Aflovia Privacy Policy

1. Welcome

We designed the Aflovia Platform with privacy in mind. Sodality Co., Ltd. and our related entities (“we,” “us,” “our,” or “Aflovia”) respect privacy rights. This Policy describes how we and the Platform collect, use, disclose, retain, and protect information. Capitalized terms used but not defined in this Policy are defined in our Terms of Service (“Terms”).

Aflovia helps Brands design campaigns and message templates for creator outreach, message Affiliates on Stores through Aflovia, and track outreach and campaign results on Stores through Aflovia APIs and analytics online. Among other Stores, Aflovia supports the TikTok Shop.

Please read this Policy before you use the Platform. By logging into and using the Platform, you acknowledge this Policy applies to you and accept our Terms of Service. If you do not agree to this Policy and the Terms, you must not access or use the Platform.

2. The Basics

At the outset, you should know that:

• We collect and process limited personal information, such as information in your user account, profile details, and communications.
• We collect and process business information you or your organization provide or authorize us to access, such as Store account information, creator outreach lists, campaign results, and billing details.
• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising through third-party ad networks.
• If you connect TikTok Shop, we process information from that connection only as authorized by you, to provide the Platform features you choose to use, and as described in this Policy.

3. Updates to This Policy

As the Platform changes, we may update this Policy. If we materially change how we use personal information, we will provide notice before the changes take effect by email to the address on your account or through a prominent notice on the Platform.

You are responsible for reviewing the Last Update date periodically and staying informed about our privacy practices. Continuing to use the Platform after an updated Policy becomes effective constitutes your acknowledgment of the updated Policy.

4. Contact Us & Data Protection Officer (DPO)

You may contact us regarding the Platform or this Policy through support@aflovia.com and any other channels designated in your applicable Order Form.

For statutory PDPA inquiries or data subject rights requests, you may also directly reach our Data Protection Officer at:

5. Info We Collect and How We Use It

This table describes the information we collect, how we collect it, why we use it, the legal bases and purposes for our use, and general retention periods. We may also deidentify and aggregate information, which we may use to improve the Platform, develop services, operate analytics, and support business reporting.

6. Google OAuth Data for Email Campaigns

Collection: Directly from users through an OAuth consent form.

We use your Google OAuth data solely for sending and managing outgoing emails on your behalf as configured in your outreach campaigns. We collect the app token and refresh token to send, manage, and track your outgoing outreach emails, handle replies, and maintain campaign logs. We do not use Google OAuth data to train generalized AI or ML models.

7. Information Storage and Security

We use commercially reasonable technical and organizational security technologies and procedures to help protect personal information from unauthorized access, loss, misuse, alteration, or destruction. We receive, store, and process information in Thailand and secure international cloud regions. Where we use service providers located in other jurisdictions, we take reasonable steps to ensure appropriate contractual safeguards are in place to protect the data.

No method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

8. Our Disclosures of Information

This section describes the ways Aflovia discloses information:

• No Sale or Behavioral Sharing: We do not sell, trade, rent, or share personal information for cross-context behavioral advertising.
• With Your Consent: We may disclose personal information with your consent or at your request.
• Service Providers & Subprocessors: We rely on trusted third-party service providers to operate the Platform (including AWS for cloud infrastructure, ClickHouse for high-throughput analytics, Stripe for payments, and Google LLC for AI assistant features). These providers are contractually bound to process data solely on our instructions. See our Subprocessors list at /subprocessors.
• Store Integrations: If you enable the TikTok Shop integration, information may be exchanged through Store APIs to sync product listings, creator rosters, and campaign performance.
• Organization Accounts: If you use the Platform on behalf of an organization, information in your account may be visible to account administrators within your organization.
• Legal & Compliance: We may disclose information where required by statutory tax authorities, lawful court orders, or law enforcement requests.
• Business Transfers: In connection with a corporate reorganization, merger, financing, or sale of assets, customer information may be transferred as an acquired business asset.

9. How Long We Keep Your Information

We maintain information for the time necessary to fulfill the purpose for which it was collected, as generally described in this Policy, or as required or permitted by law.

Our retention determinations consider the amount, nature, and sensitivity of the information, the risk of unauthorized use or disclosure, our operational needs, and our statutory legal, tax, and accounting obligations.

10. Children's Privacy (No Children)

Only adults (18 years of age or older) are eligible to use the Platform, as described in our Terms. We do not knowingly collect personal information about anyone under 18. If we learn that personal information of a person under 18 has been collected on the Platform without parental or guardian consent, we will promptly delete it.

11. How to Control Your Privacy & Request Data Deletion

You have certain choices regarding how we treat personal information:

• You may review and request changes to account information by using Platform settings or contacting support.
• You may opt out of promotional marketing communications by using unsubscribe instructions included in emails.
• You may request complete account and data deletion at any time by following our User Data Deletion Instructions at /data-deletion. Verified deletion requests are executed within 72 hours.

12. International Data Transfers

We receive and process information across cloud regions in Thailand, Singapore, and global data centers. By providing information to us, you acknowledge that we may process and store your information in these jurisdictions.

Where cross-border transfers occur, we implement standard contractual clauses and rigorous organizational safeguards in compliance with Section 28 and Section 29 of the Thailand PDPA and applicable international data transfer standards.

13. Statutory Privacy Rights (Thailand PDPA Sections 30–36)

Under the Thailand Personal Data Protection Act B.E. 2562 (PDPA), data subjects have explicit statutory rights regarding their personal data processed by Aflovia:

• Right to Access (Section 30): You have the right to request access to and obtain a copy of your personal data under our responsibility, and to request disclosure of the acquisition of such data obtained without your consent.
• Right to Data Portability (Section 31): You have the right to receive personal data concerning you in a format readable or commonly used by automated tools, and to have that data transmitted directly to another data controller where technically feasible.
• Right to Object (Section 32): You have the right to object to the collection, use, or disclosure of your personal data at any time under statutory circumstances, including processing for direct marketing or scientific research.
• Right to Erasure / Right to Be Forgotten (Section 33): You have the right to request deletion, destruction, or anonymization of your personal data when it is no longer necessary for the purposes collected, or when consent is withdrawn.
• Right to Restrict Processing (Section 34): You have the right to request restriction of the processing of your personal data during pending verification of accuracy, pending objection reviews, or in lieu of erasure.
• Right to Rectification (Section 35): You have the right to require that your personal data remains accurate, up-to-date, complete, and not misleading.
• Right to Withdraw Consent (Section 19): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
• Right to Lodge a Complaint (Section 73): You have the right to lodge a formal complaint with the Personal Data Protection Committee (PDPC) in Thailand if you believe Aflovia has violated or failed to comply with the PDPA.

14. Additional Information for EU, UK, Canada & US Residents

EU, UK & Swiss Residents: Under the GDPR and UK GDPR, you hold rights of access, rectification, erasure, restriction, data portability, and objection. You may lodge a complaint with your supervisory authority.

Canadian Users: Canadian users hold rights under PIPEDA and provincial privacy acts to access, correct, and withdraw consent by contacting us.

Certain U.S. States (California, Virginia, Colorado, Connecticut, Utah): Residents of these states hold rights to know, access, correct, delete, receive portable copies, and opt out of profiling. We do not sell or share personal information under the California Consumer Privacy Act (CCPA/CPRA).