AI Privacy Notice — LITALK Education

Last Updated: August 25, 2026 · Effective Date: August 25, 2026

1. Scope and legal status

This Notice supplements LITALK Education's general Privacy Policy and applies to Nong Lilly and other artificial intelligence-enabled chat or assistant features operated by LITALK Education through its public website, Ask services, Student Portal and authorised staff interfaces (collectively, the “AI Services”). Where LITALK Education determines the purposes and means of processing, LITALK Education acts as the data controller. This Notice shall be read together with the Privacy Policy and applicable AI Terms of Use.

2. Personal data processed

LITALK Education may collect, use, disclose, transfer or otherwise process personal data to the extent reasonably necessary for the purposes specified herein. Such data may include conversation content and AI responses; conversation identifiers and timestamps; service and technical metadata; randomly generated visitor identifiers; authenticated account or student identifiers; and records evidencing acceptance of applicable terms, including the accepted version, language and timestamp.

3. Purposes and lawful bases

Personal data may be processed for the provision and administration of the AI Services; responding to user requests; maintaining relevant conversational context; preventing, detecting and investigating misuse; enforcing service limits; protecting service security and integrity; troubleshooting; handling data-subject requests, complaints and disputes; quality assurance and improvement of LITALK's own services and educational materials; and compliance with applicable law. Depending upon the relevant circumstances, LITALK Education may rely upon performance of a contract or steps requested before entering into a contract, legitimate interests to the extent permitted by law and not overridden by the data subject's fundamental rights, compliance with legal obligations, or consent where required or otherwise appropriate under applicable law.

Acceptance of the AI Terms is legally distinct from consent under data-protection law and shall not, by itself, constitute consent to processing for which a separate valid consent is required.

4. Student Portal account context

Where reasonably necessary to answer a request made by an authenticated Student Portal user, LITALK Education may provide the AI service with a limited account context relevant to that request, which may include name or nickname, course, available learning credits, upcoming classes, most recent payment information and pending payment information. Technical and service-design measures are applied with the intention of limiting such context according to necessity and proportionality. The service is not designed to provide student files, online-meeting links or information concerning unrelated students as part of such context.

5. Conversation context

For conversational continuity, a limited number of recent messages from the same conversation may be transmitted to the AI provider together with the current request. LITALK Education limits historical conversation used for this purpose according to operational necessity and does not design the service to transmit the user's entire historical chat record with each request.

6. Service providers and recipients

Personal data may be disclosed or made available to service providers to the extent necessary for the purposes specified herein and subject to contractual, organisational and technical safeguards where required by law.

Google Gemini API: LITALK Education uses the Google Gemini API to process requests and generate AI responses. The current request, limited recent conversation context and relevant account context in certain Student Portal interactions may therefore be transmitted to Google. For the paid Gemini API service used by LITALK Education, Google states under the terms applicable to that service that API inputs and outputs are not used to improve Google's products or models unless the customer expressly elects to share such data for that purpose. LITALK Education does not voluntarily opt in to sharing user conversations with Google for model-training or model-improvement purposes unless data subjects are appropriately informed and a valid lawful basis exists before such processing.

Cloudflare: LITALK Education uses Cloudflare infrastructure, including Cloudflare Workers and Cloudflare D1, for operation of AI-related APIs, service and security controls, terms-acceptance records and storage of conversation records subject to the retention provisions below.

7. Authorised access

Authorised LITALK Education personnel may access AI conversation records only to the extent reasonably necessary and consistent with their responsibilities for service administration, troubleshooting, security or misuse investigations, handling data-subject requests, complaints or disputes, quality assurance, or legal and regulatory compliance. Such information shall not be used for purposes incompatible with those specified herein.

8. Visitor identifiers

For AI Services available without authentication, LITALK Education may generate and store a random visitor identifier on the user's device for usage controls, prevention and investigation of misuse, service security and administration of terms-acceptance status. Although not designed primarily to identify a user by name, LITALK Education will treat such information as personal data where it is capable of identifying or being linked to an individual directly or indirectly within the meaning of applicable law.

9. International transfers

Use of AI and infrastructure service providers may result in personal data being transferred to, stored in or otherwise processed outside Thailand. Where international-transfer provisions apply, LITALK Education will take steps intended to comply with Sections 28 and 29 of the Personal Data Protection Act B.E. 2562 (2019), applicable subordinate legislation and other applicable requirements, including reliance upon a lawful transfer mechanism or implementation of appropriate safeguards as the circumstances require.

10. Retention and disposal

AI chat messages are subject to a retention period of six months from the date on which each message is recorded, unless continued retention is reasonably necessary for the establishment, compliance, exercise or defence of legal claims, compliance with a legal obligation, investigation of security incidents or misuse, or another purpose permitted by applicable law. An automated retention process operates daily to identify and remove messages exceeding the applicable period. Deletion may be performed in batches for service reliability and operational reasons and, accordingly, a record may be removed during a subsequent processing cycle shortly after expiry of the stated period.

Records evidencing acceptance of the current AI Terms may be retained for so long as reasonably necessary to evidence acceptance, administer the Services, protect security, comply with legal obligations or resolve disputes. Records concerning superseded versions may be deleted in accordance with LITALK Education's applicable retention process. Where personal data is no longer necessary for a lawful purpose and no lawful basis requires or permits continued retention, appropriate steps will be taken to delete, destroy or anonymise such data.

11. Minors

Where consent is required for processing personal data relating to a minor, LITALK Education will seek consent in accordance with Section 20 of the PDPA and other applicable Thai law, including consent from a person exercising parental power where required. The existence of a minor data subject does not, of itself, mean that consent is the lawful basis for every processing activity.

12. Sensitive and unnecessary data

Users should not submit information unnecessary for use of the AI Services, including passwords, one-time passwords, complete payment-card or bank-account credentials, or sensitive personal data, unless expressly requested by an authorised LITALK feature for a lawful and necessary purpose. Information voluntarily entered into a chat may form part of the conversation record and be processed in accordance with this Notice.

13. Security

LITALK Education implements technical and organisational measures intended to provide a level of security appropriate to the nature and risks of processing. No method of transmission or storage can be guaranteed to be completely secure, and nothing herein constitutes an absolute guarantee against every security incident.

14. Data-subject rights

Subject to the conditions, exceptions and limitations prescribed by applicable law, data subjects may exercise rights of access, rectification, erasure or destruction, restriction, portability, objection and withdrawal of consent where applicable, and may lodge a complaint with the competent supervisory authority. Withdrawal does not affect processing lawfully undertaken before withdrawal and does not require cessation of processing supported by another lawful basis.

15. Amendments and contact

LITALK Education may amend this Notice to reflect changes in law, regulatory requirements, technology or the AI Services. Where a material amendment affects the manner of processing, notice will be provided by an appropriate means where required by law. Questions and data-subject requests may be submitted to support@litalkeducation.com; reasonable verification of identity or authority may be required before a request is acted upon.