Privacy policy

1. Two groups of people, and why the difference matters

Kohsta is used by property operators — hotels, villas, apartments and guesthouses — to run the stay of their guests. So two quite different groups of people have data in the system, and the law treats them differently.

Our customers: the operators

The property, the people who sign in to the admin, and anybody who writes to us. For this data we are the controller. We decide what is collected and why, and this policy is our own account of it.

Their guests

The people staying at the property. For this data the operator is the controller and Kohsta is the processor. We hold and handle guest data on the operator's instructions and for their purposes, not for ours. We do not decide what a property collects, we do not use guest data for our own ends, and we do not sell it or market to guests.

The practical consequence is in section 11: a guest who wants to see or delete their record asks the property, not us — and if they ask us, we tell the property rather than acting behind their back.

2. What we hold about our customers

• Enquiries. When you use the form on our site: your name, email address, the property name, whatever you wrote, and the IP address the form was submitted from.
• Accounts. The name, email address and role of each person you give access to, and a hashed password. We never store a readable password.
• Your property's settings. Registered addresses, rooms and rates, guide content, photographs, the details that appear on your invoices, and your taxpayer details where you have entered them.
• Billing. Your plan band, subscription status and dates, the invoices we have raised and the payments recorded against them. Where you have chosen to store a card we keep only what Stripe returns to identify it — the brand, the last four digits and the expiry — never the card number itself.
• Correspondence. Support emails and what we needed to note to answer them.
• Ordinary server records. Request logs and error reports generated by running the service.

3. What we process about guests, for the operator

This is the part worth reading closely, because guest registration in Thailand asks for more than a name and an email address. Depending on which features an operator has switched on, the system may hold:

• Identity. Title, first, middle and last name, name in Thai where given, nationality, sex and date of birth.
• Identity documents. Passport number, Thai national identification number, alien certificate number, and the authority that issued the document.
• An image of the identity document. A passport scan or photograph, where the operator asks for one.
• A signature image. Captured at registration, because the ร.ร.4 register requires the guest's signature.
• Stay details. Dates, room, arrival and departure times, and where the guest travelled from and is travelling on to, which the hotel register asks for.
• Contact and address. Email address, telephone number, current address and country, and occupation where the register requires it.
• Booking and money. The booking itself, extras, tours, room service, meter readings and room charges, invoices and receipts, and the record of payments made.
• Filing records. Whether a TM30 has been submitted and when, the reference given, and the ร.ร.4 filings sent to the registrar with the acknowledgement received back.
• Marketing consent, if any. Whether the guest ticked the box, the exact wording they were shown at the time, and when. The wording is stored with the consent on purpose: a consent nobody can reproduce is not a consent.
• Provenance. Whether the guest filled the form in themselves or a staff member entered it, and the IP address the registration was submitted from.

None of this is collected by us for us. It is collected by the property, under its own duties, and it sits in the property's own account.

4. Payments, and why card details never reach us

When a guest pays through Kohsta, they are sent to the payment provider's own hosted page, on the provider's own domain, using the property's own account with that provider. Card numbers, expiry dates and security codes are entered there and never touch Kohsta's servers or its logs.

What comes back and is stored against the booking is a reference — the checkout session and payment identifiers, the amount, the currency, the status and the time it was paid, plus a short whitelisted summary of the provider's response. Not a card number, not the last four digits, not a card brand.

Our own subscription payments run the same way: card and PromptPay are taken on Stripe's hosted page and no card number reaches us, and a bank transfer reaches no payment processor at all.

5. Why we hold it

For customers: to provide the service, to invoice for it, to answer support, to keep the service secure, and to meet our own legal and accounting obligations.

For guests: because the operator instructed us to, in order to run the stay and to meet duties Thai law places on accommodation — immigration notification and the hotel guest register in particular. The lawful bases are set out on the data and PDPA page, and the short version is that the immigration and register data is held under a legal obligation rather than under consent.

