Privacy policy

1. Who we are

MySportia is a brand of Education AI Group Co., Ltd. (บริษัท เอ็ดดูเคชั่น เอไอ กรุ๊ป จำกัด), a company registered in Thailand. The same booking and venue-management Platform is offered under two brands, MySportia and Exsportia, and this policy covers both. In this policy "we", "us" and "our" mean Education AI Group Co., Ltd., the only legal company behind MySportia and Exsportia.

• Controller: Education AI Group Co., Ltd.
• Company registration number: 0845568020186
• Registered office: 2/1 Moo 6, Tambon Bo Phut, Amphoe Koh Samui, Surat Thani 84320, Thailand
• Branch office: 9/493 Soi Lad Pla Khao 78, Khwaeng Anusawari, Khet Bang Khen, Bangkok
• Privacy contact: info@educationai.group

The Platform includes the websites, booking pages, back-office software, check-in app and mobile or web apps that carry the MySportia or Exsportia name, and our customer-support channels (together, the "Platform").

2. Our two roles

Under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") we act in two roles.

• We are the controller of your account and sign-in details, of the information we need to run, secure and support the Platform, of payment references, and of our own business and sales records. We decide why and how that data is used.
• We are the processor of the records a venue keeps about its own customers and members: bookings, memberships, attendance, notes, forms and waivers, and messages between the venue and its customers. The venue (a gym, studio, club, coach or other business, a "Venue") is the controller of those records, decides why they are used, and must give you its own privacy notice. We handle them only on the Venue's instructions.

If you ask us for something that concerns a record a Venue keeps, we pass your request to the Venue and help it answer (section 16).

3. What this policy covers

mysportia.com, vms.mysportia.com, the MySportia apps and back office, the check-in app, our booking pages and the support channels of MySportia. It applies to customers and players, parents and guardians, Venue owners and staff, coaches, website visitors, people who contact us, and people who book on behalf of someone else. It does not replace a Venue's own privacy notice for data the Venue controls.

4. Personal data we collect

Please do not give us sensitive personal data (health, biometric, religious, political or criminal-record information) unless a feature clearly asks for it. A Venue may ask for health or injury information in its own forms, and then the Venue is responsible for obtaining your consent. Where we process sensitive data for a Venue, we apply extra safeguards and rely on explicit consent.

5. Where we get personal data

From you; from the Venue you book with or work for; from another person who books or invites on your behalf, or a parent or guardian; from Google if you choose "Continue with Google"; from payment providers; from our technology providers; and automatically when you use the Platform.

6. Why we use personal data, and our legal grounds

7. AI features

MySportia includes AI features. They use AI model providers (section 10) and are described here so that you know what is sent to them.

• The back-office assistant helps Venue staff look things up and do routine work. What the staff member types or says, and the Venue records the assistant needs to answer (for example a booking or a customer's name), are sent to Anthropic, which provides the language model. If the voice features are switched on, voice audio goes to OpenAI for transcription and the text of spoken replies goes to ElevenLabs. Conversation history can be deleted by the user in the assistant, and it is removed when the account is deleted. Customers do not talk to this assistant.
• The Venue's messaging assistant (section 8.6): the customer's message and conversation, as described there, are sent to Anthropic to write a reply.

We do not use Venue Data, customers' messages or anything staff type to train models, and we do not permit our AI providers to. The providers process the data only to produce the answer. We send only what the question needs. AI output can be wrong: a Venue is responsible for what it switches on, and a person can always take over a conversation.

8. Messaging channels (WhatsApp, Messenger, Instagram, Telegram, LINE)

A Venue can connect its own WhatsApp Business account, Facebook Page, Instagram professional account, Telegram bot and LINE official account to MySportia, so that its team can read and answer customers' messages in one shared inbox (Messages). Channels are made available to Venues in stages. This section applies from the moment a Venue connects a channel, and to nothing before that. The practical steps to disconnect a channel or to ask for deletion are on our data deletion page.

8.1 Our roles

• The Venue is the controller of the messages it sends and receives through a channel, and of the customer details in them. It decides why they are used and must give its customers its own privacy notice.
• Education AI Group Co., Ltd. is the processor of those messages. We handle them only to run the inbox on the Venue's documented instructions.
• We are the controller of the details of the staff member who connects a channel (name, work email and, where a Venue authorises the connection by logging in with Meta, the technical identifier Meta gives our app for that person), and of the connection records we need to run the service securely (which account is connected, its status, when it was connected and disconnected, delivery and error records).

8.2 How a channel is connected

Only the owner of the Venue account can connect or disconnect a channel (Settings, then Channels). The Venue enters the credentials of its own account or app with the provider (for example a Meta app's access token and app secret, or a Telegram bot token), or authorises the connection through a login window of Meta, which shows what the app may do and lets the Venue choose which accounts to share. We check that the credentials work with a read-only request to the provider, and we set up delivery of notifications where the provider allows it.

