Privacy Policy

1. Who we are and what this policy covers

UltraPilot is a business inbox and commerce tool operated by ULTRA AGENT LIMITED. Shops ("businesses") use it to answer their customers on LINE and Facebook Messenger, keep customer records, and manage orders. This policy covers two groups of people: (a) shop owners and their team members who sign in to UltraPilot, and (b) the shop's customers who send messages to a LINE Official Account or Facebook Page that the shop connected.

For customer conversations, the shop decides why and how the data is used (the shop is the data controller) and we process the data for the shop (we are the data processor). For your own UltraPilot account, we are the data controller.

2. How you sign in

You sign in to UltraPilot with Ultra ID, the single account used across ULTRA AGENT apps. UltraPilot does not offer "Sign in with Facebook". Ultra ID shares your name, email and a stable account identifier with UltraPilot so we can create your UltraPilot account. Connecting a Facebook Page or LINE Official Account (see §5) is a separate step and is not a login.

3. Information we collect

Team members: name, email, profile picture, role in the workspace, sign-in history (time, IP address, browser), and actions recorded in the audit log.

Businesses: business name, connected channels (Page or Official Account id and name), access tokens for those channels (stored encrypted with AES-256-GCM), payout accounts the shop adds (PromptPay or bank account shown to its customers), products, orders, invoices and payment records.

Shop customers who message a connected channel: platform user id (for example a Facebook Page-scoped id or LINE user id), display name and profile picture provided by the platform, message text, photos, videos and files they send, and anything the shop adds (notes, tags, phone, address, orders).

4. How we use it, and the AI assistant

We use the data only to run UltraPilot for the shop: show conversations in one inbox, send the shop's replies, keep customer and order records, and keep the service secure. We do not sell personal data and do not use it for advertising.

UltraPilot has an AI assistant that runs on our own servers in Thailand. If our servers cannot answer (for example during an outage), the text needed for that one suggestion is sent to a backup AI provider listed in §9, which processes it only to return the answer on our behalf. By default it only drafts reply suggestions and a person on the shop's team decides what to send. A shop can choose to turn on automatic replies (AutoPilot) for its own channels; when it does, some replies to customers are written by AI on the shop's behalf. The AI learns from each shop's own knowledge and past answers inside that shop's workspace only — never across shops.

5. Facebook / Meta and LINE

When a shop owner connects a Facebook Page, we ask Facebook for these permissions, each used only for the purpose shown: public_profile (identify the person who connects the Page), pages_show_list (list the Pages they manage so they can pick one), business_management (list Pages that belong to their business portfolio), pages_manage_metadata (subscribe the chosen Page to message webhooks, and unsubscribe when it is disconnected), and pages_messaging (receive the Page's Messenger messages and send the shop's replies). We do not request Instagram or WhatsApp permissions today; we will update this policy before we do.

Messenger replies are sent within Meta's 24-hour standard messaging window after the customer's last message. Outside that window we only send a message where Meta's current policy allows it. We do not use message tags that Meta has discontinued.

Data from Meta and LINE is used only to provide the inbox and commerce features above. It is not sold, not used for advertising, and not shared with third parties except our infrastructure providers listed in §9.

If you remove UltraPilot from your Facebook settings and ask for your data to be deleted, Meta sends us a signed request. We process it automatically right away: the Page connections you authorized are disconnected, their tokens are deleted and the Page webhook is unsubscribed. You get a confirmation code and can check the result at https://ultrapilot.app/data-deletion-status. A shop's chat records with its own customers stay with that shop unless the shop deletes them (§6).

6. Deleting data

Delete my UltraPilot account (Settings › Profile, any team member): takes effect immediately and signs you out. Your name, email and picture are removed from the team, your UltraPilot sign-in is deleted, and messages you sent to customers stay with the shop but show as "deleted member". If you are the only owner of a business, you must first make someone else an owner or delete the business. Your Ultra ID and other ULTRA AGENT apps (such as ShopWow or TurboWoW) are not deleted — they have their own deletion.

