Privacy policy

From merchants: your LINE user ID, display name, profile image, and language preference (via Login with LINE); the business name, menu, services, prices, staff details, and operating hours you add; and the Omise API credentials and webhook configuration you provide to enable payments for your business.

From tourists who buy or book from you: their name, the booking or order details, and the email or phone number they give us for the confirmation. Card details go straight to Omise and never touch SanookPass servers.

We don't sell, rent, or trade personal data to third parties for their own marketing purposes. Ever.

We use LINE's official Login product (LINE Yahoo Corporation, Japan) to authenticate you. When you tap Log in with LINE, LINE shows a consent screen listing the scopes we request: profile (your LINE user ID, display name, avatar, and status message) and, for merchant accounts only, openid (your LINE email address, so we can send transaction receipts and account notices).

We use the returned profile data only to create and operate your SanookPass account. We do not post to your LINE timeline, read your LINE friends or groups, or send LINE messages on your behalf without your action. We never see your LINE password.

Access tokens we receive from LINE are short-lived and refreshed only while you keep us linked. You can revoke SanookPass's access to your LINE account at any time from LINE → Settings → Connected apps or from your SanookPass dashboard. Revocation ends the integration immediately and we delete the linked LINE user ID on next login.

LINE's handling of your profile data is governed by the LINE Terms of Use and LINE Privacy Policy. As a channel partner we comply with both.

With your consent, we use the LINE Messaging API to send your SanookPass account transactional notifications: payment received, new booking, refund issued, and account-level security notices. No marketing blasts, no re-engagement campaigns to tourists.

Tourists only receive a confirmation message if they explicitly opt in at checkout, and can opt out with a single tap in the message footer.

Online payments are processed using the merchant's own Omise account. Card numbers, CVVs, and expiry dates are submitted directly to Omise by the tourist's browser; we receive only tokenised payment references and the limited transaction details needed to operate the booking. Omise's privacy policy governs that data.

Payment proceeds are held in the merchant's Omise account and can be transferred to the bank account configured with Omise. SanookPass does not collect card details or bank credentials.

We use only first-party, strictly-necessary cookies: one to remember your language preference and one to remember your LINE-login session. We do not set advertising cookies, third-party tracking pixels, or analytics that profile individual visitors. Server logs (IP, user agent, timestamp) are retained for 30 days for abuse detection and then deleted.

We keep merchant account data for the life of the account plus 24 months after closure (for tax and anti-fraud purposes). Transaction records are kept for at least 5 years as required by Thai revenue law. Tourist booking data is kept for 24 months after the booking date, then anonymised for aggregate reporting.

SanookPass stores data in Singapore (AWS ap-southeast-1). LINE profile data is processed by LINE Yahoo Corporation in Japan and Korea. Omise processes payment data under its own infrastructure, privacy policy, and applicable legal safeguards. By using the service you acknowledge these cross-border transfers where they apply.

You can ask us at any time to see, correct, export, or delete the personal data we hold about you. We respond within 30 days, free of charge. We comply with Thailand's Personal Data Protection Act (PDPA) B.E. 2562 (2019) and, where applicable, the EU General Data Protection Regulation (GDPR) for European visitors.

If you believe we have not handled your data properly, you can lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand or your local supervisory authority.