Privacy Policy
Last updated November 3, 2026
Tuhmo ("we") cares about your personal data. This policy explains how we collect, use, disclose, and protect personal data, in line with Thailand's Personal Data Protection Act B.E. 2562 (PDPA).
1. Data we collect
- Account data: name, email, profile picture, password (stored as a one-way hash), and data from your Google or LINE account if you sign in with them.
- Workspace data: workspace name, members, roles, and permissions.
- Content you create: tasks, notes, proposals, contracts, invoices, client and contact information, files, and comments.
- Payment data: your plan, payment history, and receipt details (company name, tax ID, address). Card details are handled by Stripe; we do not store your full card number.
- Usage and device data: IP address, browser type, access times, and workspace activity logs, for security and abuse prevention.
- Data from services you connect: for example calendar events, Google Drive or Figma files you choose, messages from chat channels you link, and the title, state, author, and link of GitHub issues, pull requests, and commits you paste or that mention your task IDs, only as needed for the features you turn on.
- Developer connection data: API keys (we store only a one-way hash, never the key itself), webhook delivery history, and the history of requests received through incoming webhooks, including the IP address and type of program that sent them.
- Data used with Tuhmo AI: the questions and instructions you type, files and images you attach, text you select for AI to read, and workspace data AI looks up to answer you, plus the number of credits used (not the content) to track your usage allowance.
2. How we use data
- To provide the Service: create and manage accounts, store and show your content, and send documents, invoices, and bookings to your clients.
- To bill for the Service and issue receipts.
- To send necessary emails such as verification codes, invitations, notifications, and service changes.
- To keep the Service secure and prevent bots, fraud, and misuse.
- To improve the Service and fix problems, using aggregate usage statistics such as how often each feature is used, days active, team size, and how you found us. We never read the content of your documents or notes for this.
- To comply with the law.
We do not sell your personal data, and we do not use your content for advertising.
3. Client data you store
For personal data about your clients and contacts that you store in a workspace, you are the data controller and we act as a data processor on your instructions. You are responsible for informing those people and obtaining their consent where the law requires.
4. Tuhmo AI
Tuhmo AI is optional. When you use the chat or ask AI to help you write, the text you send, files you attach, and the workspace data needed to answer are sent to Anthropic, the provider of the Claude models, for processing in the United States. Under Anthropic's terms, data sent through its commercial API is not used to train its models.
- AI acts with your permissions and only sees data you can see in that workspace.
- Before anything that cannot be undone, such as sending a document to a client or deleting data, you are asked to confirm.
- Chat history belongs to you alone and is deleted 30 days after you last used it.
- Workspace owners and admins can turn Tuhmo AI off. Turning it off deletes that workspace's AI chat history.
- AI answers may not always be accurate. Please check them before using them with clients.
5. Google user data
If you connect Google Calendar, Tuhmo requests read-only access (calendar.readonly) and your Google account email. We use this access only to list your calendars so you can choose which ones to show, and to display events from those calendars in your Tuhmo calendar and Upcoming list. Tuhmo never creates, changes, or deletes events in your Google Calendar.
We store an encrypted refresh token and a copy of events from the calendars you choose, only to show them in your workspace. We do not sell this data, use it for advertising, share it with third parties, or use it to train AI or machine learning models, and our AI assistant does not read it.
If you open meeting notes for an event, Tuhmo creates a note in your workspace with that event's title and time. That note is your own content and stays in your workspace after you disconnect, until you delete it.
You can disconnect at any time in Settings, under Connections. Disconnecting revokes Tuhmo's access at Google and deletes the synced events from Tuhmo. You can also remove access at myaccount.google.com/permissions.
Tuhmo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Sharing with third parties
We share data only as needed to provide the Service, with:
- Our payment processor (Stripe).
- Anthropic, our AI model provider, for requests you make with Tuhmo AI.
- Our email delivery provider and the cloud providers that store and run our systems.
- Cloudflare, for bot and attack protection.
- Meta Platforms, to measure our advertising, only if you accept all cookies (see the cookies section).
- Services you choose to connect, such as Google, Microsoft, Apple, LINE, Telegram, WhatsApp, Figma, GitHub, and AI apps via MCP.
- Destination systems that you or your workspace admins set up through webhooks or API keys. We send only the events you choose, never note content or private pages.
- Members of your workspace and people you share links with, according to the permissions you set.
- Government authorities, when required by law or court order.
7. International transfers
Some of our providers may store or process data outside Thailand, such as Anthropic, which processes Tuhmo AI requests in the United States. We choose providers with adequate data protection standards as required by the PDPA.
8. Retention and security
- We keep data while your account or workspace is active, or as long as the law requires, for example payment records and receipts.
- Deleted items stay in the trash for 30 days, then are deleted permanently. Accounts not verified within 7 days are deleted.
- Webhook delivery history is kept for 3 days on the Free plan and 14 days on higher plans. Incoming webhook history is kept for 14 days. Revoked API keys and URLs stop working right away.
- When you delete your account, we delete it and the workspaces you own. Data in backups may take some time to be fully removed.
- We use encryption in transit (HTTPS), store passwords as one-way hashes, restrict access to data, and rate-limit sign-in attempts to prevent password guessing.
9. Your rights
Under the PDPA, you have the right to:
- Access and obtain a copy of your personal data.
- Correct your data so it is accurate and up to date.
- Have your data deleted or destroyed.
- Restrict or object to processing.
- Have your data transferred.
- Withdraw consent you have given.
- Complain to the Personal Data Protection Committee.
10. Cookies and browser storage
The app uses browser storage (local storage) to keep you signed in and remember your preferences, such as theme and your last workspace. Cloudflare's bot protection may set cookies needed for security.
The tuhmo.com website and sign-in pages use one analytics cookie (tuhmo_src) to record how you found us, such as a link from one of our customers' documents or a campaign. It is set only if you accept, kept for 60 days, and your choice is stored in the tuhmo_consent cookie for 1 year. You can change your mind at any time from "Cookie settings" in the footer.
If you sign up through a link that carries a campaign code (such as ref or utm_source), we record that code with your account even if you did not accept the analytics cookie. The code travels only with the sign-up link, nothing is stored on your device, and the site that referred you is not included. We use it to measure which channels work, under our legitimate interest. You can ask us to remove it at [email protected].
The tuhmo.com website counts visits with Cloudflare Web Analytics, which uses no cookies and collects nothing that identifies you. We only see totals, such as visit counts, pages viewed and referring sites.
If you accept all cookies, the tuhmo.com website and the app's sign-up pages load the Meta Pixel from Meta Platforms to measure our advertising on Facebook and Instagram, such as how many people saw an ad, visited the site, went to sign up, and finished signing up. Meta may set its own cookies (such as _fbp) and link visit data to your Meta account under Meta's own policies.
If you accept all cookies and then finish signing up, our server also tells Meta about that one sign-up through the Conversions API, so it is counted even when a browser blocks the Pixel. We send only the Meta cookie IDs from your browser, your IP address, your browser type and a hashed user ID. We do not send your email, name or any Tuhmo account data to Meta.
If you choose "Essential only" or have not answered yet, the Meta Pixel is not loaded, and we use no other third-party tracking cookies.
11. Changes to this policy
We may update this policy from time to time. For significant changes, we will notify you by email or in the app before they take effect.
12. Contact us
To exercise your rights or ask about personal data, contact [email protected].