Skip to main content
Back to home

Privacy policy

Effective from 19 October 2026

This policy explains how Kuukru collects, uses, discloses and protects personal data under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), and the rights you have over your data.

1.Data controller and contact

  1. 1.1Kuukru is operated by Kuukru TH, an individual, who is the data controller for users' account data.
  2. 1.2For student and guardian data that teachers record in the service, the school or the teacher is the data controller, and Kuukru processes that data on the user's instructions only, to provide the service.
  3. 1.3For anything about personal data, email adminkuukru@gmail.com.
  4. 1.4The operator has not appointed a data protection officer (DPO), as the legal conditions for one are not met. You can contact the operator directly at the email above.

2.Data we collect

  1. 2.1Teacher account data: name, email, password (stored as a one-way hash that nobody can read back), school and settings.
  2. 2.2Data teachers enter for their work: profile and career details, photos, signatures, seals, official documents, lesson plans and uploaded files.
  3. 2.3Student data recorded by teachers: names, nicknames, birth dates, addresses, photos, attendance, scores, assessments, weight and height, home visits and savings.
  4. 2.4Guardian data: name, relation to the student, phone number, and a LINE ID only for guardians who agree to connect LINE.
  5. 2.5Payment data: the plan bought, the amount and the payment status. Card and PromptPay details are entered on Stripe's own page; Kuukru never receives or stores card details.
  6. 2.6Usage and security data: sign-in records, system logs and AI usage counts for credits.

3.Purposes and legal bases

  1. 3.1To provide the service under the terms of service, such as accounts, documents, attendance, gradebooks and reports (contract).
  2. 3.2To keep accounts and systems secure, prevent misuse and improve the service (legitimate interests).
  3. 3.3To meet legal duties, such as keeping computer traffic data and payment records under tax and accounting law (legal obligation).
  4. 3.4To show student photos on the guardian page and message guardians on LINE, only with consent (consent), which can be withdrawn at any time.
  5. 3.5To send emails the account needs, such as email verification, password resets and plan-expiry reminders. We don't send marketing emails without consent.

4.AI and student data

  1. 4.1When a teacher uses AI to draft work, the system sends only students' nicknames and the facts the task needs; never full names, national ID numbers, phone numbers, addresses, birth dates, GPS locations or student photos.
  2. 4.2AI output is always saved as a draft that the teacher reviews and approves before use.

5.Sharing with service providers

  1. 5.1We do not sell, rent or disclose personal data for anyone else's marketing.
  2. 5.2We use outside providers only as needed to run the service: OVHcloud (servers and database), Cloudflare (file storage and DNS), Anthropic (AI processing, receiving only student nicknames), Resend (email delivery), Stripe (payments), LINE (messages to guardians who agreed) and Google (only for users who choose to sign in with Google).
  3. 5.3These providers receive only what their task needs and must protect the data under their service agreements.
  4. 5.4We may disclose data where the law requires it, or under a lawful order of a government authority or court.

6.Transfers outside Thailand

  1. 6.1Kuukru's main servers are in Singapore, and some providers process data in other countries such as the United States and Japan.
  2. 6.2We choose providers with internationally recognised data protection measures and send only what the service needs, as sections 28 and 29 of the PDPA require.

7.How long we keep data

  1. 7.1Teacher account data and work are kept while the account exists. When an account is cancelled, we delete it or make it unidentifiable within 30 days.
  2. 7.2Student data of archived classrooms is deleted or anonymised automatically after 12 months, or the period the school sets (1–120 months), and homeroom teachers can delete a student's data at any time.
  3. 7.3Computer traffic data is kept for at least 90 days under the Computer-related Crime Act B.E. 2550, and payment records for as long as tax and accounting law requires.
  4. 7.4Database backups are deleted on the backup schedule.

8.Security

  1. 8.1Data travels over encrypted connections (HTTPS), and passwords are stored as one-way hashes.
  2. 8.2Student photos and files are stored privately and open only through short-lived links, and teachers see only the classrooms they have access to.
  3. 8.3Important actions are logged for accountability, without student personal data in the logs.
  4. 8.4If a personal data breach happens, we will notify those affected and the PDPC as the law requires.

9.Your rights

  1. 9.1You may ask to access and receive a copy of your data, correct it, delete or destroy it, restrict its use, object to processing, move it to another service, and withdraw consent you gave.
  2. 9.2Send requests to adminkuukru@gmail.com. We reply within 30 days and may ask for information to confirm your identity first.
  3. 9.3For student data, guardians contact the teacher or school, which is the data controller. Homeroom teachers can export or delete a student's data in the app.
  4. 9.4If you believe processing breaks the law, you have the right to complain to the Personal Data Protection Committee office (PDPC).

10.Cookies

  1. 10.1We use only cookies the site needs to work: sign-in, language and display settings.
  2. 10.2We use no advertising cookies and no third-party tracking cookies.

11.Changes to this policy

  1. 11.1We may update this policy from time to time and show the effective date at the top. For significant changes we will tell users by email or in the app before they take effect.