Privacy: Qube Book
Last updated 19 October 2026
1.Who is responsible for your data
ExtraQube Systems, contact [email protected]. The full notice of this service is at https://book.extraqube.app/privacy.
2.What we collect
- Data
- Account: username, display name, password (hashed), org, role
- Purpose
- Administrator accounts
- Legal basis
- Contract (PDPA section 24(3))
- Kept for
- Not yet decided
- Data
- Activity: reading statistics
- Purpose
- Reader statistics per published book (opens, pages read, time on page) tied to a random per-tab ID, shown to the organisation's admins as per-book totals
- Legal basis
- Legitimate interest (PDPA section 24(5))
- Kept for
- 730 days (24 months as the notice commits; no prune job enforces it yet)
- Data
- Logs: audit log, IP address, browser user agent
- Purpose
- Audit admin actions
- Legal basis
- Legitimate interest (PDPA section 24(5))
- Kept for
- 730 days (24 months as the notice commits; no prune job enforces it yet)
3.Who receives it
- Cloudflare, Inc. (United States (processing at its global edge)): DNS, TLS termination, DDoS and WAF, tunnel to the cluster: sees every request to a public name, including the visitor IP and the page in transit
- Google LLC (YouTube and Google Drive players) (United States): Video players a client embeds in a published Qube Book: the reader's browser loads the youtube-nocookie or Google Drive frame directly, so Google sees the reader's IP and browser on that page
4.Your rights and how to use them
Under Thailand's Personal Data Protection Act B.E. 2562 (sections 30 to 36) you may ask for access to and a copy of your data, ask us to send it to another organisation, object to its use, ask us to delete or destroy it, ask us to restrict its use, ask us to correct it, and withdraw consent where we rely on consent.
Send a request by email to [email protected]. You may also make a request in person or by post: email us first and we will arrange a time or give you the postal address. We will tell you within 15 days if a request is incomplete, and answer within 30 days of a complete request. Electronic copies are free.
If you believe we process your data unlawfully, you may complain to the Office of the Personal Data Protection Committee (www.pdpc.or.th).