Privacy Policy
Privacy Policy
Data controller and contact
Last updated:
BOBBY BRIDGE CO., LTD. (บริษัท บ็อบบี้ บริดจ์ จำกัด) is the data controller for this website and its enquiries. Company registration number: 0105569155014.
Contact address: 18/158, The Matt 1 Building, Soi Thoet Thai 33, Talat Phlu, Thon Buri, Bangkok 10600, Thailand. Privacy enquiries: privacy@bobbybridge.com.
Project Explorer and local drafts
Project Explorer works without an account. Its draft, answers, review status and pending AI proposal are saved in local storage in this browser on this device. They remain until you delete the draft or clear browser data and are not synced between devices. When you choose an AI action, we send your idea or current structured project, relevant answers and section instruction to OpenRouter and the model provider; no chat history is included. We do not save project contents to our database or application logs. Request counters are shared with the optional AI assistant's daily limit. PDF files are generated in your browser using fonts and branding served by this website. Choosing to prepare a contact summary temporarily stores it in this tab's session storage; it becomes an enquiry only when you submit the contact form. You can edit the project manually and download a PDF without AI or providing an email.
Optional AI brief assistant
If you choose to generate a brief, we send the idea you enter to OpenRouter and the model provider serving Gemini 2.5 Flash Lite to draft project details. We do not include the separate name, email or company fields, or a chat history. Anything you include in the idea itself is sent, so please omit personal, sensitive and confidential information. The app does not save AI inputs or drafts to its database or application logs; they remain in the page while it is open. We store request counters to limit abuse. Only the message you choose to submit through the contact form is saved as an enquiry under the retention policy below. OpenRouter, model and infrastructure providers process data under their own policies, which may include technical logs, retention and processing outside Thailand. You can use the contact form without AI. Review and edit generated details before sending.
Information we collect
We collect your name, email, company name (if provided), message, project interest, and related correspondence and follow-up notes. Name, email, and message are required to receive and respond to an enquiry through the form; company name is optional. Infrastructure requests may include IP addresses, browser information, request times, and security logs. Our application uses hashed IP-based identifiers and request counts to limit abuse. Please do not submit sensitive information, such as health information or identity documents. The contact form does not accept attachments.
Purposes and legal bases
We use enquiry information to respond, understand requirements, prepare proposals, and take steps you request before entering a contract. We rely on the pre-contractual or contractual basis where applicable, and legitimate interests for general correspondence, relevant follow-up, and security, taking your rights and reasonable expectations into account. We may also process information to meet legal obligations. An enquiry does not subscribe you to marketing emails. If another activity requires consent, we will explain it and request consent separately; submitting the form is not blanket consent to other uses.
Recipients and overseas processing
Access is limited to authorised people handling enquiries and service operations. Turso stores enquiries and notes; Resend sends email notifications; hosting and email providers operate the website and correspondence. Cloudflare R2 stores public portfolio media, not contact-form attachments. These providers may also process relevant technical request data. We may disclose information to authorities or professional advisers when necessary for legal obligations or claims. We do not sell enquiry information. Providers may process data outside Thailand. Where Thai transfer rules apply, the company must use a lawful transfer basis and appropriate safeguards, such as contractual protections where required. Contact us for details of providers and safeguards relevant to your information.
Retention: 12 months after last contact
We keep ordinary enquiry records, related correspondence, and internal notes for 12 months after the last contact about that enquiry, including email correspondence. At the end of that period, we arrange deletion or anonymisation of information no longer needed. The company manages this process; the website does not automatically delete enquiries. If an enquiry becomes a client engagement, records necessary for the contract, accounting, legal obligations, or claims may be retained separately for the applicable period. Exceptions are limited to information needed for that purpose. Security logs and restricted backups follow necessary operational retention cycles and are not used to extend ordinary enquiry follow-up. You may ask us for the retention period applicable to your information.
Cookies and security
Administrator sign-in uses a necessary session cookie with a maximum lifetime of seven days. Disabling it prevents administrator sign-in. Visitors do not need an administrator account to contact us. We use access controls and request limits to help protect information. The contact form does not use advertising cookies or subscribe you to a mailing list. If we introduce optional tracking requiring consent, we will provide information and a choice before using it. Links to other websites are subject to their privacy notices.
Your rights and requests
Subject to applicable legal conditions and exceptions, you may request access or a copy, correction, deletion or anonymisation, restriction of processing, portability, or object to processing. Where we rely on consent, you may withdraw it without affecting lawful processing before withdrawal. These rights do not apply identically to every activity. Email our privacy contact or write to our address, describing your request and the email used to contact us. We may request only additional information necessary to verify identity. We will respond within applicable legal time limits and explain any lawful refusal or restriction. You may complain to the competent authority through Thailand’s Personal Data Protection Committee Office (PDPC).
Scope and updates
This notice covers this corporate website and related enquiries. Individual products and client projects may have separate notices. We will update this page when relevant practices change and provide additional notice or obtain consent where legally required.
Privacy requests: privacy@bobbybridge.com. Supervisory authority: PDPC.