PRIVACY POLICY
This Privacy Policy describes how Wellin Capital Co., Ltd. (“Company,” “we,” “us,” or “CashAI”) collects, uses, discloses, stores, and protects personal data when you use the CashAI mobile application, including its iOS version, related websites, customer support channels, and financial services (collectively, the “CashAI Services”).
This Privacy Policy should be read together with the CashAI Terms and Conditions, loan documentation, consent notices, and any service-specific notices presented to you. Where applicable law requires separate or explicit consent, we will request it separately and will not treat acceptance of this Privacy Policy as a substitute for that consent.
1. Scope and Eligibility
This Privacy Policy applies to visitors, applicants, borrowers, customers, and other persons who interact with the CashAI Services. Our loan products and services are intended for persons who are at least 20 years old, unless otherwise permitted by applicable law. If we learn that we have unintentionally collected personal data from a person who is not legally eligible to use the relevant service, we will take appropriate steps to delete or restrict that data, subject to legal retention requirements.
2. Personal Data We Collect
The data we collect depends on the service you use, the permissions you grant, the information required by law, and the device or platform you use.
| Category | Examples |
|---|---|
| Identity and profile data | Name, surname, title, date of birth, age, gender, nationality, marital status, occupation, employer, job title, business type, income, source of income, customer profile, username, and account credentials. |
| Government and verification data | National identification details, copies or images of identification documents, address information, electronic identity verification information, photographs, video, liveness checks, face images, and biometric templates used for e-KYC. |
| Contact data | Residential, registered, workplace, or mailing address; telephone number; mobile number; email address; and emergency or reference contact details you provide. |
| Financial, credit, and transaction data | Loan applications, credit assessment information, credit reports where lawfully obtained, bank account details, payment details, repayment history, loan agreements, account statements, income evidence, transaction records, and customer risk or credit scores. |
| Device and technical data | IP address, device model, operating system and version, app version, language, time zone, network and connection information, crash logs, diagnostic information, security signals, session identifiers, login timestamps, and device or app identifiers permitted by the operating system. |
| Usage and interaction data | Pages or screens viewed, actions taken in the app, feature usage, customer support interactions, chat records, survey responses, complaints, and marketing preferences. |
| Location data | Approximate or precise location, only when required for a disclosed service, fraud prevention, regulatory requirement, or address verification, and only after the applicable device permission is granted. |
| Camera, photo, and media data | Images or video captured or selected for identity verification, document submission, customer support, or other clearly disclosed features. Access occurs only after the applicable permission is granted. |
| Calendar data | Where the feature is offered and you grant permission, CashAI may create or manage repayment reminders. CashAI does not require access to unrelated calendar content to provide core lending services. |
| Marketing and advertising data | Marketing preferences, campaign interactions, attribution data, and, where permitted, advertising identifiers such as Apple’s Identifier for Advertisers (IDFA). |
| Cookies and website data | Cookie identifiers, browser type, website activity, referral source, and similar technologies used on CashAI websites. |
2.1 iOS platform clarification
The iOS version of CashAI does not collect a list of other applications installed on your iPhone or iPad. References in older or Android-specific notices to installed application information do not apply to the iOS version.
CashAI accesses protected iOS resources—such as camera, photos, location, calendar, microphone, notifications, or tracking identifiers—only when the relevant feature requires them and after the required iOS permission prompt is displayed. You may manage these permissions in iOS Settings.
2.2 Data about other persons
If you provide personal data about another person, such as an emergency contact or reference, you confirm that you are authorized to provide it, have informed that person about the relevant processing, and have obtained any consent required by law. We will use such data only for the disclosed purpose and as permitted by law.
3. How We Collect Personal Data
We may collect personal data:
- directly from you when you register, apply for a loan, verify your identity, upload documents, make a payment, contact customer service, or otherwise use the CashAI Services;
- automatically from your device or use of the app, subject to device settings and required permissions;
- from credit bureaus, banks, payment service providers, identity verification providers, fraud prevention providers, government or regulatory databases, and other lawful sources;
- from service providers and business partners that support hosting, analytics, communications, attribution, security, e-KYC, customer service, and payment processing; and
- from social login providers, only if CashAI offers that option and you choose to use it.
