Privacy notice

This notice explains how VESPERWERK Co., Ltd. (“Vesperwerk”, “we”, “us”) handles personal data when you visit vesperwerk.com, contact us, or book a call with us. It is written to meet the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the “PDPA”).

Who we are

We are the data controller for the personal data described in this notice.

This notice does not cover data we process on behalf of our clients inside systems we build or operate for them. In that work, the client is the data controller and we act as its data processor under a written agreement. If you are a patient or customer of one of our clients, the client’s own privacy notice applies.

Personal data we collect

When you use the contact form

• your name
• your email address
• your company or organization name, if you choose to give it (optional)
• your phone number, if you choose to give it (optional)
• your message
• which topic you chose: a product demo, or a custom build

How your message reaches us: the contact form is sent through our server and delivered as an email to our mailbox; the website does not keep a copy. If our server cannot deliver it, the page offers to prepare the same message in your own email app (or in Gmail on the web) for you to send; that message then travels through your email provider straight to our mailbox and our website never receives it.

When you book a call (only if we offer online booking and you use it): your name, email address, the time you choose, and any notes you add. Bookings are handled by Google Calendar, part of our Google Workspace.

When you message us on LINE: your LINE display name, profile picture, and the messages and files you send to our LINE Official Account.

When you email us: your email address, name, and whatever you choose to write or attach.

When you try the live AI receptionist demo (on our home page and the Live demo page): the messages you type, and any details you choose to put in them, such as a name or phone number. The clinic in the demo is fictional, so made-up details are fine. Our website passes each message to our own demo engine, a separate copy of our receptionist product that runs only the fictional clinic and is hosted by Fly.io. To write each reply, the engine sends the conversation so far to Google (the Gemini model on Google Cloud Vertex AI) or, if Google is unavailable, to Anthropic (the Claude model), and passes the reply back to your browser. The engine keeps the conversation only while you are chatting: it is deleted 30 minutes after your last message. If you agree to send the booking request, the engine saves the request (treatment, preferred time, branch, name and phone number) as a sample case in the fictional clinic’s staff queue, which only Vesperwerk can see. Our website’s logs record only counts, such as the number of messages, the response time and the cost of the reply, never what you wrote. If the live demo is unavailable, the demo shows a prepared example conversation that runs in your browser, and nothing you do there is sent anywhere.

Technical data: when the form is sent through our server, or when you use the live demo, your IP address and basic browser signals are checked at that moment to protect it from spam and abuse (rate limiting and Cloudflare Turnstile). Our application does not store your IP address. Cloudflare, which hosts and protects this site, processes request data such as IP addresses to deliver and secure the site under its own terms.

Analytics: we use Cloudflare Web Analytics, which does not use cookies and does not build a profile of you. It gives us aggregate figures only, such as page views, referring sites, country and device type. When the form is sent through our server, we also count submissions by page and door, without any personal data.

Page and click analytics: to learn which pages and actions on our site are useful, so we can improve it, we also use PostHog. When you browse vesperwerk.com, PostHog receives the pages you view, the links and buttons you click and the choices you make on the site (such as language or theme), how far down each page you scroll, the site that referred you and any campaign tags in the link (UTM), and your device type, operating system, browser and screen size. It never receives what you type into the contact form or the demo. PostHog uses no cookie and stores nothing on your device. To count visitors, it turns your IP address and browser details, together with a random value that changes every day, into a one-way code (a hash), and deletes each day’s random value once that day’s events are processed, so a visit cannot be traced back to you or linked to your visits on other days. PostHog does not keep your IP address with the events. We do not build profiles of visitors and we do not record sessions (no recordings of your screen or mouse). If your browser sends a Global Privacy Control signal, PostHog is not loaded and nothing is sent to it.

Demo usage counts: to learn how many different people try the live demo and how far they get, the demo keeps anonymous counts. When you open it, your browser makes a random id (kept in your browser as vw-demo-anon) and tells our server which demo steps it reached: opened the demo, sent a first message, saw the read-back of the booking details, sent the request, and clicked to book a demo, each at most once a day. We store only that random id, the step and the date: no message text, no IP address and nothing that identifies you. If your browser sends a Global Privacy Control signal, the demo sends nothing and creates no id.