Delete this business (Settings › Workspace, owner only, confirmed by typing the business name): immediately disconnects LINE and Facebook (tokens deleted, Page webhook unsubscribed unless another business still uses the same Page), turns off automatic replies, removes all team members, and deletes the payout accounts. Customers, conversations, chat photos and files, notes, AI knowledge and raw webhook data are then deleted in the background, usually within minutes. Orders, invoices and payment records are kept for tax law with customer names, addresses and payment slips removed.

Delete a customer's data (customer page, owner or admin): for when a customer asks the shop. Removes that customer's name, phone, email, addresses, platform ids, conversations, chat photos and files; their orders stay without personal details. We keep a one-way hash of their platform id so old chat history is never imported again; if they message the shop again later, it starts as a new conversation.

Starting again: if you come back after deleting, you start with an empty account or business. We keep a one-way hash of your Ultra ID to know it is not your first time, so free trials and first-time offers are not given twice.

You can also email [email protected] to ask us to delete data; we reply within 30 days.

7. Retention and legal hold

Account, business and conversation data are kept while the account or business is active, until someone deletes them as described in §6. We do not delete chats automatically on a timer.

Legal hold: right before any deletion in §6, we seal a private copy of the information that identifies the people involved (for example account and sign-in details, IP addresses, the deleted customer or business records, and invoice details). This copy is not visible in the app, is never used for the service, marketing or AI, and is opened only to respond to a lawful request from the police, a court or another authority, or to defend a legal claim. It never contains passwords or access tokens. It is kept for the legal limitation period — 2 years, or 5 years where it contains tax records — and then deleted. Signing in again does not restore it.

Requests from public authorities: we disclose personal data only when legally required. We first review whether each request is lawful, disclose only the minimum data needed, and keep a record of every request, our response and the legal basis.

Orders, invoices and payment records are kept for 5 years as required by the Thai Revenue Code. Deleted data can remain in backup copies for a limited time until those copies expire; we do not restore deleted data from backups except to recover from a system failure.

8. Where data is stored and how it is protected

Data is stored on servers we operate in Bangkok, Thailand (backup AI requests described in §4 are processed by the providers in §9). Traffic is encrypted in transit (HTTPS). Channel access tokens are encrypted at rest with AES-256-GCM. Each business's data is separated at the database level, and team access is controlled by role.

9. Service providers

Meta (Facebook Messenger) and LY Corporation (LINE Messaging API) — to receive and send the shop's messages. Logto-based Ultra ID operated by ULTRA AGENT — sign-in. Cloudflare — network security, content delivery and search indexing (Workers AI). Backup AI providers, used only when our own AI servers cannot answer: OpenAI (United States) and Alibaba Cloud (Singapore). Each provider receives only what it needs for that function, processes it on our behalf, and may not use it for its own purposes.

10. Your rights (PDPA and GDPR)

Under Thailand's Personal Data Protection Act B.E. 2562 (and the GDPR where it applies) you may ask to access, correct, delete, or receive a copy of your data, and to object to or restrict its processing. Team members can delete their account in the app (§6). Shop customers should first contact the shop that holds their conversation; the shop can delete their data in UltraPilot. You can always contact us at [email protected] — we reply within 30 days — and you may complain to the Office of the Personal Data Protection Committee.

11. Cookies

We use only cookies needed to run the app: the sign-in session cookie and small preference cookies (theme and language). No advertising or cross-site tracking cookies.

12. Changes and contact

We will post changes on this page with a new date and tell account holders about important changes. Privacy and data protection contact: [email protected] | Phone: 02-507-1724 (+66 2 507 1724) | Postal: ULTRA AGENT LIMITED, 316/97 Soi Wongsawang 11, Wongsawang, Bang Sue, Bangkok 10800, Thailand | Tax ID: 0105569026818