4. Purposes and Legal Bases
We process personal data for the following purposes and on the legal bases available under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and other applicable laws:
| Purpose | Typical Legal Basis |
|---|---|
| Create and manage your account; receive and process loan applications; enter into and perform loan agreements; disburse funds; collect repayments; issue statements, receipts, and notices. | Steps prior to entering into a contract; performance of a contract; legal obligation. |
| Verify identity, conduct e-KYC, assess eligibility and credit risk, prevent multiple or fraudulent applications, and maintain platform security. | Legal obligation; legitimate interests; explicit consent where required for biometric data. |
| Comply with anti-money laundering, counter-terrorism financing, accounting, tax, consumer protection, regulatory reporting, court orders, and lawful government requests. | Legal obligation; public interest where applicable. |
| Provide customer support, resolve complaints, manage disputes, send service messages, payment reminders, and important account notifications. | Performance of a contract; legitimate interests; legal obligation. |
| Operate, maintain, secure, troubleshoot, analyze, and improve the CashAI Services, including crash analysis and aggregated service analytics. | Legitimate interests; consent where required. |
| Send promotional communications and personalize offers. | Consent, or legitimate interests where permitted by law. You may opt out at any time. |
| Measure advertising performance or attribute installations and campaigns. | Consent where required, including Apple’s App Tracking Transparency permission where the activity constitutes tracking. |
| Establish, exercise, or defend legal claims; protect our rights, property, customers, employees, and the public. | Legitimate interests; legal obligation. |
5. Apple App Tracking Transparency and Advertising
CashAI may use analytics and attribution technologies to understand app performance and the effectiveness of marketing campaigns. If CashAI or a third-party partner seeks to track you across apps or websites owned by other companies, or seeks access to IDFA for that purpose, the iOS app will first request permission through Apple’s App Tracking Transparency (“ATT”) framework.
You may choose “Ask App Not to Track.” Refusing tracking permission will not prevent you from applying for or managing a loan and will not reduce the core functionality of CashAI. You can change your tracking choice in iOS Settings > Privacy & Security > Tracking.
CashAI does not sell personal data. We do not use sensitive financial, identity, biometric, or precise location data for third-party targeted advertising.
6. Device Permissions
Where applicable, CashAI may request the following iOS permissions. Each permission is requested at or near the time the related feature is used:
- Camera / Photos: to capture or upload identification documents, selfies, or supporting documents.
- Microphone: only where a voice, video, or customer support feature clearly requires audio.
- Location: for disclosed address verification, regulatory, security, or fraud prevention purposes.
- Calendar: to create repayment reminders at your request.
- Notifications: to deliver account, application, repayment, security, and optional marketing notifications.
- Tracking: only for activities that meet Apple’s definition of tracking.
You can revoke optional permissions in iOS Settings. Some features may not function without the permission directly required for that feature, but CashAI will not require unrelated permissions as a condition of accessing core services.
7. Cookies and Similar Technologies
CashAI websites may use strictly necessary, functional, analytics, and advertising cookies. Strictly necessary cookies support security and essential website functions. Analytics and advertising cookies are used only in accordance with applicable consent requirements. You can manage browser cookies through your browser settings or any cookie preference tool provided on our website.
8. Disclosure of Personal Data
We may disclose personal data only as necessary and subject to appropriate safeguards to:
- companies within our corporate group;
- cloud hosting, cybersecurity, analytics, crash reporting, communications, customer support, identity verification, biometric verification, payment, banking, credit assessment, fraud prevention, debt servicing, and professional advisory providers;
- advertising or attribution partners, but only for permitted purposes and subject to ATT or other consent requirements where applicable;
- credit bureaus, financial institutions, payment networks, regulators, courts, law enforcement agencies, tax authorities, the Anti-Money Laundering Office, the Bank of Thailand, and other authorities where required or permitted by law;
- potential or actual buyers, investors, successors, or advisers in connection with a merger, acquisition, restructuring, financing, or transfer of all or part of our business; and
- other parties where you direct us or give valid consent.
Our service providers may process personal data only under our instructions or for legally permitted purposes and are required to implement appropriate confidentiality and security measures.
