Privacy Policy

When a business connects its Facebook Page or Instagram professional account with Facebook Login for Business, we receive only what is needed to run its inbox:

• The Page and Instagram account ID, name and profile picture, and an access token for that Page/account (stored encrypted).
• Messages sent to the Page or Instagram account: text, attachment information and timestamps.
• The sender’s Page-scoped or Instagram-scoped ID, name, username and profile picture, so staff can see who wrote.
• Replies sent by the business, including replies sent from Meta’s own apps (message echoes), so the conversation history is complete.

We do not use Meta data for advertising, do not sell it, and do not use it to build profiles outside the business’s own inbox.

• LINE Official Account messages and the sender’s LINE user ID, display name and picture, for businesses that connect LINE.
• Staff accounts: email address, display name, language and notification settings, sign-in records.
• Technical data needed for security and reliability: IP address, device/browser information and request logs.

• Show each conversation in the business’s inbox and send the replies its staff write.
• Translate messages and draft replies between Japanese, English and Thai, and check dates, times and amounts before sending.
• Improve translation quality for that business: we review past translations and staff corrections with personal details masked, and use the results only for that business’s glossary and our quality tests. They are not used to train AI models and are deleted with the business’s data when its contract ends.
• Link a conversation to the customer record in the business’s own TORIA OS system when the business uses one.
• Notify staff of new messages, keep the service secure, prevent abuse and fix problems.

We share data only with providers that run the service for us, under their terms:

• Vercel (application hosting) and Supabase (database, Tokyo region).
• Google (Gemini API) and Anthropic (Claude API) to translate text. Obvious personal details such as phone numbers and addresses are masked where possible before sending. We do not use message content to train our own models.
• Meta and LINE, to receive and deliver the messages themselves.

We do not sell personal data. We disclose data to authorities only when the law requires it.

• Message content and its translations are kept for the retention period of the business’s TORIA plan and deleted automatically when it ends (on the highest plan, they are kept for as long as the business uses TORIA).
• When a business’s contract ends or it disconnects the account, that business’s message content and translations are deleted within 30 days.
• If you ask us to delete your data, we delete it within 30 days (see Data Deletion).
• Access tokens are deleted when the business disconnects the account.
• Staff account data is kept while the account is in use and deleted on request.

Message content and account credentials are stored encrypted. Only staff members who belong to a business’s inbox can see its conversations, and each business is kept separate from the others.

You can ask us to delete your data at any time. See https://chat.toriaos.com/data-deletion for the steps. Businesses can also disconnect their Facebook, Instagram or LINE account, which stops new data and deletes the access token.

Under Thailand’s Personal Data Protection Act B.E. 2562 and other applicable laws, you may ask to access, correct, delete or restrict the use of your personal data, or object to its processing. Contact info@toriaos.com. If you are the customer of a business that uses TORIA Chat, you may also contact that business directly.

We will update this page when our practices change. Questions: info@toriaos.com, WALC DESIGN CO., LTD., 591 Samatcha Vanit 2 Building, 20th Floor, Sukhumvit Road, Khlong Tan Nuea, Watthana, Bangkok 10110, Thailand.