Legal

Privacy Policy

What personal data we collect, why we use it, who receives it, and how you use your rights under Thailand’s PDPA.

Last updated: 1 November 2026

This Privacy Policy explains how Grixhub collects, uses, shares and protects personal data when you visit grixhub.com, contact us, use our free tools, use GrixTrack (including grixtrack.grixhub.com), pay us, or work with us as a client or supplier. It is our privacy notice under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA“).

Who we are and how to contact us

In short

Grixhub, in Bangkok, is responsible for your personal data. Contact jade@grixhub.com for any privacy request.

Grixhub, the operator of grixhub.com and GrixTrack, based in Bangkok, Thailand, is the data controller for the personal data described in this policy (“Grixhub“, “we“, “us“).

For any question about privacy, or to use your rights, contact us at jade@grixhub.com. This is also our contact point for the Personal Data Protection Committee. We have not appointed a data protection officer, because the PDPA does not currently require us to; if that changes, we will add the officer’s contact details here.

When we act for our clients. When we handle personal data on a client’s behalf to deliver a service, for example enquiries from a website form we run for them, customer lists for ads, or a client contact’s name in a GrixTrack report, the client is the data controller and we are its data processor. The client’s privacy notice applies to that data, and our Terms of Service set out our duties to the client. If you want to use your rights over that data, please contact the client; if you contact us, we will pass your request on and help the client respond.

Personal data we collect

In short

We collect what you give us in forms, GrixTrack, quotes and payments, plus basic technical data. We do not collect card details.

Where it comes from	What we collect
Contact forms, free audit requests, email, phone and LINE	Your name, email, phone number, LINE name, company, website, your message, and any other details you choose to give us
Free tools, free reports and newsletter sign-ups	Your email, the tool or report you asked for, the website or brand you want checked, and your subscription choices
GrixTrack account	Your email, name if given, password (stored only as a secure hash, never in plain text), language, plan and settings
GrixTrack tracking settings and results	The domains, brand names, competitors, keywords, AI prompts and locations you choose to track, the results we collect for them, and the reports and share links you create
Clients and quotations	Names, job titles and contact details of your staff, quotations, contracts, approvals, meeting notes, and the access details you give us for your website, hosting, domain, analytics or ad accounts
Payments and billing	Billing name and contact, company name, tax ID, billing address, plan, invoices, receipts and payment records, including how and when you paid.
Records of acceptance	Your acceptance of our Terms of Service, Refund and Cancellation Policy and quotations, with the date, time and version, and records of cancellations, refunds and payment disputes
Suppliers and job applicants	Contact and business details, and any CV or portfolio you send us
Technical data	IP address, browser and device type, pages viewed, referring page, date and time, error logs, sign-in and security logs, and cookie or local storage identifiers (see Section 9)

We do not ask for sensitive personal data, such as health, religion, criminal records or biometric data. Please do not send it to us, and do not put personal data about private individuals into GrixTrack keywords or prompts. If you do, we use it only to run the checks you asked for.

Why we use it and our legal basis

In short

We use data to answer you, provide our services, take payments, keep records, stay secure and, with consent, send news.

Purpose	Legal basis under the PDPA
Reply to enquiries, prepare quotations, and handle free audit requests	Steps you ask for before a contract (Section 24(3)); our legitimate interests in answering business enquiries (Section 24(5))
Send a free report, tool result or notification you asked for	Steps you ask for (Section 24(3))
Provide our agency services and manage the client relationship	Performance of a contract (Section 24(3)); legitimate interests for the staff of business clients (Section 24(5))
Create and run your GrixTrack account, run the checks you set up and show reports and share links	Performance of a contract (Section 24(3))
Take payments, issue invoices and receipts, keep accounting and tax records	Performance of a contract (Section 24(3)); legal obligation (Section 24(6))
Keep records of acceptance of our terms and policies, and handle cancellations, refund requests, chargebacks and payment disputes	Performance of a contract (Section 24(3)); our legitimate interests in proving what was agreed and defending our legal rights (Section 24(5))
Keep the website and GrixTrack secure, prevent fraud and abuse of free plans, and fix problems	Legitimate interests (Section 24(5)); legal obligation where a law requires us to keep logs (Section 24(6))
Improve our services, for example by measuring usage, costs and accuracy, using aggregated data where possible	Legitimate interests (Section 24(5))
Send newsletters, offers and product news	Your consent (Section 19), which you can withdraw at any time; for existing customers, news about the service you use may rely on our legitimate interests, and you can object at any time
Comply with the law, respond to authorities, and establish, use or defend legal claims	Legal obligation (Section 24(6)); legitimate interests (Section 24(5))

If you do not give us data that we need to provide a service or meet a legal duty, such as your email for a GrixTrack account or billing details for a tax invoice, we may not be able to provide that service.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

How GrixTrack uses search engines and AI services

In short

GrixTrack sends your keywords and prompts to search and AI services to run checks, but not your name or email.

To show where a brand ranks on Google and whether AI tools mention it, GrixTrack sends the keywords, AI prompts and locations you set up to search and AI services, such as Google, ChatGPT (OpenAI), Gemini and Google AI Mode (Google), directly or through our data providers. We store the results. We do not send your name, email or billing details to these services with your checks.

Who we share data with

In short

We do not sell personal data. We share it only with providers such as Hostinger, banks and our data providers, and only as needed.

