Privacy Policy

1. Introduction and Acceptance

By accessing or using the M.A.D platform and the website madbot.chat (collectively, the “Platform” or the “Service”), you acknowledge and agree to this Privacy Policy (“Policy”) together with our Terms & Conditions.

If you do not agree with this Policy or any part of it, you should immediately discontinue using the Platform and disconnect any linked third‑party accounts (e‑commerce or social media) from M.A.D.

2. Scope and Relationship with Other Documents

  • This Policy explains how M.A.D (“we”, “our”, “us”) collects, uses, discloses, protects, and retains personal data when:

    • You create and use an account on M.A.D
    • You access or use madbot.chat or other interfaces we provide
    • You connect your accounts from:
      • E‑commerce platforms: Shopee, TikTok Shop, Lazada, etc.
      • Social platforms: Facebook, Instagram, LINE, etc.
    • You use our AI chatbot and automation features, integrations, and analytics

  • This Policy forms part of and is complemented by our Terms & Conditions, which describe:

    • User eligibility and account responsibilities
    • Use of the Platform
    • Third‑party platform integrations and data access
    • User rights, data retention, and breach notification
    • Relationship with partner platform policies

If there is any inconsistency between the summary in the Terms & Conditions and this Privacy Policy regarding data protection, this Privacy Policy prevails for privacy and data‑protection issues.

We process personal data in accordance with applicable data protection laws, including (where applicable):

  • Personal Data Protection Act B.E. 2562 (2019) (PDPA) of Thailand
  • General Data Protection Regulation (GDPR) for users located in the European Economic Area (EEA), if and where applicable
  • Any other data‑protection regulations that may apply in relevant jurisdictions

In addition, we comply with the Terms and Platform Policies of partner platforms, including but not limited to:

  • Meta (Facebook / Instagram) Platform Terms and Data Policy
  • Shopee Open Platform terms and documentation
  • TikTok Shop Partner terms and documentation
  • Lazada, LINE, and other platform‑specific terms and policies

If a partner platform changes its policies, we may need to adjust, restrict, suspend, or discontinue certain features immediately, as explained in our Terms & Conditions.

4. Definitions

For the purposes of this Policy:

“Personal Data”
Any information relating to an identified or identifiable natural person, such as name, surname, email, phone number, address, username on external platforms, and other identifiers.

“Sensitive Personal Data”
Certain categories of personal data defined by law as sensitive, such as health data, religious beliefs, political opinions, biometric data, etc.
M.A.D does not intend to collect or process sensitive personal data unless strictly necessary and supported by an appropriate legal basis and explicit consent under applicable law.

“Usage / Technical Data”
Data generated from your use of the Platform, including IP address, browser type, operating system, device type, logs of actions taken within the Platform, and cookie data.

“Data Controller”
The entity that determines the purposes and means of processing personal data. M.A.D acts as a data controller for the data of its own account holders (merchants) — for example, merchant account, profile, and billing data. For the personal data of a merchant’s own end‑customers that M.A.D processes through connected platforms (such as messages, comments, customer name/profile, and order details), the merchant is the data controller and M.A.D acts as a data processor, processing such data on the merchant’s behalf and in accordance with their instructions.

“Data Processor”
A third party that processes personal data on behalf of the data controller, such as cloud hosting providers, analytics services, or email delivery services.

“Partner Platforms”
Third‑party platforms you choose to connect to M.A.D, including but not limited to Facebook, Instagram, LINE, Shopee, TikTok Shop, and Lazada.

5. Information We Collect

5.1 Information You Provide Directly

We collect information that you provide to us directly, including:

  • Account information
    • Name and surname
    • Email address
    • Phone number
    • Password (stored in encrypted form)
  • Business / Store information
    • Store name
    • Logo
    • Contact details
    • Basic business profile data
  • Forms and communications
    • Messages sent via contact forms or support channels
    • Feedback, inquiries, or complaints
    • Attachments you upload for support or configuration purposes
  • Chatbot and automation content
    • Scripts, templates, auto‑reply messages
    • FAQs and knowledge‑base entries
    • Custom rules, tags, and configurations you define within M.A.D

5.2 Information Collected Through Use of the Platform

When you use M.A.D, we may automatically collect:

  • Usage logs
    • Login time, pages visited, features used
    • Clickstream and interaction data within the dashboard
  • Technical information
    • IP address
    • Browser type and version
    • Operating system and device type
    • Language and time‑zone settings
  • System performance and security logs
    • Error logs and crash data
    • Information required for debugging and monitoring system health

5.3 Information from E‑commerce and Social Platforms

When you connect external platforms to M.A.D, we collect data as authorised via each platform’s official APIs and your explicit consent.

