Privacy Policy
This English version is a translation provided for convenience. The Thai version is the official version; in the event of any discrepancy or inconsistency between the two, the Thai version shall prevail.
1. Who we are
HomeHQ (“we”, “us” or “our”) provides a 3D virtual office platform for organizations that work from home, including attendance, leave, chat and HR features, through our Windows app, our website and our web app.
Contact for personal data matters: email homehq817@gmail.com · phone 098-309-0252
2. Our role
- Account data of applicants and customers (people who sign up, organization administrators and payers) — we act as the data controller.
- Employee data that customer organizations import and use in the service (such as attendance, leave, chat and organizational structure) — the customer organization (the employer) is the data controller, and we act as a data processor that processes the data on the customer organization’s instructions.
3. Data we collect
- User accounts — name, email and password (stored using one-way scrypt hashing, so no one can read your password). If you choose to sign in with Google or Microsoft, we receive your name, email address and account identifier from that provider.
- Organization and work data — company name, branches, province, departments, positions, clock-in and clock-out times and work mode (WFH / office / on-site), leave requests and reasons, chat messages, announcements, kudos, profile pictures, 3D avatars, and online status and online periods.
- Attendance verification data — IP address, channel (app / mobile / web), a random device identifier, and GPS coordinates (only when clocking in from a mobile phone while choosing to work at a branch or on-site and allowing location access — no location is collected when working from home), so that the employer organization can verify that attendance records are accurate.
- Voice and video — transmitted directly between users while they talk in the 3D office. We do not record audio or video.
- Payments — amount, date and time, transfer slip image, transaction reference number, payer name and bank. (We do not store card numbers or banking passwords.)
- Contact — the phone number and company size entered at sign-up, and questions typed to the AI assistant.
- Technical data — IP address, device/browser type and sign-in history, for account security.
4. Purposes and legal bases
- To provide the service under our contract, such as creating accounts and organizations, the 3D office, attendance, leave and chat — contractual basis
- To maintain security and prevent password guessing and abnormal use — legitimate interests basis
- To bill, verify payments and prepare accounting documents — contractual basis and legal obligation
- To send service notices, such as upcoming expiry and new versions — contractual basis
- To improve the service using aggregated usage statistics — legitimate interests basis
We do not sell personal data, and we do not use customer organizations’ employee data for advertising.
5. Disclosure to third-party service providers
- Server and database providers that we use to deliver the service
- Slip verification providers (such as Thunder Solution) — slip images and transfer details, to confirm with the bank that the transfer actually took place
- Google / Microsoft — when you choose to sign in with an account from that provider
- AI providers (Google Gemini or Anthropic Claude) — only the text you type to the AI assistant, in order to generate a response (the system does not send other employees’ data along with it)
- Government authorities, where required by law or by a lawful order
Some providers may process data outside Thailand. We only use providers that have adequate data protection measures as required by the PDPA.
6. Retention period
- Chat messages: according to your plan — Free 30 days · Pro 6 months · Business 1 year · Enterprise 2 years, after which they are deleted automatically
- Sign-in history 180 days · online periods 400 days · data change records (audit log) 2 years
- Questions to the AI assistant: 90 days
- Attendance and leave data: kept for as long as the customer organization uses the service (employers are required to keep these records under labor law)
- Attendance verification data (IP address, GPS coordinates, device identifier): deleted automatically after 180 days
- Payment data: 5 years, as required by accounting and tax law
- When an organization owner deletes the organization, that organization’s data is deleted immediately (except payment data that the law requires us to keep) · The public demo is wiped every 6 hours
7. Security
Data is transmitted over encrypted connections (HTTPS); passwords are stored with one-way hashing; two-step verification is supported; accounts are locked after repeated incorrect password attempts; access is restricted by role (only HR can see working-time data for the whole team); and changes to important data are logged.
8. Rights of data subjects
You have the right to access and obtain a copy of your data, to request that it be sent or transferred, to have it corrected, to have it erased or its use restricted, to object to processing and to withdraw consent, as well as to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC).
To exercise your rights, use the contact details in section 1. We will respond within 30 days. For data controlled by your employer organization (such as attendance data), please contact your organization’s HR department first, and we will assist in carrying out the organization’s request.
9. Cookies and local storage
The app and website use local storage on your device to remember your sign-in and settings, such as theme and audio devices. We do not use advertising cookies and have no third-party trackers.
10. Minors
This service is intended for organizations and their employees and is not directed at minors signing up on their own.
11. Changes to this policy
If we make material changes, we will notify you through the website and the app before they take effect.