1. Data controller

GOV TO GLOBAL COMPANY LIMITED (บริษัท กอฟ ทู โกลบอล จำกัด), 9/3, 9/7 Soi Lat Phrao 8, Lat Phrao Road, Chom Phon, Chatuchak, Bangkok 10900, Thailand · Tel. +66 2 511 5340-1 · LINE @commeiq.

2. Data the browser extension handles

The extension reads a web page only when you send a request in its side panel, and only the tab you are asking it to help with. It does not read pages in the background, does not collect browsing history, does not use data for advertising, and does not sell data.

• Random device key generated by the extension and stored in extension storage; sent to the commeIQ server to recognise the same device.
• commeIQ device key and LINE user ID — read-only, and only from pages on g2g-ai-os.fly.dev (our own site), so the assistant recognises you as the same person as in the commeIQ app.
• Your typed request in the side panel.
• Content of the active tab when you make a request and after each step you approve: URL, title, visible page text (up to about 9,000 characters), and a list of up to 200 buttons, links and form fields with their labels and the current value of ordinary fields (up to 80 characters each). This is sent to the commeIQ server and to our AI provider to plan the next step. Our server does not save page content to its database.
• Sensitive fields (passwords, OTP codes, card numbers, payment/transfer fields, bank account numbers): their values are never read or sent.
• Screenshot of the visible tab — only when the AI asks and you approve it (you are asked every time). Sent once with the next request; not stored by our server.
• Action log: time, a hash of the device key, tool type, step description, outcome (approved / declined / done / error) and a short result text. Anything typed into sensitive fields is masked. Page text and screenshots are not logged. Used for security and audit.
• Cross-app memory: only if you agreed to let commeIQ remember you, the first request of each task and the AI's reply are saved to your commeIQ assistant memory.

The extension does not download or execute remote code. All code is packaged with the extension; AI replies are data describing a proposed action (click, type, scroll, open a page), which the extension validates and shows to you for approval before doing anything.

3. Data the commeIQ app handles

• A random browser key (stored hashed on the server).
• If you consent to be remembered: your name, profile details you choose to enter, optional national ID number and sales figures (encrypted with AES-256-GCM before storage), optional face data computed on your device as numbers (photos are not uploaded), and your conversations with the in-app assistant. Document photos you submit for form-filling are processed and discarded, not stored.
• LINE Login: your LINE user ID and the profile data LINE shares with your permission.
• Orders, delivery details, wallet credit transactions, shop listings and messages you send to our team. PromptPay payments are made in your own banking app; we never receive your bank password.
• Technical data such as IP address, timestamps and error logs, for rate-limiting, security and troubleshooting.

4. Purposes and legal bases (Thai PDPA)

• Providing the service you request (marketplace, delivery, wallet, AI answers, in-page help) — contract / service performance.
• Remembering you across devices and apps, profile and assistant memory — your consent, which you may withdraw at any time.
• Sending a screenshot to the AI — your consent each time.
• Action logs, abuse prevention, security and debugging — legitimate interests.
• Receipts, tax invoices and accounting records — legal obligation.

5. Sharing and international transfer

We do not sell personal data and do not use extension data for advertising or creditworthiness. We share only what is necessary with: AI providers that process your request (Anthropic Claude primarily; OpenAI or Google Gemini as fallback when the primary provider is unavailable); our cloud hosting provider (the service runs on Fly.io); LINE (LY Corporation) for LINE Login and messages; shops, couriers and banks involved in your order; and authorities where required by law. These providers may process data on servers outside Thailand.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

6. Retention

• Page content and screenshots: used for the request and not saved to our database; AI providers handle data under their own API terms.
• Extension device key: stays on your device until you uninstall the extension.
• Action logs, memory and profile: kept while you use the service until you ask us to delete them (no automatic time-based deletion is currently configured).
• Order and accounting/tax records: for the period required by Thai accounting and tax law.

7. Your controls and rights

• Every action the extension takes requires your approval (“allow once”, “allow for this task” or “don't allow”). Screenshots are always asked. Steps involving passwords, payments or deletion require you to type the confirmation word first, and the AI is instructed never to type passwords or press payment buttons for you.
• Stop instantly with the Stop button or Ctrl+Shift+X (Mac: Command+Shift+X); each task is limited to 20 steps.
• Declining to be remembered does not limit any feature. Uninstalling the extension removes the data it stored on your device.
• Under the Thai Personal Data Protection Act you may request access, a copy, portability, objection, erasure or anonymisation, restriction, correction, withdrawal of consent, and a copy of the action log for your device. Contact us using the details above. You may also complain to the Office of the Personal Data Protection Committee (PDPC), Thailand.

8. Changes

We will post any update on this page with a new date. Material changes to how data is used will be announced in the app or the extension before they take effect.