Facebook / Instagram (Meta APIs)
Depending on permissions granted and Meta’s rules, this may include:

  • Basic profile: name, user ID, profile picture, email (if authorized)
  • Page information: list of pages you manage, page roles/permissions
  • Messaging data: page inbox messages (to enable chatbot/automation replies)
  • Posts and comments: content on pages required to manage comments and replies

Shopee / Lazada / other e‑commerce platforms
Depending on available APIs and your authorizations, this may include:

  • Store information: shop name, shop ID, store status, contact info
  • Product information: product listings, descriptions, images, prices, inventory
  • Order information: order IDs, order items, shipping status
  • Buyer information (to the extent permitted and necessary):
    • Recipient name
    • Shipping address
    • Phone number
  • Payment information: payment status (e.g., paid, pending), but not full credit‑card or bank account numbers, which are handled by the payment provider or platform directly

TikTok Shop
Depending on available APIs and your authorizations, this may include:

  • Seller account information: shop name, seller ID, contact details
  • Product information: listings, categories, prices, stock levels
  • Order and customer information:
    • Order details and order status
    • Shipping information and addresses
    • Customer name and phone number (only as necessary for order processing and automation)

LINE (e.g., LINE Official Account / Messaging API)
Depending on your settings and LINE permissions, this may include:

  • Connected LINE Official Account details
  • Message content exchanged between customers and your LINE OA, to allow M.A.D chatbot and automation to respond
  • Basic profile details of message senders (e.g., display name, userId) where allowed by LINE

5.4 Cookies and Tracking Technologies

We may use cookies and similar technologies on madbot.chat, including:

  • Essential cookies – required for core functionality:
    • Login and session management
    • Security and fraud prevention
  • Analytics cookies – to understand how the Platform is used and improve user experience:
    • Page visits, navigation paths, and feature usage
  • Marketing / tracking cookies (if used):
    • Measuring performance of advertising campaigns
    • Remarketing or retargeting where legally permitted and in accordance with relevant platform policies

Where required by law, we will request your consent before using non‑essential cookies. You can manage cookies through your browser settings and, where provided, our cookie banner or settings panel.

6. How We Use Your Information

We use the information we collect for the following purposes:

6.1 To Provide and Operate the Service

  • Create and manage your M.A.D account
  • Enable chatbot and automation features across Facebook, Instagram, LINE, Shopee, TikTok Shop, Lazada, and other connected platforms
  • Synchronize product data, stock, and orders from e‑commerce platforms
  • Display dashboards and reports (e.g., sales, order volumes, conversation metrics)
  • Provide customer support and resolve technical issues
  • Enable the merchant’s authorised human support agents to view and reply to customer messages and conversations when automated (AI chatbot) handling is insufficient; these agents are bound by confidentiality and data‑protection obligations

6.2 To Improve and Develop the Platform

  • Analyse usage data and feedback to enhance features and user experience
  • Test and debug new functionalities and system changes
  • Improve AI models and automation workflows, generally using aggregated or anonymized data where possible

6.3 To Communicate with You

  • Send service‑related notifications:
    • Account changes, system maintenance, feature updates
    • Security alerts and important notices
  • Respond to your inquiries and support requests
  • Send marketing or promotional content where you have given consent or where permitted by law, with clear options to opt out
  • Detect, investigate, and prevent fraud, abuse, or violations of our Terms & Conditions
  • Monitor and protect the security and integrity of our systems
  • Comply with legal obligations, regulatory requirements, and law‑enforcement requests

6.5 What We Do Not Do

  • We do not sell your personal data to third parties.
  • We do not use data obtained from Shopee, TikTok Shop, Lazada, Facebook, Instagram, LINE, or other partner platforms for unrelated advertising or any purpose other than:
    • Providing and improving M.A.D services as described in this Policy and the Terms & Conditions
    • Complying with applicable laws and partner platform policies

7. How We Share Your Information

We only share personal data in the situations described below and with appropriate safeguards.

7.1 Service Providers and Data Processors

We use carefully selected third‑party service providers to support our operations, such as:

  • Cloud hosting and storage providers
  • Email and SMS delivery services
  • Monitoring, logging, and analytics providers
  • Security and infrastructure service providers

These providers act as data processors and are contractually required to:

  • Use personal data only as necessary to provide services to us
  • Implement appropriate technical and organisational security measures
  • Comply with applicable data‑protection laws and our instructions

7.2 Partner Platforms You Connect

When you use features that require interaction with external platforms, we may send back or update certain data on those platforms, for example:

  • Posting or replying to comments and messages on Facebook, Instagram, or LINE on your behalf
  • Updating order statuses on Shopee, TikTok Shop, or Lazada through their APIs
  • Syncing message content or actions across integrated channels

We only exchange data that is necessary for the requested functionality and in accordance with each platform’s terms and your authorizations.

We may disclose your information if reasonably necessary to:

  • Comply with applicable laws, regulations, legal processes, or governmental requests
  • Enforce our Terms & Conditions or other agreements
  • Protect the rights, property, or safety of M.A.D, our users, or the public, as required or permitted by law

7.4 Business Transfers

If we are involved in a merger, acquisition, restructuring, sale of assets, or similar transaction:

  • Personal data may be transferred as part of that transaction
  • The receiving entity will be bound to respect this Policy or a privacy standard that is substantially similar
  • In case of material changes, we will notify you through appropriate channels

8. Data Retention

  • We retain personal data only for as long as necessary to fulfil the purposes described in this Policy and in our Terms & Conditions.
  • When personal data is no longer needed:
    • We will delete or securely destroy it; or
    • We will anonymise it so it can no longer be linked to you

8.1 Account Closure and Disconnection of Platforms

  • When you close your account or revoke access to a Partner Platform:
    • We will remove or anonymise related data within a reasonable period (for example, within 30 days), except where longer retention is required by law or necessary to protect our legal rights
  • Certain transactional records (e.g., invoices, tax records) may be retained for the duration required by applicable law.

