Last updated: October 25, 2026
This Privacy Policy explains what personal data Guri Wise collects, why we use it, who we share it with, how long we keep it and the rights you have. It applies to our website, our apps and our emails. We wrote it to meet the Thai Personal Data Protection Act of 2019 (PDPA) and, for visitors in the European Union, the General Data Protection Regulation (GDPR).
The short version: we collect only what we need to run your account and your subscription, we never sell your data, we use no advertising or tracking cookies, and you can ask us at any time to see, correct or delete your data.
1. Who We Are
1.1 Guri Wise is run by Guri Technologies (Thailand) Co., Ltd., company registration number 0105564046756, 92/5, 2nd Floor, Sathorn Thani 2 Building, North Sathorn Road, Silom, Bang Rak, Bangkok 10500, Thailand (“we”, “us”). We are the data controller for the personal data described in this policy.
1.2 For any privacy question or request, write to [email protected]. We have not appointed a data protection officer, because the law does not require one for a service of our size; the same address reaches the person responsible for data protection.
2. What We Collect and Why
2.1 The table below lists each purpose, the data we use for it, the legal basis under the PDPA (and the GDPR) and how long we keep the data.
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Creating and running your account | Name, email address, password (stored only as a secure hash), language | Contract | Until your account is closed, then deleted within 30 days |
| Your subscription, trial and payments | Plan, prices, dates, payment status, billing country or address if you enter one, the last four digits and brand of your card | Contract; legal obligation for accounting records | Accounting records for 5 years after the end of the financial year, as Thai accounting law requires |
| Giving you the service | Books you listen to or save, your progress and preferences, when you use these features | Contract | Until your account is closed |
| Service emails (receipts, password resets, account and subscription notices) | Name, email address, message details | Contract | Email delivery logs for 30 days |
| Newsletter | Email address, name, the date and way you signed up | Consent, given by ticking the box at checkout or signing up | Until you unsubscribe |
| Answering your messages (contact form, publisher requests, email) | Name, email address, company and what you write to us | Legitimate interest in answering you; steps before a contract | 2 years after our last exchange |
| Preventing fraud and abuse, including one free trial per person | Email address, payment details checked by our payment provider, IP address | Legitimate interest in protecting our service and customers | As long as the related account and payment records |
| Security and legal compliance | IP address, browser, pages requested, date and time, sign-in events | Legal obligation (Thai Computer-Related Crime Act); legitimate interest in keeping the service secure | At least 90 days, as Thai law requires, and no longer than 12 months unless an authority orders otherwise |
| Understanding how our website is used | See section 4 | Legitimate interest | 24 months |
2.2 You need to give us your name, email address and payment details to start a trial or subscription: without them we cannot create your account or charge for your plan. Everything else is optional.
2.3 We do not collect sensitive data such as health, religion or biometric data, and we do not use your personal data to train artificial intelligence models.
2.4 Where we rely on legitimate interest, we have weighed it against your rights, and you can object at any time (see section 7).
3. Who We Share It With
3.1 We never sell your personal data and we never share it with advertising networks. We share it only with service providers that process it for us under contract and only for the purposes above:
- Stripe, which processes card payments and screens them for fraud. We never see or store your full card number.
- DigitalOcean, which hosts our website on servers in Singapore.
- Amazon Web Services, which hosts our analytics, sends our emails (Amazon SES) and stores backups, on servers in Singapore.
- Cloudflare, which delivers and protects our website and stores our audio and images on its global network.
- Google, which hosts our company email, so messages you send us are stored there.
3.2 We may also share personal data with our professional advisers under a duty of confidentiality, with authorities when the law requires it, and with a buyer or successor if our business or this service is transferred, who must keep this policy’s protections.
4. Cookies and Analytics
4.1 Our website uses only strictly necessary cookies: they keep you signed in, remember your language, protect your session and let you complete a purchase. We do not use advertising or tracking cookies.
