Privacy policy

GORINY Business Suite is a web-based point of sale (POS) and business management system for SMEs in Thailand, covering sales, inventory, purchasing, accounting and tax, HR, and marketing.

The service provider and data controller under this policy is Mr. Nattanon Srimongkol, who operates GORINY Business Suite (in this policy, the "service provider", "we" or "us"). For personal data matters, contact hello@goriny.com

Person responsible for personal data: Mr. Nattanon Srimongkol, service provider, 187/2 Krungthep Kreetha 7 Road, Hua Mak, Bang Kapi, Bangkok, phone 083-927-2676. For customer and employee data that businesses record in the app, we are the data processor under the Data Processing Agreement

Partner programme: Chaimongkol Inter Group Co., Ltd., company registration number 0115559021627, is the party to the partner agreement and pays the referral fees, so it is a controller of the data in section 2 (i), (j) and (k) jointly with the service provider. The service provider lets the company use the sign-up records and service fees of shops that sign up with a partner code only to calculate and pay referral fees. For data in this programme, contact the same email address.

(a) User account data: email, user name and your password in encrypted form (we cannot see your actual password), plus the business and branches your account belongs to and the permissions you have been given.

(b) Business data you enter yourself: products, customers, suppliers, employees, sales and purchase documents, accounting entries and payroll data. This data may include personal data of third parties that you record, such as your customers' names and phone numbers or your employees' details, so you own this data and we only process it on your instructions.

(c) System usage data: sign-in times, changes to important data and system errors, kept for security and later review.

(d) Cookies and data stored in your browser: essential cookies keep you signed in. The website remembers the channel you arrived from in your browser until you close the page, and if you turn on the analytics and advertising category, it remembers it for 30 days (see (e)). You can change your mind at any time with the cookie settings link at the bottom of the website. If you turn on the analytics and advertising category, the website loads the Meta and Google Ads advertising measurement tags to count page views and whether ads bring people to send the contact form, open the demo or sign up for a trial. If you leave it off, the website loads no advertising scripts at all (for visit statistics, see (f)).

(e) Prospect data from the website: when you fill in the contact form on goriny.com, we collect your name, phone number, email, business type, message and the channel you arrived from (utm), in order to contact you, answer your questions and review partner applications. We keep it for 12 months from your last contact, then delete it. The channel you arrived from means the campaign name attached to the link, the Google ad click ID, the first page you opened on our website, the name of the website that sent you (domain name only, not the full address) and the time of your first visit. This data stays in your browser until you close the page, and is remembered for 30 days only if you turn on analytics and advertising cookies. It is sent to us only when you press send on the form.

(f) Website visit statistics: we use Vercel Web Analytics, which counts page views, countries and device types without cookies and without identifying anyone.

(g) Onboarding emails during the trial: when you sign up for a trial, we send the shop owner at most 5 emails on how to get started, from the start of the trial, the last one no more than 5 days after it ends. To choose what to suggest, the system only checks whether the shop has started the main tasks, such as adding products, issuing a sales document, entering a tax ID, opening a POS shift, adding employees or adding a bank account, without reading any details or amounts. Every email has an unsubscribe link. After you unsubscribe you will not receive onboarding emails again, while emails about your account and payments are still sent as usual. Some email apps load a typeface from Google Fonts when you open the email.

(h) Introduction emails to businesses: we may email addresses that a business has published itself on its own website or page for business contact. This is one introduction email per email address, stating clearly who is sending it, why, and where the address was found, with links to supporting documents. We do not send further offer emails unless the recipient replies. We keep the business name, business type, province, email address, the link to the page where the address was found, notes by our administrators, unsubscribes, the sending history and the delivery results reported by our email provider, such as bounces or spam reports, in order to send the introduction email and not send it again, on the basis of legitimate interests. Every email has an unsubscribe link. Unsubscribing stops sending immediately, and you can object at any time at hello@goriny.com.