Further details on retention and deletion procedures are aligned with the “Data Retention and Breach Notification” and “User Rights and Data Deletion” sections in our Terms & Conditions.

9. Data Security and Breach Notification

9.1 Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

  • Encryption of data in transit (e.g., HTTPS/TLS) and encryption of stored sensitive data, such as account passwords and platform access tokens
  • Access controls and authentication mechanisms to limit access to authorised personnel only
  • Regular backups and measures to prevent data loss
  • Logging and monitoring of system activity to detect anomalies or suspicious behaviour

Despite our efforts, no method of transmission or storage is completely secure. You are responsible for:

  • Keeping your account credentials confidential
  • Using strong and unique passwords
  • Not sharing login details with others
  • Notifying us promptly if you suspect unauthorised access to your account

9.2 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

  • We will assess the incident without undue delay
  • We will notify relevant supervisory authorities (e.g., under PDPA/GDPR) within the legally required timeframe (for example, within 72 hours, where required)
  • We will inform affected users as soon as reasonably practicable, providing:
    • A description of the nature of the breach
    • The types of data affected
    • Potential consequences
    • Measures taken or proposed to address the breach and mitigate its effects

This is consistent with the “Data Retention and Breach Notification” provisions in our Terms & Conditions.

10. Your Rights and Choices

Subject to applicable law (e.g., PDPA, GDPR), you may have some or all of the following rights:

  1. Right of Access

    • Request confirmation whether we process your personal data and obtain a copy of such data.

  2. Right to Rectification

    • Request correction of inaccurate or incomplete personal data.

  3. Right to Erasure (“Right to be Forgotten”)

    • Request deletion of your personal data when:
      • It is no longer necessary for the purposes for which it was collected; or
      • You withdraw consent (where processing is based on consent); or
      • You successfully object to processing; or
      • Deletion is required by law

  4. Right to Restrict Processing

    • Request temporary or permanent restriction of processing in certain circumstances (e.g., while we verify accuracy of data or our legitimate grounds to process it).

  5. Right to Object

    • Object at any time to processing of your personal data for direct marketing.
    • In some cases, object to processing based on our legitimate interests.

  6. Right to Withdraw Consent

    • Where processing is based on consent, you may withdraw that consent at any time, for example:
      • Opting out of marketing communications
      • Disconnecting external platforms via your account settings
    • Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

  7. Right to Data Portability

    • In certain cases, request to receive your personal data in a structured, commonly used, and machine‑readable format and to have it transmitted to another controller.

  8. How to Exercise Your Rights

    • You may contact us at: [email protected]
    • We may need to verify your identity before acting on your request to protect your data.
    • We aim to respond within the period required by applicable law or within a reasonable time.

Additional details on user rights and deletion procedures are aligned with the “User Rights and Data Deletion” section in our Terms & Conditions.

11. Cookies and Tracking Technologies

As described in Section 5.4:

  • We use cookies and similar technologies for:
    • Essential functionality (sessions, authentication, security)
    • Analytics (to understand and improve how users interact with our Platform)
    • Where applicable, marketing (to measure campaign effectiveness), in line with legal requirements

You can control cookies via:

  • Your browser settings (e.g., blocking third‑party cookies or all cookies, deleting cookies)
  • Any cookie settings interface we make available on our website

Note that disabling some cookies, especially essential ones, may affect the functionality of the Platform and your ability to use certain features.

12. International Data Transfers

Your personal data may be stored or processed on servers located outside your country of residence, including in countries that may have different data protection laws.

When we transfer personal data internationally, we will:

  • Use reputable service providers with appropriate security and compliance standards; and
  • Implement safeguards required by applicable law, such as:
    • Contractual protections (e.g., standard contractual clauses, where relevant)
    • Other legally recognised mechanisms for international data transfers

13. Relationship with Partner Platform Policies

You are responsible for reviewing and complying with each platform’s terms independently.
If changes in partner platform policies affect our ability to provide certain features, we may need to modify, suspend, or remove those integrations, as further described in our Terms & Conditions.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to:

  • Reflect changes in laws or regulatory requirements
  • Reflect changes in our services, features, or business practices
  • Improve clarity and transparency

When we make material changes:

  • We will notify you via the Platform, by email, or through other reasonable means
  • The “Last updated” date at the top of this Policy will indicate when the latest changes took effect

Your continued use of the Platform after any update constitutes acceptance of the revised Policy. If you do not agree with the revised Policy, you should stop using the Platform and may request deletion of your data as outlined above.

15. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, you can contact us at:

If you believe that our processing of your personal data does not comply with applicable law, you may also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.