Privacy Policy

1. Who is responsible for your data

TaskJai (“we”) operates the TaskJai website and mobile apps for Koh Samui, Thailand. We are the data controller for the personal data described in this policy under Thailand's Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

Contact for all privacy matters: privacy@taskjai.com.

2. What we collect

Account data: name, email, phone number (optional), password (stored as a salted hash), preferred language.

Identity verification data (taskers, and customers posting high-value tasks): a photo of your Thai national ID card or passport, and a selfie. These are reviewed manually by our operations team.

Task and usage data: tasks you post or offer on, prices, the general Samui area of a task and any location details you type, photos you upload (task photos and completion proof), reviews, and reports or blocks you make.

Chat messages between you and your matched counterpart for each task.

Payment metadata: amounts, payment status, and payout records. Card numbers are collected directly by our payment processor Stripe and never touch our servers.

Device data: a push-notification token if you enable notifications on the mobile app, and standard technical logs (IP address, timestamps) for security.

3. Why we use it (purposes and legal bases)

To provide the marketplace — matching, chat, payments, payouts, reviews (performance of our contract with you).

To verify identity and keep the marketplace safe — ID review, fraud prevention, handling reports, enforcing suspensions (legal obligation and legitimate interest in platform safety).

To notify you about your tasks — push notifications for offers, awards, chat messages, and completion submissions (performance of contract; you can disable notifications in your device settings).

To comply with Thai law, including tax and accounting duties (legal obligation).

We do not sell personal data, and we do not use it for third-party advertising.

4. Who we share it with

Stripe (payment processing) — receives payment card data directly and transaction metadata from us.

Cloud infrastructure providers — our database host and object-storage provider (currently Cloudflare R2) store platform data, including uploaded photos and ID documents, under contractual confidentiality.

Expo (push delivery) — receives device push tokens and notification content in order to deliver notifications via Apple and Google.

Your task counterpart — sees your name, profile, rating history, task details, chat messages, and (for the customer) completion proof photos. Your ID documents are never shown to other users.

Authorities — where Thai law requires disclosure.

5. International transfers

Some processors above store data outside Thailand (for example, Stripe and cloud infrastructure in other jurisdictions). Where personal data leaves Thailand we rely on the receiving provider's recognized safeguards and contractual protections, as permitted by the PDPA.

6. How long we keep it

Identity documents and selfies: kept only as long as needed for the verification decision and fraud-prevention window, and stored separately so they can be deleted independently of your account.

Account, task, chat, and payment records: kept while your account is active, then for the period required by Thai accounting/tax law (typically 5 years for transaction records) before deletion or anonymization.

When you delete your account it is deactivated immediately (soft delete) and personal data is removed at the end of the applicable retention periods.

7. Your rights

Under the PDPA you may request access to your data, a copy of it, correction, deletion, restriction of processing, or object to processing; where processing is based on consent you may withdraw consent at any time without affecting prior processing.

To exercise any right, email privacy@taskjai.com from your account email. We respond within 30 days.

You also have the right to complain to Thailand's Personal Data Protection Committee (PDPC).

8. Security

Passwords are hashed, transport is encrypted (HTTPS), photo storage uses expiring signed links, and ID documents are accessible only to authorized operations staff. No system is perfectly secure; we will notify affected users and the regulator of any breach as required by the PDPA.

9. Children

TaskJai is for adults (20+). We do not knowingly collect data from minors; accounts found to belong to minors are removed.

10. Changes and contact

We will announce material changes to this policy in the app before they take effect.

Questions or requests: privacy@taskjai.com.