(i) Partner (referrer) data: when you are a partner, we keep the name of the person or company, the entity type (individual or company), tax ID, email, phone number, VAT registration, bank name, account name and account number or PromptPay, your partner code, the referral fees bill by bill, withholding tax, the transfer history and copies of customer notices you send us when we ask, in order to perform the partner agreement, pay referral fees and withhold and remit tax as the law requires, on the basis of contract and legal obligation. When an administrator changes payout account details, the administrator activity log keeps only the last 4 digits of the account number and PromptPay.

(j) Shops that sign up with a partner code: when you open the sign-up page from a partner's link or fill in the Partner code (optional) box, we record which partner your shop is linked to, the code used, whether it was linked from the sign-up page or by an administrator, the date, the extra trial days given and whether you agreed to show your shop's name, and we use the service fees excluding VAT that the shop pays GORINY to calculate the referral fee bill by bill. This is to give 30 extra free trial days and calculate referral fees, on the basis of contract under the Terms of Use. The shop pays the same price as someone who signs up on their own. The partner sees the shop's name in the referral fee list only if the shop ticks a separate consent box on the sign-up page, which is not ticked in advance, on the basis of consent. Without consent, the partner sees the shop as a sequence number with the referral fee. Not agreeing does not affect signing up, use of the program or the price. The partner programme does not let partners see the shop's business data, such as sales bills, purchase bills, ledgers or tax. A partner sees that data only if the shop separately invites them into the program as its accountant, with the permissions the shop sets.

(k) Checks for improper referrals: before linking a shop to a partner, the system compares the partner's tax ID and email with the shop's tax ID and the email used to sign up, to prevent self-referral, and checks whether the shop has had a trial before. Referral fees for bills that were refunded or disputed, or for shops flagged as repeat trials, are put on hold, on the basis of legitimate interests. The system only puts them on hold; an administrator reviews every case before deciding, and the partner can respond under clause 8 of the partner agreement.

Connecting a Google account is optional. The app works fully without it. If you choose to connect, we request only one permission: https://www.googleapis.com/auth/adwords

What it is used for: to read advertising cost reports from your Google Ads account and show them next to the sales in the app, so you can see whether each advertising channel is worth it.

What we keep: the connection token (refresh token), encrypted in our database, and the ad cost figures retrieved. We do not read your email, files or contacts, and we do not change or create any ads in your account.

You can cancel at any time: disconnect in the app in the marketing channels menu, or revoke access at myaccount.google.com/permissions. Once you cancel, we delete the token from our system.

GORINY Business Suite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide the app's functions as you instruct, such as issuing receipts, deducting stock and calculating payroll
• To verify identity and control each user's access within your business
• To keep the system secure, review past activity and fix problems when you report them
• To keep backups so data can be restored after a fault
• To send emails about your account and use of the service, such as trial links, onboarding emails during the trial as described in section 2 (g), and system notifications
• To send introduction emails to businesses as described in section 2 (h)
• To give extra trial days to shops that sign up with a partner code, calculate and pay referral fees, withhold and remit tax, and check for improper referrals, as described in section 2 (i), (j) and (k)
• To answer questions through the AI assistant when you ask. The system sends your question and the summary figures needed for the answer (such as sales, receivables and stock) to the language model provider Anthropic for temporary processing. Your data is not used to train models, and you can choose not to use the AI assistant while the app keeps working fully

We do not sell your data and we do not use your business data for advertising.

We disclose data only to the service providers the system needs in order to work, namely:

• Supabase database and authentication
• Vercel servers that deliver the web pages
• Stripe monthly service fee payments (we do not store your card number)
• Anthropic AI assistant, only the question text and summary figures described in section 4
• Google only when you choose to connect a Google Ads account, as described in section 3
• LINE only when a business chooses to connect a LINE Official Account to the Lead inbox
• Resend sends system emails, such as trial links, onboarding emails, emails to businesses as described in section 2 (h) and file delivery emails to a business's customers
• Meta and Google advertising measurement tags on the website, only when you turn on the analytics and advertising category as described in section 2 (d), under each provider's business tools terms
• Cloudflare bot check (Turnstile) on the sign-in page, trial sign-up page, forgot-password page, demo button, contact form and partner form, seeing the IP address and the browser and device signals needed only to check that the user is a real person and not an automated program

