Privacy Policy

UBiLL ("the Service", "we") is a subscription billing platform for small shops in Thailand, operated at app.ubill.xyz. This policy explains what personal data we collect, why we collect it, and how we protect it.

1. Data we collect

Account data: username, password (hashed with bcrypt), full name, shop name, phone number, and email address.
Business data: invoices, products and services, your own customers' details, discounts, and payment records.
Linked social accounts: LINE User ID, Facebook User ID, Google User ID, and TikTok Open ID with the TikTok display name and avatar — only when you choose to link them.
Usage data: sign-in history, IP address, in-app activity, and system logs.
Profile picture: the image you upload yourself.

2. Why we use it

To provide the billing and customer management service you signed up for.
To authenticate you and keep your account secure.
To send notifications by SMS and LINE, only when you enable them.
To improve the Service.
To contact you about changes to the Service or these policies.

3. Signing in with a social account

UBiLL supports signing in with LINE, Facebook, Google, and TikTok. Linking is optional — you can always sign in with your username and password instead. When you link an account we receive:

LINE: LINE User ID.
Facebook: Facebook User ID, name, and email (if available).
Google: Google User ID, name, and email.
TikTok: Open ID, display name, and avatar, under the user.info.basic scope only.

We never receive your social account password.

How we use TikTok data

Open ID identifies which UBiLL account a TikTok sign-in belongs to. TikTok does not provide an email address, so this is the only value that lets us match a sign-in to an existing account.
Display name and avatar are shown on your "Connected accounts" page so you can see which TikTok account is linked.
We do not post, upload, read, or modify any content on TikTok, and we do not access your videos, followers, or analytics.
We do not use TikTok data for advertising, marketing, or profiling, and we never share it with third parties.
We call TikTok's user info endpoint only when you press Connect or sign in — never in the background — and we do not retain access tokens after the request completes.
You can disconnect at any time on the Connected accounts page. The Open ID, display name, and avatar are deleted from our database immediately.

4. Third-party services

DeeSMS

OTP and SMS notifications — sent: phone number and message body.

Administrator alerts — sent: anonymised system activity logs.

LINE API

OAuth2 and notifications — received: LINE User ID.

Facebook

OAuth2 login — received: User ID, name, email (if available).

Google

OAuth2 login — received: User ID, name, email.

TikTok

Cloudflare

Turnstile CAPTCHA — sent: a verification token, no personal data.

5. Data retention

Account and business data are kept for as long as your account is active.
Passwords are hashed with bcrypt and cannot be read by our staff.
Activity logs are kept for security and troubleshooting.
When you close your account, your personal data is removed within 30 days.
Linked social account data is deleted immediately when you disconnect it.

6. Security

All connections use HTTPS (TLS).
Passwords are hashed with bcrypt.
A single-use OAuth state value protects social sign-in against CSRF.
Client secrets are stored server-side only and are never sent to the browser.
Sign-in attempts are rate limited.
Data is stored on servers located in Thailand.

7. Disclosure

We do not sell, trade, or transfer your personal data to outside parties, except when:

you have given us your consent;
we are required to comply with the law or a court order; or
it is necessary to prevent fraud or a security breach.

8. Your rights

Under Thailand's Personal Data Protection Act B.E. 2562 (PDPA) you have the right to:

Access the personal data we hold about you.
Correct inaccurate data, on your profile page.
Delete your account and personal data — email us at the address below and we will complete the request within 30 days.
Disconnect any linked LINE, Facebook, Google, or TikTok account yourself at any time on the Connected accounts page.

9. Changes to this policy

We may update this policy from time to time. Significant changes will be announced on the website or through an in-app notification. Continuing to use the Service after a change means you accept the updated policy.

10. Contact us

For any question about this policy, or to exercise any of the rights above, contact:

UBiLL

Email: support@ubill.xyz

Website: app.ubill.xyz