Privacy: Client portal (portal.extraqube.app)
Last updated 21 October 2026
1.Who is responsible for your data
ExtraQube Systems, contact [email protected].
2.What we collect
- Data
- Account: name, email, avatar, role, company
- Purpose
- Sign in through ExtraQube SSO and show each company its own projects
- Legal basis
- Legitimate interest in serving the client's contract (PDPA section 24(5))
- Kept for
- Not yet decided
- Data
- Activity: service requests, comments, attachments, requester email
- Purpose
- Service requests from clients
- Legal basis
- Contract (PDPA section 24(3))
- Kept for
- Not yet decided (request files 90 days after closing; request records are not pruned yet)
- Data
- AI Assistant: questions, answers, tool results, pictures, name, email
- Purpose
- The AI Assistant: questions, a picture a person adds to a question (ExtraQube's own portal only, since 2026-10-21), answers and the tool results it reads to answer them are processed by Anthropic
- Legal basis
- Legitimate interest (PDPA section 24(5))
- Kept for
- 30 days (conversations and their pictures 30 days after the last activity; the person record (name, email) 13 months after the last question, or longer while that person is individually blocked from the Assistant, then deleted at the next cleanup after the block ends; a company-wide block holds no one's record)
- Data
- Logs: sign-in sessions, IP address, browser user agent, audit log
- Purpose
- Security and audit
- Legal basis
- Legitimate interest; Computer Crime Act section 26 (PDPA section 24(5))
- Kept for
- Not yet decided
3.Who receives it
- Cloudflare, Inc. (United States (processing at its global edge)): DNS, TLS termination, DDoS and WAF, tunnel to the cluster: sees every request to a public name, including the visitor IP and the page in transit
- Resend, Inc. (United States): Sends transactional mail: the contact form to our inbox, portal notifications, platform reports. Receives recipient addresses and the message
- Anthropic, PBC (United States): Claude API behind the portal Assistant and incident triage, and the coding agents that operate the platform: receives questions, tool results and log excerpts, which can hold personal data
4.Your rights and how to use them
Under Thailand's Personal Data Protection Act B.E. 2562 (sections 30 to 36) you may ask for access to and a copy of your data, ask us to send it to another organisation, object to its use, ask us to delete or destroy it, ask us to restrict its use, ask us to correct it, and withdraw consent where we rely on consent.
Send a request by email to [email protected]. You may also make a request in person or by post: email us first and we will arrange a time or give you the postal address. We will tell you within 15 days if a request is incomplete, and answer within 30 days of a complete request. Electronic copies are free.
If you believe we process your data unlawfully, you may complain to the Office of the Personal Data Protection Committee (www.pdpc.or.th).