Please do not send sensitive data. Our website is not the place for health information, patient records, ID card numbers or other sensitive personal data under Section 26 of the PDPA. If you send it anyway, we will not use it beyond replying to you, and we will ask you to share it through a proper channel if it is needed for a project. The same goes for the live demo: please do not describe a real health condition there; made-up details work just as well.

Why we use it, and our lawful basis

We do not rely on consent to process the data described here. We do not sell or rent personal data, and we do not use it for advertising. We do not send marketing newsletters; if that ever changes, we will ask you first.

Where we rely on legitimate interests, we have weighed those interests against your rights and expectations. You can object at any time (see “Your rights” below).

How long we keep it

• Contact form: the website has no database for contact form submissions. Each submission is delivered as an email to our Google Workspace mailbox.
• Inquiry emails and booking details: kept in our mailbox and deleted after 24 months without further correspondence, unless a contract follows.
• LINE messages: messages and files sent to our LINE Official Account are deleted after 24 months without further correspondence, unless a contract follows.
• If a contract follows: kept for the duration of the contract, and afterwards for as long as Thai accounting and tax law requires us to keep business records.
• Live demo conversations: our demo engine deletes the conversation 30 minutes after your last message, and your browser forgets it when you leave or reload the page. A booking request you chose to send is kept as a sample case in the fictional clinic’s queue and deleted after 30 days. Google and Anthropic may keep the requests they receive for a limited period under their own terms, for safety and abuse monitoring, and under their commercial terms they may not use them to train their models.
• IP addresses and form protection signals: not stored by us.
• Analytics: no personal profile to keep. The PostHog events described above are kept for up to one year, the retention period of our PostHog plan.

Who receives it

We share personal data only with service providers who process it for us under their data processing terms, and only for the purposes in this notice:

We may also disclose personal data to professional advisers bound by confidentiality, to a successor if our business is reorganized or sold, or to a public authority when the law requires it.

Transfers outside Thailand

Our providers operate global infrastructure, so your data may be processed or stored outside Thailand, for example in the United States, the European Union, Singapore or Japan. Our PostHog analytics are stored in the European Union (Frankfurt, Germany). When we transfer personal data abroad, we do so under Sections 28 and 29 of the PDPA: we rely on the providers’ data protection safeguards, such as their data processing agreements and standard contractual clauses, and, where it applies, on the transfer being necessary to take steps you requested before entering into a contract with us.

Your rights

Under the PDPA, you have the right to:

• access your personal data and get a copy of it, and ask how we obtained data you did not give us yourself
• data portability: receive your data in a commonly used, machine-readable format, or have it sent to another controller where technically possible
• object to processing based on our legitimate interests
• erasure: ask us to delete, destroy or anonymize your data
• restriction: ask us to suspend the use of your data
• rectification: ask us to correct data that is inaccurate, out of date or incomplete
• withdraw consent at any time, where processing is based on consent (we do not rely on consent for the processing described here)
• complain to the Personal Data Protection Committee (PDPC) if you believe we have not complied with the PDPA

To use any of these rights, email contact@vesperwerk.com. We may ask you to confirm your identity before acting. We respond without undue delay and within 30 days, free of charge. If we cannot fully meet a request, for example because the law requires us to keep certain records, we will tell you why.

How we protect it

We keep personal data to a minimum and protect it with technical and organizational measures, including:

• HTTPS encryption with HSTS on every page
• no database of contact form submissions
• access limited to the people who need it, using personal accounts with multi-factor authentication
• credentials kept in managed secret stores, never in source code
• logs that exclude message content and contact details

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and notify you without delay when the risk is high, as the PDPA requires. More detail is on our security page.

Children

This website is meant for businesses and professionals. We do not knowingly collect personal data from minors (persons under 20 years of age under Thai law). If you believe a minor has sent us personal data, please contact us and we will delete it.

Changes to this notice

We may update this notice when our practices or the law change. The version number and effective date at the top of this page always show the current version. If a change is significant, we will say so clearly on this page.

This notice is published in Thai and English. If there is any inconsistency between the two, the Thai version prevails.

Contact us

For any question about this notice or your personal data, write to contact@vesperwerk.com or by post to VESPERWERK Co., Ltd., 89/4 Moo 1, Ban Ko Subdistrict, Phra Nakhon Si Ayutthaya District, Phra Nakhon Si Ayutthaya 13000, Thailand.