We do not sell personal data. We share it only with the following, and only as much as each needs:

Hosting and database: Hostinger, which hosts our website, GrixTrack and their databases, and provides our email sign-up forms and newsletters (Hostinger Reach).
Banks: banks that process your payments and any refunds. If we use a payment provider, we name it here before it receives your data.
Data providers for GrixTrack: third-party providers that collect public search results and AI answers for the keywords, prompts and locations you set up. They receive your tracking settings only, never your name, email or billing details.
Communication and productivity tools: Google, for email and documents we use to run our business and for the web fonts on our site; and LINE, if you chat with us on LINE.
Professional advisers and authorities: our accountants, auditors, lawyers and insurers, and government bodies, courts or regulators where the law requires it or to protect our legal rights.
Subcontractors: trusted freelancers or partners who help deliver a client project, under confidentiality duties, and only for that project.
A new owner of our business: if Grixhub’s business is transferred, including to a company set up to run Grixhub, personal data may be transferred to the new owner, who will continue to protect it under this policy.

When an agency creates a GrixTrack share link, anyone who has the link can see that report.

Sending data outside Thailand

In short

Some providers are outside Thailand. We transfer data abroad only in the ways the PDPA allows.

Some of these providers store or process data outside Thailand, for example in Singapore, the United States, Israel or the European Union. When we send personal data abroad, we do so only as Sections 28 and 29 of the PDPA and the PDPC’s rules allow, for example where the destination has adequate data protection standards, where the provider has given appropriate safeguards such as standard data protection contract terms, where the transfer is needed to perform a contract with you or to take steps you asked for before a contract, or with your consent. You can ask us for more information about these safeguards.

How long we keep data

In short

We keep data only as long as we need it or the law requires, then delete or anonymise it.

Data	How long we keep it
Enquiries and leads that do not become clients	Up to 2 years after our last contact
Client records, contracts, quotations and project communications	For the contract period and 10 years after it ends, the general limitation period for legal claims under the Civil and Commercial Code
Accounting and tax records, invoices and receipts	At least 5 years, and longer if the Revenue Department or accounting law requires it
Records of acceptance, cancellations, refunds and payment disputes	For the contract period and 10 years after it ends
GrixTrack account, settings and results	While your account is open; deleted or anonymised within 90 days after the account is closed
Free GrixTrack accounts not used for 12 months	Closed after an email warning, then deleted or anonymised within 90 days
Newsletter and marketing lists	Until you unsubscribe or withdraw consent; after that, we keep only your email on a do-not-contact list so we do not email you again
Server, security and sign-in logs	At least 90 days where the Computer-related Crime Act requires it, and normally no more than 12 months
Backups	Overwritten on a rolling cycle, normally within 30 days
Job applications	Up to 1 year, unless you agree that we keep them longer

When we no longer need personal data, we delete it, destroy it or make it anonymous. We may keep it longer only where the law requires it or where we need it to establish, use or defend legal claims.

How we protect data

In short

We use reasonable security, and we report serious breaches to the PDPC within 72 hours.

We use reasonable technical and organisational security measures, including encrypted connections (HTTPS), hashed passwords, access limited to people who need it, separation of customer accounts, and providers with their own security controls. No system is completely secure, but we work to prevent loss, misuse and unauthorised access, change or disclosure.

If a personal data breach happens, we will notify the Personal Data Protection Committee within 72 hours after becoming aware of it, unless the breach is unlikely to put anyone’s rights and freedoms at risk. If the risk is high, we will also tell the people affected and explain what we are doing about it, without undue delay.

Cookies and similar technologies

In short

We use only necessary cookies today. Our Cookie Policy has the details.

We currently use only the cookies and browser storage that grixhub.com and GrixTrack need to work, such as a language cookie and GrixTrack sign-in cookies. We do not use analytics, advertising or tracking cookies. If we add them, we will ask for your consent first. Our Cookie Policy lists the cookies we use and how to control them.

Your rights

In short

You can access, correct, delete, restrict, move or object to the use of your data, and withdraw consent. We reply within 30 days.

Under the PDPA, you have the right to:

withdraw consent at any time, without affecting what we did before you withdrew it;
access your personal data and get a copy, and ask how we obtained data you did not give us;
receive your data in a commonly used electronic format, or ask us to send it to another controller, where the PDPA allows (data portability);
object to processing based on our legitimate interests, and to direct marketing at any time;
ask us to delete, destroy or anonymise your data;
ask us to restrict the use of your data;
ask us to correct data that is wrong, out of date or incomplete; and
complain to the Office of the Personal Data Protection Committee (pdpc.or.th).

To use your rights, email jade@grixhub.com, or make your request in writing by post or in person; email us and we will send you the postal details or arrange a time. We check your request and confirm your identity within 15 days, and we reply within 30 days of receiving it. If we need more time, we may extend this once by up to 30 days and will tell you why. We keep a record of each request and our reply for at least 2 years. Some rights have legal limits, for example where we must keep data by law or need it for a legal claim; if we cannot fully meet your request, we will explain why. You can unsubscribe from marketing emails using the link in each email.

Children

In short

Our services are for adults and businesses, not for minors.

Our services are for businesses and adults. You must be at least 20 years old, or otherwise have full legal capacity under Thai law, to create a GrixTrack account or buy our services. We do not knowingly collect personal data from minors. If you believe a minor has given us personal data, please contact us and we will delete it.

Links to other services

In short

Other services we link to have their own privacy policies.

Our website and GrixTrack link to other services, such as LINE and Google. Those services have their own privacy policies, and we are not responsible for how they handle your data.

Changes to this policy

In short

We will post updates here and tell you about significant changes.

We may update this policy, for example when we add a new service, provider or cookie. The latest version is always on this page with its “Last updated” date. If a change is significant, we will tell GrixTrack users and clients by email or in the app before it takes effect. Where a change needs your consent, we will ask for it.