4.2 A cookie is a small file of letters and numbers that a website stores in your browser.
4.3 You can block or delete cookies in your browser settings. If you block strictly necessary cookies, signing in and checkout may not work.
4.4 To understand how our website is used, we run Umami, a privacy-focused analytics tool that we host ourselves on Amazon Web Services servers in Singapore. Umami sets no cookies. For each page view it records the page address, the referring website, browser, operating system, device type, screen size, language and approximate location (country), plus actions such as playing a preview, opening the pricing page or starting a trial. Your IP address is used only to estimate your country and to create a pseudonymous visitor code together with your browser details and a key that changes every month; the IP address itself is not stored. We keep these records for 24 months, never sell them and never share them with advertising networks. We process this data on the basis of our legitimate interest in understanding and improving our service. You can object at any time by writing to [email protected].
5. Transfers Outside Thailand
5.1 We are based in Thailand, and our website, analytics and email run on servers in Singapore. Stripe and Cloudflare may also process data in the United States and other countries where they operate.
5.2 We transfer data abroad only where it is needed to give you the service, and we rely on our providers’ data processing terms, which include standard contractual clauses that meet the PDPA and the GDPR. You can ask us for a copy of these safeguards.
6. How Long We Keep Your Data
6.1 We keep personal data only as long as the table in section 2 says. When a period ends, we delete the data or make it anonymous.
6.2 When your account is closed, we delete your account data within 30 days. We keep only what the law requires (accounting records for 5 years, security logs as described above) and what we need to handle a dispute or a legal claim, and only for that purpose.
7. Your Rights
7.1 Under the PDPA (and the GDPR, where it applies) you have the right to:
- ask whether we hold data about you and get a copy of it;
- receive the data you gave us in a common machine-readable format, or have us send it to another service;
- have inaccurate or incomplete data corrected;
- have your data deleted, or made anonymous, when we no longer need it or you withdraw consent;
- ask us to restrict how we use your data while a question about it is being resolved;
- object to processing based on our legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time, as easily as you gave it, without affecting what we did before;
- complain to the Office of the Personal Data Protection Committee in Thailand (pdpc.or.th), or, if you live in the European Union, to the data protection authority in your country.
7.2 To use any of these rights, write to [email protected] from the email address on your account. We may ask you to confirm your identity. We answer without delay and within 30 days, free of charge. If we cannot do what you ask, for example because the law requires us to keep certain records, we tell you why.
7.3 To close your account, write to the same address with the subject “Close my account”. We cancel any active subscription and delete your account data within 30 days, as described in section 6. You can unsubscribe from the newsletter at any time with the link in every newsletter email.
8. Security
8.1 We protect your data with encrypted connections (HTTPS), hashed passwords, access limited to the people who need it and providers that meet recognized security standards. Card payments are handled entirely by Stripe.
8.2 No system is completely secure. If a data breach is likely to put your rights at risk, we report it to the Office of the Personal Data Protection Committee within 72 hours of learning about it, and we tell you without delay when the risk to you is high.
9. Children
9.1 Guri Wise is not meant for children under 13, and we do not knowingly collect their data. Under Thai law, anyone under 20 needs the consent of a parent or guardian to subscribe. If you believe a child has given us personal data, write to us and we will delete it.
10. Automated Decisions
10.1 We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Our payment provider screens payments automatically for fraud and may decline one; if this happens, write to us and a person will review it.
11. Changes to This Policy
11.1 We may update this policy when our service or the law changes. The date at the top shows the latest version. If a change matters to how we use your data, we tell you by email or on our website before it takes effect.
12. Language and Contact
12.1 This policy is available in English and Thai. If the two versions differ, the Thai version applies to consumers in Thailand and the English version applies everywhere else.
12.2 Questions or requests: [email protected], or Guri Technologies (Thailand) Co., Ltd., 92/5, 2nd Floor, Sathorn Thani 2 Building, North Sathorn Road, Silom, Bang Rak, Bangkok 10500, Thailand.
