Privacy Policy

The Tale Company Limited ("the Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the TALE platform and services (the "Services") in accordance with the Personal Data Protection Act B.E. 2562 (PDPA) of Thailand.

1. Data We Collect

We collect information that identifies, relates to, or could reasonably be linked to you ("Personal Data"):

• Account Data: Name, email address, password, and profile preferences.
• Payment Data: Billing address and partial payment information (processed via our secure third-party payment processors).
• Technical Data: IP address, browser type, device information, and usage patterns (collected via cookies and similar technologies).

2. User Inputs and AI Processing

Our Services include AI features that generate output based on the content you provide (such as photos, images, and text prompts). This section explains how that input is handled:

• Third-Party AI Processing: When you use these features, your inputs are transmitted to our third-party AI model providers — Google (Gemini) and OpenAI — via their APIs solely to generate the output you have requested.
• No Storage by the Company: We do not store your inputs in our own systems. Once your output has been generated, your inputs are not retained on our servers.
• Processing and Retention by AI Providers: Your inputs are transmitted to and temporarily retained by our AI Providers (OpenAI and Google) under their own data-retention and privacy terms. We may access the inputs and outputs associated with your use of the Services through those providers' interfaces for the purposes of operating, supporting, troubleshooting, and improving the Services. We do not use your inputs to train our own models.
  • Face Data: Some photos you provide as input may depict a person's face. The following explains how such data is handled:
    • Collection: We do not collect, scan, map, or extract face data or other biometric identifiers from your photos. No facial recognition or face detection is performed, and no face templates or embeddings are created or derived. The Services do not use Face ID / LocalAuthentication.
    • Use: We do not use face data for identification, authentication, or any other purpose. Photos are used only as generic reference images to generate the output you have requested.
    • Disclosure and Sharing: We do not share, sell, disclose, or otherwise provide face data or biometric identifiers to any third party, for any purpose whatsoever — because we neither collect, create, nor derive any such data in the first place. The only content transmitted to our AI Providers (OpenAI and Google) is the photo itself, sent solely as a generic reference image to generate the output you have requested; no facial features, templates, or biometric information are extracted from it or sent to anyone.
    • Retention: We do not retain face data, and we do not store your photos in our own systems. Our AI Providers hold submitted content only for limited periods under their own data-retention terms.

3. Legal Basis for Processing

Under the PDPA, we process your data based on the following legal grounds:

• Contractual Necessity: To provide the Services you signed up for.
• Legal Obligation: To comply with Thai laws (e.g., tax reporting or the Computer Crimes Act).
• Legitimate Interests: To operate, support, troubleshoot, and improve the Services, ensure security, and prevent fraud.
• Consent: Where you have explicitly opted-in to marketing or specific data uses.

4. How We Use Your Data

We use your Personal Data to:

• Operate and maintain your account.
• Process payments and provide customer support.
• Investigate and troubleshoot reported issues, including reviewing the inputs and outputs associated with a reported generation, and maintain and improve the Services.
• Send administrative updates and, with your consent, promotional materials.

5. Data Sharing and Disclosure

We do not sell your Personal Data. We may share data with:

• Service Providers: Cloud hosting (e.g., AWS/Google Cloud), AI model providers (OpenAI and Google), and payment processors.
• Legal Authorities: When required by a court order or to comply with the Computer Crimes Act.
• Business Transfers: In the event of a merger, acquisition, or sale of assets.

6. International Data Transfers

As an AI service, your data may be processed on servers located outside of Thailand (e.g., in the US or Singapore). We ensure that such transfers comply with PDPA requirements by implementing standard contractual clauses or ensuring the destination country has adequate data protection standards.

7. Data Retention

We retain only the categories of Personal Data described in Section 1 (Data We Collect). We do not retain your AI inputs in our own systems; such inputs are held by our AI Providers for limited periods under their terms, as described in Section 2. We retain the Personal Data we do collect only for as long as:

• Your account remains active.
• It is necessary to provide you with the Services.
• It is required to comply with our legal and tax obligations in Thailand (typically 5–10 years for financial records).

8. Your Rights Under PDPA

As a data subject under Thailand's PDPA B.E. 2562, you have the following rights:

• Right to be Informed (S.23): To receive this notice before or at the time we collect your data.
• Right to Access (S.30): To request a copy of your data and disclosure of how we obtained it. We respond within 30 days.
• Right to Data Portability (S.31): To receive your data in a machine-readable format or have it transferred to another controller where technically feasible.
• Right to Erasure (S.33): To request deletion or anonymization of your data when it is no longer necessary, consent is withdrawn, or it was unlawfully processed — subject to our legal retention obligations (Section 7).
• Right to Rectification (S.36): To request correction of inaccurate or incomplete data.
• Right to Object (S.32): To object to processing based on legitimate interests. We will cease unless we have compelling grounds or legal claims require otherwise.
• Right to Restrict Processing (S.34): To request suspension of processing while accuracy is verified, an objection is assessed, or data is needed for legal claims.
• Right to Withdraw Consent (S.19(5)): To withdraw consent at any time via your account settings or by contacting us. Withdrawal does not affect prior lawful processing but may limit service delivery.
• Right to File a Complaint (S.73): To lodge a complaint with the PDPC if you believe we have not complied with the PDPA.

To exercise these rights, contact our Data Protection Department through support@talestudio.ai.

9. Security

We implement technical and organizational measures (such as encryption and access controls) to protect your data. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:
Data Protection Officer at The Tale Company Limited
Email: support@talestudio.ai
Address: 75/8 Grand Crystal, Pradit-Manutham road, Nuanchan, Buengkum, Bangkok 10230 Thailand