Who is responsible
MR. ERP COMPANY LIMITED (registration no. 0315551000297) is the data controller for the pearnly.com website and for Pearnly user account data. Contact us about personal data at hello@pearnly.com.
For documents and data about other people that a business customer sends into the service, such as a supplier's tax invoice or a dealer's customer ID card, the business customer is the controller. We process that data on the customer's instructions only, and the customer is responsible for informing those people and having a lawful basis.
What we collect
- pearnly.com website: no cookies and no visitor analytics. The server keeps normal IP and browser logs for security. Pages load fonts from Google Fonts, so Google sees your IP address.
- Accounts: name, email, username, contact phone number and, when you connect LINE, your LINE user ID and display name.
- Usage: IP address, browser details, sign-in history and a log of who opened or downloaded original files.
- Documents you send: tax invoices, receipts, bank statements, transfer slips and the data read from them.
- ID cards (Pearnly DMS): the card image, ID number, name, date of birth, address, gender, and issue and expiry dates.
- CC Desktop: the computer name, the folders you authorise and their network share paths, document files in those folders that match your rules, and the account-set data needed to send entries into your ERP or accounting software (account-set list, chart of accounts, customers, suppliers, products and departments). CC Desktop does not store your accounting software password.
- Top-ups: the transfer slip you upload so our staff can check the amount. We do not receive or store card details.
How we use it
- To provide the service under our contract: reading, checking and recording documents, sending them to the systems you choose and replying in LINE.
- To verify identity and keep accounts and systems secure (legitimate interest).
- To investigate problems and to check and improve document-reading quality, using your documents and the corrections you save, within our own systems (legitimate interest; you may object). This data is not used to train AI models of Google or any other third party and is not made available to other customers.
- To answer questions, support you and tell you about important service matters.
- To meet legal duties, such as keeping our own accounting and tax records.
We do not sell personal data, we do not use your documents for advertising, and we do not send you marketing without your consent.
Who receives it
- Google Cloud: AI document reading (Vertex AI Gemini, Cloud Vision, Document AI), with reading jobs run on Cloud Run in Singapore, and storage of original files and backups in Cloud Storage in Singapore. Under Google Cloud's terms, data sent for reading is not used to train Google's models.
- SSD Nodes: our main server provider in Singapore, holding the databases and system files.
- LINE (LY Corporation): messages, images and LINE sign-in when you use the service through LINE.
- Google (Gmail): system emails such as welcome and account notices.
- Cloudflare: DNS and the overview videos on the website.
- Systems you tell us to connect, such as MR.ERP DMS or your accounting software. Data is sent only when you instruct it.
- Government authorities, only where the law requires.
Transfers outside Thailand
Your databases and files are stored in Singapore. Google's AI document reading may be processed in data centres abroad depending on load at the time: Singapore, India, Australia, Canada, the United States and Europe. LINE processes data under LINE's own policy. We use providers with data protection agreements that meet international standards so that your data stays adequately protected.
How long we keep it
- Accounts and documents: for as long as you use the service. When you stop or ask us to delete, we delete within 30 days unless the law requires us to keep it.
- Intermediate document-reading results: deleted automatically within 7 days.
- Backups: daily copies are kept 14 days and weekly copies 8 weeks, then deleted automatically, so deleted data may remain in backups for up to 8 weeks.
- System logs: kept on the server's normal rotation for security.
- CC Desktop data on your computer, namely its logs, push history and account-set snapshots (the latest 3 by default), is managed and deleted by you.
How we protect it
- Every connection uses HTTPS.
- Each business customer has its own separate database.
- Original files are stored privately, open only to people with rights in that account, and every opening is logged.
- Backups are closed to outside access and sensitive configuration files are encrypted.
- CC Desktop's connection token is stored encrypted on your computer.
- Staff access only what they need to provide the service.
Your rights
Under the PDPA you have the right to:
- access your data and get a copy
- receive or transfer it in a machine-readable format
- have it corrected
- have it deleted, restrict its use or object to processing
- withdraw consent you have given
Send requests to hello@pearnly.com. We reply within 30 days. You may also complain to Thailand's Personal Data Protection Committee (PDPC).
Minors
Our services are built for businesses and are not aimed at minors.
Changes to this policy
If we make important changes, we will announce them on this page and in the service before they take effect.
Contact
MR. ERP COMPANY LIMITED · 158 Moo 8, Isan Subdistrict, Mueang Buriram District, Buriram Province 31000