8.3 What we receive and store

• Messages: the text of each message a customer sends to the Venue's account and each reply sent from it, with the time and, where the provider reports one, a delivery failure. Photos, videos, voice messages, files and stickers are not stored: they appear in the inbox as a short placeholder such as [photo], with the caption if there is one.
• Sender identifiers: the WhatsApp phone number; the Messenger page-scoped ID; the Instagram-scoped ID; the Telegram chat ID or LINE user ID; and the display name, username and language where the provider supplies them. A Venue's staff can link a conversation to a customer record; from then on later messages from that sender on that channel appear in that customer's thread.
• Connection data: the identifiers of the Venue's WhatsApp Business Account, phone number, Facebook Page, Instagram account, Telegram bot or LINE account; the access credentials (token and app secret); the connection's status; and when it was connected and disconnected.
• Technical records: delivery and error records, kept for security and fault-finding. We do not keep a copy of the provider's raw notification.

8.4 What we do not do

We do not sell this data. We do not use it for advertising. We do not use customers' messages to build profiles, for our own marketing, or to train or evaluate machine-learning models, and we do not permit our providers to. We do not read a Venue's messages except where the Venue asks us for support, where it is needed to keep the service secure, or where the law requires it. We do not message a Venue's customers on our own account through a channel: what goes out is written by the Venue's staff or, where the Venue has switched it on, by the Venue's messaging assistant.

8.5 Why we use it

To receive messages and show them in the Venue's shared inbox; to send the replies its staff write; to run the Venue's automated assistant if it switches one on; to keep the connection working and secure; to show delivery failures; and to meet our legal duties. For customers' messages the Venue's own legal basis applies (usually the customer's request or the contract with the Venue). For the connecting staff member's details and the connection records our basis is our contract with the Venue (section 24(3) PDPA) and our legitimate interest in security (section 24(5) PDPA).

8.6 The optional AI messaging assistant

A Venue can switch on an assistant that answers customers' messages for it. It is off until the Venue turns it on, the Venue sets its greeting, rules and what it may do, and it hands the conversation to a person when it should or when a person takes over. To write a reply, the customer's message, the recent messages of that conversation, the Venue's rules and FAQ, and, for a customer linked to a customer record, the booking information about that customer needed to answer are sent to our AI provider (Anthropic, section 10). The provider processes them only to produce the reply. The Venue is responsible for telling its customers that an automated assistant may reply.

8.7 What Meta and the other providers do

WhatsApp, Messenger and Instagram are services of Meta Platforms; Telegram and LINE are services of their own providers. Messages travel through the provider's systems, and the provider processes data on its own services under its own terms and privacy policy (for Meta: facebook.com/privacy/policy), as an independent controller of that processing. Meta's charges for WhatsApp messaging are made by Meta to the Venue, not through us.

8.8 Security

Access tokens, app secrets and other credentials are stored encrypted in a secret store (Google Cloud), are never shown to Venue staff, and are never returned to the browser after the Venue submits them. Notifications from Meta and LINE are checked against a cryptographic signature, and Telegram's against a secret, before we act on them. Messages are stored in the Venue's own area of the database and access is limited by role and venue, so that a Venue's staff see only that Venue's messages.

8.9 Retention and deletion

• Access credentials: deleted at once when the Venue disconnects the channel, and replaced (the old ones deleted) when it reconnects. If a provider stops accepting a credential, the connection shows that it needs attention and asks the Venue to reconnect; the credential stays until the Venue reconnects or disconnects.
• Messages and the contact records created from them: kept while the Venue's account is active, because they are the Venue's records, and deleted or anonymised when the Venue closes its account or instructs deletion, or when a person asks (8.10). The automatic deletion routines described on the data deletion page do not yet cover messages received through a channel or the contact records created from them. Until they do, we delete or anonymise them by hand: within 30 days after the grace period ends on a venue closure, and within 30 days of a request in other cases. We confirm in writing what was done.
• Technical records: the log periods in section 13.
• Kept: accounting entries (section 13) and a short record that a connection existed and was removed, because the law requires it or to keep the service secure.

8.10 Your rights, and how to have this data deleted

If you wrote to a Venue, ask the Venue first: it is the controller. You can also email info@educationai.group with "Data deletion" or "Privacy request" and the Venue, channel and dates involved. We pass the request to the Venue and, where we can lawfully delete as its processor, we do. We answer within 30 days. Section 16 describes your rights, and the data deletion page describes each route step by step. MySportia does not receive an automatic notice when you remove an app in Facebook or Instagram, so if you did and want us to delete what we hold, email us.