9. Third-Party Software Development Kits
The CashAI app may include third-party software development kits (“SDKs”) or services for functions such as analytics, crash reporting, push notifications, campaign attribution, security, e-KYC, image processing, and customer support. We assess these providers and require their data handling to be consistent with this Privacy Policy, App Store privacy disclosures, applicable law, and contractual safeguards.
Data collected by CashAI or its third-party partners will be reflected, as applicable, in the App Privacy information displayed on the CashAI App Store product page. The exact providers may change as our technical infrastructure evolves; material changes affecting your rights will be disclosed through an updated policy or in-app notice.
10. International Transfers
Some service providers may store or process data outside Thailand. Where personal data is transferred internationally, we use safeguards required by applicable law, which may include contractual protections, security controls, transfer assessments, or other lawful transfer mechanisms. Regardless of processing location, we require an appropriate level of protection.
11. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including the duration of your account and loan relationship, and thereafter for periods required by financial, accounting, tax, anti-money laundering, consumer protection, limitation, regulatory, or other applicable laws.
When data is no longer required, we will securely delete, destroy, anonymize, or restrict it. Certain records may be retained after account deletion where required by law, necessary to complete an outstanding transaction, resolve disputes, prevent fraud, enforce agreements, or establish or defend legal claims.
12. Security
We use administrative, technical, and physical safeguards designed to protect personal data, including access controls, encryption in transit and where appropriate at rest, logging, security monitoring, vulnerability management, employee confidentiality obligations, and service-provider due diligence. No method of transmission or storage is completely secure; however, we continually review and improve our safeguards based on risk.
13. Your Privacy Rights and Choices
Subject to applicable law and relevant exceptions, you may have the right to:
- request access to and a copy of your personal data;
- request correction of inaccurate or incomplete data;
- request deletion, destruction, or anonymization;
- request restriction or suspension of processing;
- object to certain processing;
- request data portability where applicable;
- withdraw consent at any time, without affecting processing already lawfully carried out;
- opt out of direct marketing communications; and
- submit a complaint to the competent data protection authority.
We may need to verify your identity before completing a request. Certain rights may be limited where processing is required by law, necessary for an active loan or contract, needed to protect the rights of others, or otherwise exempt under applicable law.
14. Account Deletion
If you create a CashAI account, you may initiate account deletion from within the iOS app through the account, profile, privacy, or settings section. CashAI may ask you to verify your identity and may provide additional steps where necessary because CashAI operates in a regulated financial industry.
Account deletion is not merely temporary deactivation. Upon a valid deletion request, we will delete the account and associated personal data that we are not legally required or otherwise permitted to retain. Data relating to an active loan, unpaid balance, legal dispute, fraud investigation, or statutory recordkeeping requirement may be retained or restricted until the relevant obligation or retention period ends.
If the in-app deletion function is temporarily unavailable, you may submit a deletion request using the contact information in Section 18. This alternative does not replace the in-app initiation option required for the iOS app.
15. Marketing Choices
You may withdraw marketing consent or opt out of promotional messages through in-app settings, an unsubscribe mechanism in the communication, or by contacting us. You may still receive non-marketing messages necessary to manage your account, application, loan, repayment, security, or legal obligations.
16. Children’s Privacy
CashAI is not directed to children. We do not knowingly offer loan services to persons below the legally required age or knowingly collect their personal data for such services. Where we discover such collection, we will take appropriate action consistent with applicable law.
17. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in law, regulation, technology, our services, or our data practices. We will post the updated version and revise the “Last Updated” date. Where changes are material, we will provide additional notice through the app, website, email, push notification, or another appropriate channel, and obtain consent where required.
18. Contact Information
Data Controller / Service Operator:
Wellin Capital Co., Ltd.
Address:
141/16 Phrom Prasert Road, Ban Kluai Sub-district, Mueang Chai Nat District, Chai Nat Province, Thailand
Email:
support.th@cashaiservice.com
Telephone:
096-083-1166
This Privacy Policy is intended to describe CashAI’s actual data practices. The permissions, SDKs, App Store privacy answers, privacy manifest, in-app disclosures, and technical behavior of the submitted iOS build must remain consistent with this document.