Privacy policy

Our approach to data protection

Protecting user data is a guiding principle for CoolOn. We are progressively configuring the system to reduce the amount of data transmitted, how long it is retained, and the people and services that can access it. We favour local processing and modes that do not retain content at the AI provider where compatible with the selected feature. This describes our direction of development, not completion of every safeguard or independent certification.

We do not sell the content of your recordings or use it for advertising or training our own models. We process it to provide the features you request. In app versions with the consent setting, cloud AI processing of content starts only after your explicit consent; access by connected agents and integrations is managed separately. Account, payment and security data processing and compliance with legal requirements are described below and may rely on other legal bases.

Zero Data Retention (ZDR) is a mode in which an AI provider processes a request without retaining its content or the response content after processing, subject to the terms of that mode. ZDR does not mean there are no technical metadata, that your CoolOn archive is deleted, or an automatic prohibition on training: retention and training-use conditions are checked separately. Below we explain where we require ZDR; it does not automatically cover every speech recognition service and integration.

Already in place: consent to cloud AI processing and its withdrawal (section 4); a requirement for no-data-collection and zero data retention routes for language model requests made through the CoolOn server (section 6); clearing of the server copy of audio after batch recognition results are delivered (section 7); account deletion with immediate loss of access and 30 days to cancel (section 7). The rest of this section describes our direction of development.

1. Who is responsible for your data

This policy describes personal data processing on the CoolOn website, in the app and in its cloud services. The operator and contact for requests are:

Business in Pattaya Co., Ltd.
บริษัท บิสิเนส อิน พัทยา จำกัด

Company registration number: 0205565045345.

399/37, Room 1, Moo 12, Nong Prue, Bang Lamung, Chon Buri, Thailand.

[email protected]

2. Data we process

Account: email, name or profile name, sign-in and session information, access, quota and service usage records. Support requests: your email, message and attachments you send to support.

Recordings: audio, transcripts, notes, summaries, tasks and selected context, including information about people in your materials. The data transmitted depends on the features and integrations you enable.

Technical data: network requests, IP addresses, security events and errors may be processed by the server and infrastructure providers to operate and protect the service. Your website language preference is stored in your browser.

Location details help create events: for example, the place name from a calendar event or a location the app determined with your permission. They may be included in the context sent for AI processing. We do not use them for advertising and do not keep a separate history of your movements on the server. You can turn off the app’s location access in your phone settings.

To investigate processing failures, the server stores diagnostic records linked to your account, including the build version, job identifier, stage, error code and retry information. These are used for technical support and processing recovery.

The app also sends the server an error journal linked to your account: time, build version, component and operation, error code and HTTP status from a fixed list. The journal contains no audio, conversation text, file names, request addresses or system error messages. Support uses it to find a failure you report. It does not depend on consent to cloud AI processing because it is not shared with AI providers.

3. Pilot applications

The form stores your email and selected answers; your name, Telegram and additional details are optional. Applications are stored in Cloudflare D1. Answers and contact details are sent to the responsible team member through Telegram to contact you. Do not include recordings or client data in an application.

For spam prevention, the application database uses an hourly-changing IP hash instead of the original IP. This does not exclude IP processing by Cloudflare infrastructure. If you start the bot after applying, your chat ID is linked to your application; this step is optional.

4. Recordings and cloud AI

Your archive of recordings and results is stored in the app. Having an account does not itself mean that the whole archive is backed up. When you use cloud features, audio is sent to speech recognition providers; text, notes and selected context are sent to language models through the CoolOn server for analysis and responses.

In app versions with consent controls, you can continue without cloud processing and withdraw consent in account settings. Withdrawal stops new cloud requests but does not undo processing already completed. External agent and integration access is managed separately.

Inform participants about recording and ensure you have the necessary legal basis to record and share their data. Do not upload materials you are not entitled to share. AI results can be wrong; verify important conclusions against the source.

5. Purposes and legal bases

We use data to provide requested features, manage accounts, answer enquiries, process payments, prevent abuse and meet applicable obligations. Depending on the purpose, the basis is performance of a contract or steps you request before entering one, consent, a legitimate interest in service security, or a legal obligation.

Email is needed for account features and application follow-up. Audio is needed for cloud transcription and text for cloud analysis. If you do not provide this data, those features are unavailable. You may leave optional fields blank.

6. Recipients and international transfers

Recipients may include authorised staff, hosting and email providers, Cloudflare, speech recognition, speech synthesis and language model providers (including Soniox, ElevenLabs, OpenRouter and other model providers), Telegram for application notifications, and integrations you connect. For payments through Stripe, Stripe processes payment details; we may receive payment identifiers, status, amount and buyer contact details.

Providers may process data outside Thailand. For language model requests made through the CoolOn server, we require routes that disallow data collection and use zero data retention. This does not mean that CoolOn itself or other services do not retain data. The provider depends on the feature and configuration. Contact support for information about recipients, processing countries and applicable safeguards.

7. Retention and deletion

For batch cloud transcription, the file and job at the recognition provider are cleaned up after the result is saved on the server, independently of the app acknowledging receipt. The server audio copy is cleared after the app acknowledges receipt of the result. Storage of the corresponding data may continue if delivery or cleanup is incomplete. Result text and technical records may remain for delivery, recovery and usage accounting.

After the server confirms an account deletion request, account access ends. There is a 30-day period to cancel the request through support; final cleanup is performed separately afterwards and may take additional time. This does not mean that every copy is deleted exactly on day 30. Website applications and support correspondence are handled separately from your account.

Local data is retained according to app rules and settings; audio may be cleared automatically. Account deletion and deletion of local files are separate actions. Server retention depends on the data category: processing a job, operating an account, resolving an enquiry, security and required recordkeeping. Anonymised records or legally required records may remain after account closure.

The cabinet shows error journal events received by the server within the last 30 days. No more than the latest 500 events are retained per account. Older events are deleted during scheduled cleanup, which may take additional time. The journal is deleted together with the account at final purge.

Request account deletion in app settings where available in your version, or through support. For pilot applications, support enquiries and details of retention periods, email [email protected]. We may ask you to verify account ownership. Do not send your password or sign-in code.

8. Your rights

Subject to applicable law, including Thailand’s PDPA, you may request access and a copy, correction, erasure, restriction or portability, object to processing and withdraw consent. Legal exceptions may apply. Withdrawal does not affect the lawfulness of earlier processing. Contact [email protected] to exercise your rights; you may also complain to the relevant data protection authority, including Thailand’s PDPC.

9. Changes and questions

The version date appears at the top of this page. When processing changes, we update this policy and, where required, notify you or request new consent. If you believe data was shared without the necessary rights, contact support.