, YouTube, X, Shopee, Lazada)
naka-ai helps you create clips and content to post on these platforms. This table explains what we connect to or read from each platform, and what we do not do.
| Platform | Data we receive or read | Purpose |
|---|---|---|
| Facebook and Instagram (Meta) | When you connect a page yourself: page name, page ID, the page token (stored encrypted), and comments and chat messages customers send to the page | Post clips/content when you ask us to, read comments and help draft replies — we never post without your instruction |
| TikTok (Login Kit and Content Posting API) | When you choose to connect your TikTok account and consent on TikTok’s page, we receive only what the scopes you approve allow: · user.info.basic: open_id, union_id, display name and avatar· video.upload: permission to send the clips you choose to the inbox (drafts) of your TikTok app· video.publish: permission to post the clips you choose directly to your TikTok account when you ask us to, with the information needed to post (creator nickname, the privacy levels your account allows, maximum video duration and post status)· access and refresh tokens (stored encrypted) We also read public data: the title, creator name and cover image of clips we feature as examples (via TikTok’s oEmbed), and product details from a TikTok Shop link you paste | Show which account is connected, and send clips you create in naka-ai to your TikTok account only when you tell us to, in one of two ways: to your drafts, to edit and post yourself in the TikTok app, or as a direct post, where you see a preview, write the caption and choose the privacy level yourself before every post. We do not read your followers, messages or other videos, and we never post automatically without your instruction |
| YouTube | The link, title and public details of clips we feature as examples — we do not connect to your YouTube account | Show example clips. You upload finished clips yourself |
| X (Twitter) | We do not connect to or read data from your X account | You download clips and post them yourself |
| Shopee and Lazada | Public product details (name, description, images) from a product link you paste, and affiliate links you enter — we do not connect to your seller account | Create sales clips and content for that product |
We use data from these platforms only to provide the features you choose to use. We do not sell it or use it for advertising, and we follow each platform’s terms. Connecting an account on any platform always requires your consent on that platform’s own page first. If we ever request more data than listed here, we will update this policy first. You can disconnect at any time in the naka-ai app (we delete that account’s tokens immediately and cancel its queued posts) or in that platform’s settings, such as TikTok’s app permissions settings.
4. Service providers we share data with
| Provider | What is shared | Purpose |
|---|---|---|
| ThaiBulkSMS | Your phone number | Send the OTP code by SMS at sign-in |
| Google (OAuth and Cloud Text-to-Speech) | Sign-in with Google; script text to synthesise Thai voice-overs | Verify your identity and create voice-overs |
| LINE (LINE Login) | Sign-in with LINE: we receive your LINE user ID and display name after you consent on LINE’s page | Verify your identity |
| Anthropic (Claude API) | Product briefs, text you enter and the shop context needed | Generate scripts/content and draft customer replies |
| Meta (Facebook/Instagram Graph API) | Tokens of the pages you connect and the content you ask us to post | Post automatically, read comments and reply to messages |
| TikTok | The video file you choose, the caption and privacy level you set, with the token of the account you connected | Send the clip to your drafts or post it to your TikTok account when you ask us to |
| Stripe | Payment amount, plan and transaction ID; card/PromptPay details and billing address you enter on Stripe’s checkout page | Process plan payments securely |
| LINE | Messages and replies through your shop’s LINE Official Account (if you use the LINE sales assistant) | Let the assistant sell and reply to customers on LINE |
| Cloudflare | All data the system stores (Workers, D1, R2) and Turnstile when requesting an OTP (if enabled) | Host the service and block bots |
We do not sell your personal data and we do not share it for advertising.
5. How long we keep data
- OTP codes: 5 minutes (stored as hashes)
- Sign-in cookie: about 30 days
- Tokens of connected TikTok/Facebook/Instagram accounts: kept until you disconnect or delete your account, then deleted immediately
- Account data, jobs, clips, Inbox messages and shop knowledge base: kept while you use the service, until you ask us to delete them (completed within 30 days after we verify your identity — see how to request deletion, in Thai)
- Receipts and payment records: kept for as long as accounting and tax law requires, even after your account is deleted
6. Cookies and similar technologies
We use only strictly necessary cookies: naka_session (keeps you signed in). There are no advertising cookies and no cross-site tracking. The app also stores small values in your browser (localStorage), such as whether you hid the welcome card; these are never sent to our servers.
7. Your rights
Under the PDPA you have the right to: access and obtain a copy of your data · have it corrected · have it deleted or destroyed · restrict its use · object to certain processing · withdraw consent · data portability · lodge a complaint with Thailand’s Personal Data Protection Committee.
To exercise your rights, call +66 89 278 8587 · +66 99 656 7792 or use the contacts in section 1. We will act on your request and reply within 30 days.
8. Deleting your data
How to delete your account and data is explained on the Data deletion page (in Thai; also used as our User Data Deletion URL for Meta). You can also ask by email at [email protected] or by phone using the contacts in section 1.
9. Changes to this policy
When we change this policy we update the "Last updated" date above and announce significant changes through our contact channels.
Privacy contact
Phone +66 89 278 8587 · +66 99 656 7792 · email [email protected]
naka-ai (operated by NAKA-AI Tech) · Nattapong Yothaphai