1. Our core principle: an encrypted private space

The life data you record (appointments, tasks, notes, assets, finances, documents, pets, chat history, e-docs emails and data synced from connected accounts) is encrypted on your device with a key you hold. Our staff and servers cannot read stored content. Some features need the server to see content briefly to work, such as sending your message to the AI, sending an email or fetching data from Google. In those cases content is processed in memory only and encrypted with your key before it is stored.

Even though we cannot read encrypted content, we treat ourselves as the data controller processing all of this data, because our system stores, transfers and decrypts it on your device. This policy and all your rights therefore apply to encrypted data too.

2. Information we collect

• Account: email, verification status, user ID, sign-up and last sign-in time. With Google Sign-In: name, email, profile photo and Google account ID (we never receive your password).
• Private space: your public key, key fingerprint, your private key file locked with your recovery code, and encrypted content we cannot read. We do not store your recovery code.
• Chat with Maya (with your consent): messages and photos you send are processed by Google Vertex AI (Gemini) to produce a reply. Our servers do not log the content. Chat history is stored encrypted in your private space. We keep your consent record and monthly token counts for quotas.
• Emails Maya sends for you: the recipients, subject, body and attachments you confirm are sent through Amazon SES, and an encrypted copy is kept in e-docs. Replies to Maya's reply address arrive through Cloudflare Email Routing and are encrypted into e-docs immediately. Addresses that bounced or reported spam are kept as a keyed hash so we stop sending to them.
• System emails: sign-in links, welcome emails and your encrypted key backup are sent through Amazon SES; we count send requests to prevent abuse.
• Connected accounts (if you choose): see section 3.
• Notifications: a device token for push and a device name. Notifications never show private details.
• Places, weather and travel time (when you ask): the city or location you choose or allow is sent to Google Maps Platform (Weather, Air Quality, Places, Routes).
• Payments (when enabled): plan status and invoices. Card details stay with Stripe; we never see your card number.
• Technical: IP address and device data for security and bot protection (Google reCAPTCHA Enterprise, Firebase App Check), and security event logs.
• Pre-launch registration: email and mobile number, encrypted before storage.
• Browser storage and analytics: see Cookies and analytics. We do not use advertising cookies.

3. Data from Google and Microsoft (connected accounts)

• When: only when you connect an account in Settings and choose which categories. Everything works without connecting.
• Google permissions requested: see your list of calendars (read-only) and see, create, edit and delete events (calendar.calendarlist.readonly, calendar.events); see, create, edit and delete contacts (contacts); see, create, edit and delete tasks (tasks); plus the account's name, email and profile photo.
• Microsoft permissions requested: calendars, contacts, tasks and OneNote, and reading mail only where enabled and you choose it.
• How we use it: to show your events, contacts and tasks in KhunLeka, let Maya remind you and answer questions about them, and — when you edit, add or delete something in KhunLeka — send that change back to the source account as you asked. We do not use this data for advertising, do not sell it, and do not use it to train AI models.
• How we store it: access and refresh tokens are encrypted (AES-256-GCM) on our servers and never sent to the app. Fetched data is encrypted with your key before it is stored; our staff cannot read it. Data syncs about every 30 minutes or when you tap sync; items deleted at the source are deleted here.
• Sharing: we do not share it with third parties except the processors in section 5. When you ask Maya about something that needs this data, the relevant part is sent to Vertex AI to answer, under your AI consent.
• Revoking access: tap “Disconnect” in Settings — we revoke our access with Google, delete the tokens immediately, and you can choose to delete the synced data. You can also revoke access at myaccount.google.com/permissions.

KhunLeka's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Sensitive data

Some data you choose to record may be sensitive data under section 26 of the PDPA, such as health information in notes, chats or documents, and details on ID cards or passports (for example religion or a face photo). We process it only with your explicit consent given in the app, which is separate from accepting the Terms and is not a condition of using the service. Before you save your first ID card or passport, the app asks for consent for that again.

You can withdraw consent at any time by deleting that data or by writing to dpa@khunleka.com, dpa@otfuture.com. Withdrawal does not affect earlier processing.

5. Other people's data you record or send

You may record other people's data, such as contacts, family members' details and document copies, or have Maya email other people. We process this data only to provide the service on your instructions, stored encrypted with your key. You are responsible for making sure you may record or send it.

