Data processing terms

Parties and scope

Effective date: 20 October 2026

These terms are between the business using Tellfox ("the business", the data controller) and Foxsoft Solutions Co., Ltd., company registration number 0105564127624, head office at 723 Charoen Nakhon Road, Khlong Ton Sai, Khlong San, Bangkok 10600, Thailand, which provides Tellfox ("Tellfox", the data processor). They apply from when the business accepts the terms of service and for as long as Tellfox processes data on its behalf.

They cover only the customer data the business keeps in Tellfox. Owner and team account data, for which Tellfox is the controller, is covered by the privacy policy. Where these terms and the terms of service differ on personal data, these terms apply.

Details of the processing

• Data subjects: the business's customers, people who book or join classes, stamp card members, and anyone the business imports or adds as a customer
• Types of data: name, phone, email, LINE user ID and LINE name, language, birthday, bookings, classes, packages, stamp cards, points, coupons, tags, notes, consent records, messages sent to customers, and customers' messages to the Tellfox bot
• Sensitive data: the business may record health information, such as allergies or symptoms, in customer notes, and must get explicit consent first. For clinic businesses, Tellfox does not save patients' messages to the bot.
• Purposes: taking and managing bookings, sending confirmations and reminders, keeping customer records and stamp cards, sending offers customers agreed to, and letting the AI assistant prepare drafts at the business's request
• Duration: while the business uses Tellfox, and until the data is deleted as described under "When the service ends"

What the business does

• Has a lawful basis to collect and use customer data, and tells customers why
• Gets consent before sending offers, and explicit consent before keeping sensitive data
• Imports only data it obtained lawfully
• Gives team members access only to what their work needs
• Answers customers' requests to use their rights, with the help of Tellfox's tools

What Tellfox does

• Only on the business's instructions: Tellfox processes data under these terms, the terms of service, and the business's settings and actions in Tellfox, which count as its instructions. Tellfox tells the business if it believes an instruction breaks the law.
• No other use: Tellfox doesn't sell customer data or use it for other businesses or its own marketing. The business allows Tellfox to use usage statistics and de-identified data (such as labels of messages to the bot) to run and improve Tellfox.
• Confidentiality: Tellfox staff who can access data are bound to confidentiality, and look at customer data only when needed for support or to check failures.
• Security: each business's data is kept apart, every request is checked against the person's role, sign-in uses signed cookies, private files have no public link, data is encrypted in transit, and technical logs hold no names or message text.
• Help with requests: Tellfox gives the business tools to download one customer's data, export customers as a CSV file, correct data, and delete or anonymise a customer. If a customer sends a request to Tellfox directly, Tellfox passes it to the business without delay.
• Breach notice: Tellfox tells the business without delay, and within 48 hours of becoming aware of a personal data breach affecting its data, with the information the business needs to notify the PDPC office.
• Records: Tellfox keeps records of processing as the PDPA requires, and gives reasonable help when the business needs a data protection impact assessment.

Sub-processors

The business allows Tellfox to use these sub-processors. Tellfox has a data protection agreement with each, giving at least the protection of these terms, and remains responsible to the business for them.

• Cloudflare, Inc. (United States; database in the Asia-Pacific region): the platform Tellfox runs on: database, file storage, email sending, bot checks and AI (Workers AI, AI Gateway)
• LY Corporation and its affiliates (Japan, and countries where LINE processes data): sign-in with LINE and LINE messages
• Anthropic, PBC (United States): the Claude AI model when the assistant needs it; it receives only what owners and their teams send the assistant

Stripe takes the business's payments for its plan and receives none of the business's customer data.

Tellfox tells the business by email at least 30 days before adding or replacing a sub-processor. If the business objects on data protection grounds, it may cancel before the change applies and we refund the unused part of the period.

Transfers abroad

The sub-processors above may process data outside Thailand. Tellfox transfers data abroad under sections 28 and 29 of the PDPA, relying on each sub-processor's data protection agreement.

When the service ends

Before closing a business, the owner can download its customers as a CSV file and each customer's data. After the business is closed, Tellfox deletes its customer data within 30 days, and from backups within 90 days, except what the law requires to be kept.

Audits and liability

On the business's written request, Tellfox provides the information needed to show it complies with these terms (at most once a year).

Liability under these terms follows the liability section of the terms of service, unless the law says otherwise.

Questions about these terms: hello@tellfox.app