8.11 Transfers, children and cookies

Messages pass through the providers' systems, and our own hosting and sub-processors are outside Thailand: see section 11. Customers who message a Venue are normally adults; the Platform is not designed for messaging children directly, and we do not knowingly collect messages directly from children. A Venue that messages a minor must have the authority of the person with parental responsibility, as sections 19 and 20 of the PDPA require. Connecting a channel sets no cookie on any MySportia or Exsportia site.

9. Facebook, Meta and Google

You cannot sign in to MySportia with Facebook, and the MySportia apps and back office do not load the Meta (Facebook) Pixel or any Facebook plug-in. A Venue owner who connects a Meta messaging channel (section 8) may authorise it through Meta's own login window; that is the only place Meta's login appears. The Platform offers "Continue with Google": if you choose it, Google tells us your name, email address and profile picture, and Google handles your data under its own privacy policy. A Venue may link to its own Facebook or Instagram page; following that link takes you to Meta, which has its own policy.

10. When we share personal data, and our sub-processors

We do not sell personal data. We share it only where needed for the purposes above:

• with the Venue you book with or work for, so that it can run its service;
• with other participants only where a feature needs it (for example a team list or invitation), limited to basic details;
• with payment providers, banks and fraud-prevention services;
• with the providers in the table below, which process data for us under contract;
• with authorities, courts, insurers and advisers where the law requires or to protect rights and safety;
• with a buyer or successor of Education AI Group Co., Ltd. if the business is reorganised or sold, under confidentiality.

Our sub-processors

Venues get 30 days' notice by email or in the back office before we add or replace a provider that processes their data. Some providers are used only if a Venue switches the feature on.

11. International transfers

Our providers may process data in Thailand and in other countries, including the United States and Singapore. When personal data leaves Thailand we rely on the safeguards in section 28 of the PDPA: an adequate level of protection in the destination, contractual protections with the provider, your consent where appropriate, or another lawful mechanism.

12. Cookies and similar technologies

The MySportia apps use a small number of things stored in your browser: your sign-in session, your language choice, favourites and a booking you have started. These are necessary for the Platform to work. The payment providers (Opn Payments, Stripe, PayPal) load their own scripts on the payment step to take your payment securely and prevent fraud. We do not use advertising cookies in the MySportia apps. You can clear stored data in your browser settings; if you block the necessary items you may be signed out and some features may not work.

13. How long we keep personal data

When data is no longer needed we delete, anonymise or aggregate it. Copies may remain in our hosting providers' backups until they are overwritten in the normal cycle; we do not restore a deleted account's data from them.

14. Security

We use technical and organisational measures to protect personal data: access controls and role-based permissions, encrypted connections, secure service providers and monitoring. No online service is completely secure. If a personal-data breach occurs we investigate and act as the PDPA requires, including telling the Personal Data Protection Committee Office and the people affected where required.

15. Deleting your account and your data

You can delete your MySportia account yourself: sign in, open Account, then Delete my account. Deletion is immediate and cannot be undone. In short: your sign-in is removed; your profile is wiped; your future bookings are cancelled; your messages, notification settings and device registrations are deleted; and the personal details are removed from the records Venues hold that are linked to your account. Accounting records stay as described in section 13. The data deletion page lists exactly what is removed and what is kept, for customers, Venue owners and staff, and explains how to ask us by email.

16. Your rights under the PDPA

Subject to the law you may: withdraw consent; ask for access to and a copy of your data; ask us to correct it; ask us to delete, destroy or anonymise it; ask us to restrict its use; ask for it in a portable form; and object to processing based on legitimate interests or direct marketing. You may complain to the Personal Data Protection Committee Office of Thailand if you think your rights have been infringed.

Email info@educationai.group with "Privacy request" and tell us the account email or phone number and which Venue, if any, is involved. We may ask for information to confirm who you are. We reply within 30 days. If your request is about a record a Venue controls, we pass it to the Venue and help it respond.

17. Children and minors

Venues use the Platform for activities that include children. The Platform is not meant for a child under 13 to use alone: a parent or guardian should make the bookings and create the account. Where the law requires a parent's or guardian's consent for a minor's data, we ask for it, and a Venue that collects a child's data is responsible for having it.

18. Language

This policy is published in English and Thai. If they differ, the English text applies, except that a Thai text that gives you more protection under the PDPA prevails to that extent.

19. Changes to this policy

We update this page when our services, providers or the law change, and change the date at the top. For material changes we also tell users in the Platform or by email.

20. Contact us

Education AI Group Co., Ltd., 2/1 Moo 6, Tambon Bo Phut, Amphoe Koh Samui, Surat Thani 84320, Thailand. Branch office: 9/493 Soi Lad Pla Khao 78, Khwaeng Anusawari, Khet Bang Khen, Bangkok. Company registration number 0845568020186. Email info@educationai.group.

Read this together with the MySportia Terms.