For recipients of emails Maya sends: we process the email address, name and content to deliver the email and keep a copy for the user. We accept replies only from the original recipients, and every email links to this policy. Recipients can exercise the rights in “Your rights” at dpa@khunleka.com, dpa@otfuture.com.

6. Purposes and legal bases

7. Processors we share data with

We do not sell personal data. We share data only with processors needed to provide the service, under contracts that require security.

• Google LLC — Firebase (Authentication, Hosting, Firestore, Storage, Functions, Cloud Messaging), Google Sign-In, Vertex AI (Gemini), Google Maps Platform, reCAPTCHA Enterprise / Firebase App Check, Google Analytics (with consent) and the Google Calendar / People / Tasks APIs (when you connect)
• Microsoft Corporation — Microsoft Graph (when you connect)
• Amazon Web Services, Inc. — Amazon SES (Singapore region) for system emails and emails Maya sends for you
• Cloudflare, Inc. — receiving replies to Maya's emails and forwarding them to our system
• Stripe — when payments are enabled
• External AI assistants you connect yourself via MCP — only what you allow; encrypted content stays unreadable
• Public authorities — only where required by law or a lawful order

8. International transfers

These processors may store or process data outside Thailand, such as in Singapore, the United States and other regions the AI provider uses for processing. We choose providers with appropriate safeguards, such as standard contractual clauses, under sections 28–29 of the PDPA.

9. Cookies and analytics

We use two kinds of cookies and browser storage. Analytics cookies are not loaded at all until you tap “Accept”. Your choice applies to both khunleka.com and app.khunleka.com.

What we send to Google Analytics: the page address without URL parameters, device and browser details, approximate location derived from IP (Google Analytics does not store IP addresses) and usage events. We never send your email, name, phone number, user ID or private-space data, and Google signals and ad personalisation are turned off.

You can withdraw consent at any time with “Cookie settings” at the bottom of every page; we then stop collecting analytics and delete the _ga cookies on our domains.

10. Retention

• Account data: while your account is active and 90 days after the service ends or you ask for deletion
• Private-space content, including your public key and encrypted key file: until you delete it, or 90 days after account deletion
• Connected-account tokens: until you disconnect or delete your account. Synced data: until deleted at the source, until you disconnect and choose to delete it, or until account deletion
• Maya's reply addresses: 90 days after sending
• Push device tokens: until you turn notifications off or the token expires
• Pre-launch registration: until we send your invitation, 12 months, or until you ask us to delete it, whichever comes first
• Security logs: 1 year
• Monthly token counts and AI consent records: while your account is active (the consent record is deleted as soon as you withdraw)
• Email and registration rate counters: deleted automatically within 2 days
• Google Analytics data: up to 14 months; analytics cookies expire after 13 months
• Payment and tax records: as required by accounting and tax law
• Backups: deleted on the backup rotation schedule

11. Your rights

You may request access to or a copy of your data, portability, objection, deletion or anonymisation, restriction, and correction, and you may withdraw consent at any time. Withdrawal does not affect processing done before it.

Send requests to privacy@khunleka.com or dpa@khunleka.com, dpa@otfuture.com. We reply within 30 days and may need to verify your identity. We can delete data encrypted with your key but cannot hand over its readable content; you can export it yourself from the app. If your recovery code and every unlocked device are lost, we cannot recover encrypted data.

If you believe we have not complied, you may complain to Thailand's Personal Data Protection Committee (PDPC).

12. Security

We use encrypted connections (HTTPS), limit staff access, encrypt registration data and designed the private space to be encrypted on your device. If a data breach poses a risk, we will notify the PDPC within 72 hours and notify you without undue delay when the risk is high.

13. Children

KhunLeka is not designed for people under 20. If we learn we have collected a minor's data without consent from a parent or guardian, we will delete it.

14. Changes and contact

We will tell you about important changes by email or in the app before they take effect. Version 5 (11 October 2026) brings the policy in line with features now live and adds connected Google/Microsoft accounts with the Limited Use requirements, emails Maya sends and receives, notifications, places and weather, MCP, and this English translation. Controller: OT Future Limited Partnership, 222/16 Moo 2, Soi Vibhavadi-Rangsit 60 Yaek 18, Talat Bang Khen, Lak Si, Bangkok 10210, Thailand · privacy@khunleka.com. Data protection contact: dpa@khunleka.com, dpa@otfuture.com.