6. Who else sees it

We do not sell data and we do not share it for anybody else's marketing. Data reaches a third party only where the service requires it:

• Stripe — guest payments, on Stripe's hosted checkout page, using the property's own Stripe account.
• OpenAI — translation of content and interface text. Guide content and interface strings are sent for translation; guest records are not translation material and are not sent.
• Mailchimp or Kit — only where an operator has connected one, and only for guests who gave marketing consent. The property configures this; it is off unless they turn it on.
• Google Analytics — only where an operator has entered their own measurement ID for their own public site. Kohsta's admin does not carry analytics.
• Google Maps — address and place lookup on admin forms, used by staff rather than guests.
• jsDelivr — a public CDN serving stylesheets and icons. Loading a page from it discloses the visitor's IP address and browser to the CDN, as any external asset does.
• An email delivery provider — for the mail the service sends. See the gap noted at the top of this page.
• A content publishing webhook — used to bring blog articles into a property's site. It carries content, not guest data.

We would also disclose data where a Thai authority is legally entitled to require it, and we would tell the operator unless we were prohibited from doing so.

7. Where it is kept

Guest data, including passport scans, signature images and filing acknowledgements, is stored on private storage that is not part of the public web root. Those files are never served by a link: an authorised member of the property's staff requests one through the admin and it is streamed to them with caching switched off.

The country the servers sit in is one of the gaps listed at the top of this page, and it has to be settled before the cross-border transfer section of the PDPA page can be finished.

8. How long it is kept

Plainly: the software does not currently delete anything automatically. There is no scheduled purge and no retention job. Records stay until somebody removes them, which we would rather say than describe a schedule we do not run.

What does exist:

• Deletion on request. A guest record can be deleted from the admin, and doing so removes the passport scan and the signature image from storage with it, rather than leaving files orphaned on disk.
• A statutory floor for the register. The ร.ร.4 register and its associated forms must be kept in a checkable condition for at least one year under the Hotel Act. A deletion request cannot reach below that floor while it applies.
• Tax and accounting records. Invoices and receipts have their own minimum retention under Thai tax law. Your accountant will tell you what applies to your business; we do not advise on it.
• Our own records. We keep our invoices to you and our correspondence for as long as we are required to, and no longer than we must.

9. Security

• The service is served over HTTPS.
• Each property's data is scoped to that property. Staff see their own venue, not somebody else's.
• Passwords are stored hashed, never in a readable form.
• Passport scans, signatures and filing acknowledgements are held on private storage, checked on upload, and released only through an authorised, non-cached download.
• Access to the admin is by named account, so an action can be attributed to a person and access can be withdrawn when somebody leaves.

For current service availability, see the status page. The PDPA page explains data breach notification duties.

10. Cookies and analytics

Kohsta sets the cookies a signed-in session needs — a session cookie and a cross-site request forgery token. They are functional: without them you cannot stay signed in or submit a form safely.

We run no advertising cookies and no cross-site tracking. If a property has entered their own Google Analytics measurement ID, analytics runs on that property's own public site under their control, not ours, and it is their disclosure to make to their visitors.

11. Your rights, and which door to knock on

Under the PDPA you may ask for access to your data, correction of it, erasure, restriction of its use, transfer of it, and you may object to processing or withdraw a consent you gave. Those rights and their limits are set out in more detail on the data and PDPA page.

If you are a guest of a property that uses Kohsta

Ask the property. They are the controller: they decide what happens to their guest records, and they hold the relationship with you. If you write to us instead, we will pass the request to them and help them answer it. We will not quietly alter or delete a property's records on a third party's say-so.

If you are an operator using Kohsta

Write to [email protected]. For data we hold about you as our customer, we answer directly. For your guests' data, we act on your instructions, including exporting it or deleting a record when you tell us to.

We will not charge for a reasonable request and we will answer within the period the PDPA allows. If we cannot do what is asked — usually because a statutory retention period applies — we will say so and say why.

You may also complain to Thailand's Personal Data Protection Committee. We would rather you gave us the chance to put it right first.

12. Children

Kohsta is not offered to children. Children do appear in guest records, because families travel and a hotel register asks for every guest staying. Where a property registers a minor, the property is responsible for handling that lawfully, including any parental consent the PDPA requires.

13. Changes to this policy

We may update this policy. The date at the top says when it last changed, and it will keep saying "draft" until a Thai lawyer has been through it. Material changes affecting operators will be sent to them rather than published quietly.

14. How to reach us

Privacy questions and data requests: [email protected]. A person reads it.

Registered name

AW Code Company Limited

Company registration number

0205557033660

Registered address

244/127-128 Moo 6, Nong Prue, Bang Lamung, Chon Buri 20150, Thailand

Taxpayer identification number

0205557033660