Each provider above, other than the Meta and Google advertising tags, is bound by a data processing agreement with data protection duties no lower than Thai law. What each one does and where it stores data is set out in section 4 of the Data Processing Agreement. Meta and Google use the data under their own terms and privacy policies

In the partner programme we also disclose the following:

• The partner receives the bill-by-bill referral fee list for shops that signed up with their code, showing the shop name only for shops that consented under section 2 (j)
• Chaimongkol Inter Group Co., Ltd. receives partner data, the links between shops and partners, and the service fees of shops that signed up with a partner code, in order to pay referral fees under section 1
• The Revenue Department receives the partner's name, tax ID, referral fees and the tax withheld, when withholding tax returns are filed
• The paying bank receives the partner's account name and account number or PromptPay, when referral fees are transferred

Partners are not our data processors, but they must use the data they receive only to track their own referral fees, must not disclose it further, and must delete it when the agreement ends, under clause 9.2 of the partner agreement.

Beyond this, we disclose data only when ordered to by law.

The app's database is in a data centre in Australia, and some of the providers in section 5 process data in the United States and Japan, while the Cloudflare bot check runs at the data centre nearest the user in its global network. Thailand has not yet announced a list of countries with adequate data protection standards, so we use appropriate safeguards under section 29 of the Personal Data Protection Act, namely standard contractual clauses in the data processing agreement with each provider, which require protection no lower than Thai law and require them to notify us of any breach, except for the Meta and Google advertising tags, which follow each provider's own terms.

Your business data is kept for as long as your account is in use, because Thai law requires accounting and tax documents to be retained. When you cancel the Service, you can export all your data within 30 days, and we will delete your business's data from our systems within 90 days. Older backup files that still contain it rotate out within 6 months after that, except for the parts the law requires us to keep ourselves, such as records of service fee payments.

Prospect data from the website is kept for 12 months, system logs for 90 days, and the Google Ads connection token is deleted as soon as you disconnect. The record of which onboarding email was sent and when is kept for the life of the account. Data about businesses we email under section 2 (h) is deleted within 12 months of the last email, or within 30 days after unsubscribing. After deletion we keep only the email address so that we do not contact it again.

Partner programme data: the partner's financial and tax records, namely referral fees, withholding tax and the transfer history, are kept for at least 5 years under accounting and tax law. Copies of customer notices that partners send us are kept for 5 years. Other partner account data and the links between shops and partners are kept while referral fees are still arising, and for 90 days after the agreement ends or the shop stops using the service. If the data is needed for legal proceedings, it is kept until they end.

Under the Personal Data Protection Act B.E. 2562 (2019) (PDPA), you have the right to request access to, a copy of, correction of, deletion of, or restriction of use of your personal data.

The app already has a menu for you to download a copy of your business's data yourself. To exercise any other right, contact hello@goriny.com. We acknowledge requests within 7 business days and complete them within 30 days as the law requires. If you believe we are not complying with the law, you have the right to complain to the Office of the Personal Data Protection Committee.

If you are a customer or employee of a business that uses the app, your data is under that business's control. Please contact the business directly, and we will help the business act on your request.

Withdrawing consent to show the shop name: a shop that agreed to let the partner see its name under section 2 (j) can withdraw that consent at any time by emailing hello@goriny.com from the shop owner's email address. Referral fee lists sent to the partner after we receive the request will show the shop as a sequence number instead. Withdrawing does not affect use of the program or the price, and does not affect what was done before the withdrawal. Partners can ask for copies of their own referral fee lists, statements and withholding tax certificates at the same email address.

Data is always sent over encrypted HTTPS, and the database enforces separation of data between businesses at database level (Row Level Security), so users of one business cannot see another business's data. Each user is also limited to the branches and menus they have been given access to.

If a data breach happens, we have a written response procedure. We will notify the affected business owners within 24 hours of becoming aware, with the information the business needs to notify the Office within 72 hours, and for data where we are the controller ourselves, we notify the Office of the Personal Data Protection Committee within 72 hours as the law requires.

If we make changes, we will update the date at the top of this page and tell users in the app when the change is significant.