Privacy Policy

01Who we are

AIROVA AI CONSULTANT CO., LTD. (company registration no. 0105569058191) is the data controller for personal data collected through airova.ai, AiROVA Studio, and all related services. If you have questions about this policy, see the contact details at the bottom of this page.

02Data we collect

We collect the following categories of personal data:

• Contact details you submit through forms (name, email, phone, company, role).
• Lead context (which plan you're interested in, business type, expected timing, free-text messages).
• Account details when you sign up for AiROVA Studio (name, email, profile picture, a hashed password, or the profile data from the Google/GitHub account you sign in with).
• Payment details, which are processed by Stripe — we store only a customer reference and your order history, never your card number.
• Technical data set automatically when you visit the site (IP address, device, browser, referring URL, pages viewed).
• Cookie identifiers (see the Cookies section).

Data generated specifically by using AiROVA Studio is covered in the next section.

We do not knowingly collect sensitive personal data (race, religion, health, etc.). Please do not submit or upload such data.

03Data in AiROVA Studio

When you use AiROVA Studio to create content, we store:

• The prompts you type and the settings you choose for each run — kept so you can reopen and tweak previous work.
• Files you upload, such as product photos or reference images.
• The output AI generates for you (images, video, text).
• A technical log of AI calls, used for troubleshooting and credit accounting — kept for 30 days, then deleted automatically.

What we do not do:

• We do not use your prompts, files, or output to train our own AI models.
• We do not make your work visible to other users unless you choose to publish it as a public template yourself.

Files and output are deleted automatically according to your plan (Free 7 days · Starter 60 days · Pro 120 days · Pro MAX 180 days). After that they move to trash and remain recoverable for a further 7 days before permanent deletion.

Your prompts and reference files are sent to our AI model providers in order to generate output — see 'Who we share data with' and 'International transfers' below.

04Why we use your data

• Respond to your enquiry and follow up with relevant information.
• Send proposals, quotations, and onboarding for clients who choose to engage us.
• Improve the website, measure marketing performance, and prioritise content based on usage patterns.
• Comply with legal obligations (tax, accounting, regulatory requests).

05Lawful basis

We rely on different bases under PDPA depending on the activity:

• Consent — for analytics, marketing cookies, and marketing communications.
• Contractual necessity — to deliver services you've engaged us for.
• Legitimate interest — to operate the website, secure it against abuse, and reach back out to leads who initiated contact.
• Legal obligation — to keep records required by Thai law.

06Who we share data with

We share data only with providers that help us run the service, under agreements that bind them to confidentiality:

The airova.ai website

• Hosting and database: Vercel, Neon (Postgres), DigitalOcean Spaces.
• Email delivery: Resend.
• Analytics and marketing: Google (Analytics, Tag Manager), Meta (Pixel, Conversions API), X (Pixel) — only when you grant the corresponding cookie category.

AiROVA Studio

• AI model providers: Google (Gemini, Veo, Imagen), OpenAI, Anthropic — they receive your prompts and reference files in order to generate output.
• Google Cloud: the servers running our systems and database.
• Cloudflare (R2): storage and delivery of your files.
• Stripe: payment processing.
• Sentry: error logging.

Both

• Professional advisors (auditors, lawyers) when strictly necessary.
• Government authorities where required by law.

We do not sell your personal data.

07International transfers

Some of the providers we rely on are located outside Thailand, so your data is transferred and processed abroad. In line with Section 28 of the PDPA, we disclose that:

• The servers and database running AiROVA Studio are hosted on Google Cloud in the Southeast Asia region (Jakarta, Indonesia).
• Your files are stored on Cloudflare R2, which operates data centres in multiple countries.
• Your prompts and reference files are sent to Google, OpenAI, and Anthropic, which process them abroad — primarily in the United States.
• Payments are processed by Stripe outside Thailand.

We select providers that maintain internationally recognised data-protection standards, and we are bound by each provider's data-processing agreement.

