Privacy Policy

Wlipper is a hotel-management platform operated by SAKO MANUFACTURING CO., LTD. ("Wlipper", "we", "us"), registered in Thailand (registered address available on request at privacy@wlipper.com). It includes this website, a customer/CRM application, a hotel-management system (HMS), a guest booking application, and a central sign-in service. This policy explains what we collect and why, under the Thailand Personal Data Protection Act (PDPA).

If operation of Wlipper is later transferred to a successor entity (e.g. Wlipper Co., Ltd.), we will give notice and your data will remain protected under this policy.

1. Our two roles — please read this first

Depending on which part of Wlipper is involved, we act in one of two roles under the PDPA:

• As a data controller — for this website, and for the account, billing, and support data of the hotels and people who subscribe to Wlipper. This policy governs that data.
• As a data processor — for the guest data a hotel enters into the product (guest names, contact details, stays, and passport / national-ID documents used for Thai TM30 immigration reporting). For that data the hotel is the controller and we process it only on the hotel's instructions, under our Data Processing Addendum (provided to customers at signup). If you are a hotel guest with a question about your data, contact the hotel you stayed with; we support them in responding.

2. Website visitors

We keep this website deliberately light on data collection:

• No analytics or tracking cookies. We do not run analytics or advertising tracking. Only strictly necessary cookies are used (sign-in, security, your language choice). If we ever introduce analytics, we will update this policy first.
• Support messages. The support form collects your name, email, and message so we can respond — nothing else, and only for that purpose.
• Standard server logs (IP address, request time) kept by our hosting provider for security.

3. Customer account data

When a hotel signs up, we process the data needed to run the subscription: organization details (name, owner contact, plan, domains), staff identity and roles, billing records, property configuration (hotels, rooms, rates, inventory), and support tickets.

Sign-in is handled by WorkOS — we do not store your password. Billing is handled by Stripe — we never collect or store full card details.

4. Guest data inside the product

Hotel staff store guest data in the product on behalf of the hotel: contact and stay details, loyalty records, and — for Thai TM30 immigration reporting — identity documents including passport/national-ID numbers and uploaded document scans. This is sensitive identity data and is protected with strict access controls and hotel-by-hotel isolation. The product includes per-guest export and erasure tools so hotels can honor their guests' PDPA rights.

5. AI features

AI features are optional and off by default. When enabled, the text you submit is sent to the AI provider you chose (or stays in your browser in local mode). Saved provider API keys are encrypted before storage and never returned to the browser. AI output is decision-support only — a human always reviews and decides; we do not make solely automated decisions with legal or similarly significant effects about you.

6. Lawful bases (PDPA)

• Contract — providing the service to a customer; billing.
• Legitimate interest — security, fraud prevention, service improvement, responding to enquiries.
• Legal obligation — tax, accounting, and immigration (TM30) record-keeping.
• Consent — anything we ask you to opt into; withdrawable at any time.

7. Who we share data with

We use trusted providers to run Wlipper. We do not sell personal data and do not use it for advertising profiling.

8. International transfers

Some providers process data outside Thailand. Where personal data is transferred abroad, we comply with the PDPA's cross-border transfer requirements and rely on contractual protections with each provider. Details are available on request at privacy@wlipper.com.

9. Retention

Account data is kept for the life of the subscription plus a reasonable period for legal/accounting purposes. Guest data, including TM30 documents, is kept per the hotel's instructions and any legal minimum. Wlipper supports per-guest erasure (anonymizing booking history while keeping the financial record, and retaining immigration documents only as long as the law requires) and full account deletion on offboarding.

10. Your rights (PDPA)

You have the right to access and obtain a copy of your personal data; correct it; delete or anonymize it where the law allows; restrict or object to certain processing; port data you provided; withdraw consent; and complain to the Personal Data Protection Committee (PDPC).

To exercise rights over data we control, contact privacy@wlipper.com. We respond within 30 days and do not charge for an individual's first copy of their own data. For guest data inside a hotel's account, contact that hotel — we will assist them in responding.

11. Security

Access is gated by authentication and server-side isolation — one hotel's staff can never read another hotel's data. Secrets are stored encrypted, never in plaintext. Data is encrypted in transit, and every data export and erasure is recorded in an accountability log. If a breach affects your data we will notify you and the PDPC as the PDPA requires.

12. Changes & contact

We may update this policy and will post the new effective date; material changes will be notified to customers before they take effect.

SAKO MANUFACTURING CO., LTD. (operating Wlipper) — Thailand
privacy@wlipper.com (privacy) · support@wlipper.com (support)