This policy explains how Qubiz Technology Co., Ltd. ("we") collects, uses, and protects your personal data when you use Qubiz Cloud at qubiz.net, including your rights under Thailand's Personal Data Protection Act (PDPA).
Scope
This policy applies to:
- Visitors of qubiz.net and its subdomains
- Account holders of Qubiz Cloud (including workspace members)
- Anyone contacting us via support, email, or social channels
It does not apply to content customers deploy on Qubiz Cloud. For that content, the customer is the Data Controller and Qubiz is the Data Processor acting under the customer's instructions.
Data we collect
Data you provide
- Account: email, full name, username, password (stored hashed + salted), phone number
- Payment: handled by Stripe (we never store full card numbers), only
customer_id,payment_method_id, last 4 digits, brand, expiry - Workspace: workspace name, billing email, member roles
- User-defined content: project/service names, environment variables (encrypted at rest)
Data collected automatically
- Usage logs: timestamp, IP, user agent, action
- Cookies and sessions: see "Cookies" below
- Service telemetry: usage metrics, billing events
How we use your data
- Provide Qubiz Cloud per contract and secure the platform
- Issue receipts and process payments
- Detect abuse, fraud, brute force attempts
- Improve the product through aggregate (non-identifying) analytics
- Send essential notifications (billing, security, incidents), not marketing unless you opt in
Legal basis (PDPA)
- Performance of contract:for data needed to deliver the service
- Consent:for marketing communications and opt-in beta programs
- Legitimate interest:security logs, fraud detection, aggregate analytics
- Legal obligation:tax invoicing, lawful authority requests
International transfers
Our primary servers are located in Thailand, region ap-southeast-1 (Bangkok). Some processors (Stripe, Cloudflare, Sentry) may process data in other jurisdictions. We use standard contractual clauses to safeguard such transfers.
Retention
- Account data: lifetime + 90 days after account deletion (for reversibility / clean shutdown)
- Payment + invoices: 7 years per Thai tax law
- Security logs: 12 months
- Database backups: rolling 30 days
Your rights
Under PDPA, you have the right to:
- Access:request a copy of your personal data
- Rectification:correct inaccurate data
- Erasure:request deletion (subject to legal limits)
- Object:to processing based on legitimate interest
- Portability:receive data in a machine-readable format
- Withdraw consent:for processing based on consent
Send requests to privacy@qubiz.net. We respond within 30 days.
Security
- TLS 1.2+ on every endpoint, HSTS preload
- Passwords stored with Argon2id + per-user salt
- Secrets/env vars encrypted at rest with AES-256-GCM
- TOTP-based 2FA available on every account
- Audit log on role, billing, and secret changes
Children
The service is not directed to users under 18. If we discover we hold a minor's data without parental consent, we delete it immediately.
Changes to this policy
We may update this policy periodically. For material changes, we provide at least 30 days' email notice before they take effect. The latest update date is shown at the top of this page.
Contact
Questions about this policy or to exercise your rights:
Qubiz Technology Co., Ltd.
Email: privacy@qubiz.net