If you do not wish your data to be transferred outside Thailand, you may choose not to use AiROVA Studio.

08How long we keep data

• Lead and prospect records: up to 24 months from last contact, then deleted or anonymised.
• Active client records: for the duration of the engagement plus 5 years (Thai accounting requirement).
• AiROVA Studio files and output: Free 7 days · Starter 60 days · Pro 120 days · Pro MAX 180 days, then 7 days in trash before permanent deletion (files saved to your Asset Library or Brand Kit are exempt from this schedule).
• AI call logs: 30 days.
• Account data: for as long as your account is active. When you delete your account we delete your personal data and files, except payment records we are required to keep under Thai accounting and tax law (5 years).
• Cookie data: see the Cookies table — either for the browsing session only, or 12 months.
• Server logs: 90 days unless required for security investigation.

09Cookies

AiROVA Studio sets only two kinds of cookie: Necessary ones, without which you cannot sign in or stay signed in, and Functional ones that remember a choice you made yourself, such as your language or how you prefer the interface laid out.

This application loads no analytics, advertising, or third-party tracking cookies, so there is nothing here to consent to or opt out of. Every cookie listed below is set by AiROVA itself and is readable only by this site. Browsing the public pages — including this one — sets no cookies at all; they appear only once you sign in or change a setting.

We also use your browser's local storage for your light/dark theme choice and for drafts you have not saved yet. That data stays on your device and is never sent to us.

10Your rights under PDPA

Under Sections 30–37 of PDPA, you have the rights listed below. The next section explains exactly how to exercise them.

Right of access

Request a copy of the personal data we hold about you.

Right to rectification

Ask us to correct inaccurate or incomplete data.

Right to erasure

Ask us to delete your data when it is no longer needed or you withdraw consent.

Right to withdraw consent

Withdraw any consent you previously gave, including cookie consent.

Right to object

Object to processing based on legitimate interest, including direct marketing.

Right to data portability

Receive your data in a machine-readable format and have it transferred where technically feasible.

Right to restrict processing

Ask us to pause processing while a dispute or correction is being resolved.

Right to lodge a complaint

File a complaint with the Personal Data Protection Committee (PDPC) at pdpc.or.th.

11How to exercise your rights / request deletion

To exercise any of the rights above — including asking us to delete your data — email us at [email protected].

What to include in your email:

• What you want: deletion, a copy of the data we hold on you, a correction, or withdrawal of consent.
• The name and email address you used to sign up or contact us, so we can locate your records.

What happens next:

• We may ask you to verify your identity first, so that nobody else can request deletion of your data.
• We respond and act within 30 days of receiving your request.
• There is no charge.

What we delete: your account, uploaded files, prompts and output in AiROVA Studio, contact details, and any lead records.

What we cannot delete: payment records and tax invoices, which Thai accounting and tax law require us to keep for 5 years. We retain only what the law requires and use it for nothing else.

A note on self-service in AiROVA Studio: you can cancel plan renewal yourself from the billing portal. Permanent account deletion and requests for a copy of your data currently have to be made by email using the address above.

If you are unhappy with how we handle your request, you have the right to complain to Thailand's Personal Data Protection Committee (PDPC) at pdpc.or.th.

12How we protect your data

We use encryption in transit (HTTPS/TLS), access controls, least-privilege admin accounts, and audit logs on our database.

In AiROVA Studio, your files are held in private storage and are reachable only through short-lived signed links. Passwords are stored as one-way hashes, and we never store your card number.

Production secrets are never committed to source control. We review security practices regularly.

13Children's data

Our services are aimed at business owners and professionals. We do not knowingly process personal data of anyone under 20 years of age. If you believe a minor has submitted data through our forms, please contact us so we can delete it.

14Changes to this policy

We may update this policy as our services or legal requirements change. The 'Last updated' date at the top reflects the latest revision. Material changes will be flagged on this page or via email if we have your contact.

15Contact

Reach out for any privacy question or to exercise your PDPA rights: