นโยบายความเป็นส่วนตัว

Privacy Policy (English)

Last updated 12/11/2026 · applies to mail.erpna.com and mail.ok-order.com

What we access. Accounts of this system (username, display name, profile picture, a hashed password, and the IP address and browser used to sign in, for security). Mail sent to the shop's addresses, in full with attachments. When a user connects Gmail with Google (gmail.readonly, read-only): the account's email address and the messages that match the account's settings (by default all mail except sent mail, one year back), with attachments. When a user connects Google Drive (drive.readonly, read-only): the account's email address and the names and contents of only the folders or files the user picks; Google Sheets are kept as .xlsx files and as table values. For other mailboxes (IMAP): the password the user enters, used only to read mail. When a user chooses to sign in with Google (openid, email): the Google account ID and email address, used only to match the user of this system; the PIN and the authenticator secret (if turned on) are stored hashed or encrypted. PDF passwords (sender + password) a user saves in PDF Settings, or types to open a PDF (kept automatically), are stored encrypted and used only to open PDFs for that same user and, for the boxes that user owns, to let the system sort documents. When such a statement is passed to the shop's own bank-statement system, the copy opened with that password is sent (the password itself is not). The system reads the first two pages of received PDFs on the shop's own server (no AI, nothing sent anywhere) to guess whether each is a bank statement, a credit card statement, an expense or something else; only the guess and the generic words that decided it are kept, never the text. A user's own choice in PDF Settings always comes first.

How we use it. To show and search the mail and files, and to file document data (amounts, dates, vendors) into the shop's accounting and sales system. The shop's administrators may use tools, including AI assistants, to read or analyse the data for the shop's work only. The in-app AI assistant searches and reads only the asking user's own mailboxes / Drive copies whose switch for that engine is on: AI Local runs on the shop's own machine and nothing leaves the shop, and is on by default (the box owner can switch it off); with Claude (Anthropic) the content the AI opens to answer is sent to Anthropic for processing, and it is off until the box owner switches it on. A box with an engine's switch off is invisible to that engine. Pictures or files a user attaches in the chat are read by the engine chosen at that moment (Claude = sent to Anthropic) and kept on the shop's server with the chat. Chats are kept on the shop's server as topics; the AI sees only the topic being discussed, and in a long topic the same engine summarises the earlier part as that topic's memory. We do not sell the data or use it for advertising. The system is read-only: it never sends, changes, moves, deletes or marks anything in a user's mailbox or Drive (stars, important and junk marks stay inside this system).

Who can see it. The owner of the connected account, users with a higher role in this system (moderator, admin, superadmin), and people a box is shared with. The shop's administrators decide who sees the shop's shared boxes.

Storage and security. Data is kept on the shop's own server and travels over HTTPS. The system never sees or stores Google passwords: users sign in on Google's own page, and only the token Google issues is stored. Google tokens IMAP passwords and saved PDF passwords are stored encrypted. Copies already fetched are kept as the shop's document records.

Revoking and deletion. Access can be revoked at any time at myaccount.google.com/permissions or by turning off sync in the account settings of this system; after that no new data can be fetched. To have copies already fetched deleted, contact the shop's administrator.

Contact. The shop's administrator, or the support email Google shows when you click the app name on the consent screen. If this policy changes, the “last updated” date above changes with it.