Privacy Policy

1. About this policy

This Privacy Policy explains how Loha ("Loha", "we", "us") collects, uses, stores, and protects personal data when you use the Loha CI/CD platform, our website, and related services (the "Service").

It is written to align with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). If you do not agree with this policy, please do not use the Service.

2. Who we are (Data Controller)

Loha is the data controller for personal data processed through the Service. Loha operates from Thailand and hosts all customer data within Thailand.

For privacy questions or to exercise your rights, contact our privacy team at privacy@loha.longtumlab.com. The registered operating entity and Data Protection Officer details will be published here before general availability.

3. Personal data we collect

Account data: your name, email address, and (if you sign in with a third-party provider) the identifier that provider returns to us.

Workspace and usage data: organizations and workspaces you create, repositories you connect, pipeline and build metadata, and audit records of actions taken in your account.

Technical data: IP address, browser/user-agent, and request logs generated when you use the Service. Build logs are produced by your pipelines; Loha applies automated secret redaction to build logs but you remain responsible for what your pipelines emit.

4. How we use your data and our lawful basis

To provide and operate the Service (performance of our contract with you): authentication, running pipelines, storing builds, and delivering features you request.

To secure and improve the Service (our legitimate interests): abuse prevention, rate limiting, audit logging, troubleshooting, and aggregate analytics.

To communicate with you (performance of contract and, where required, consent): service notices, security alerts, and (only where you have opted in) product updates.

To meet legal obligations: tax, accounting, and lawful requests from competent authorities.

5. Cookies

Loha uses only strictly-necessary and functional first-party cookies. We do not use advertising or third-party analytics/tracking cookies, so no consent banner is required.

better-auth.session_token: keeps you signed in (HttpOnly, secure in production). loha_csrf_token: protects against cross-site request forgery on state-changing requests (HttpOnly). NEXT_LOCALE: remembers your language preference.

Because these cookies are essential to operate the Service or remember a preference you set, they are exempt from prior-consent requirements. You can clear cookies in your browser at any time, though doing so will sign you out.

6. Where your data is stored (data residency)

All personal data, source code, build logs, artifacts, and audit logs are stored and processed entirely within Thailand. There is no offshore region and no routine transfer of data outside Thailand.

If this ever changes, we will update this policy and disclose any cross-border transfer and its safeguards before it takes effect, as required by the PDPA.

7. Sharing and sub-processors

We do not sell your personal data. We share it only with infrastructure and service providers that help us run the Service, all operating within Thailand, and only as needed to provide the Service.

Enterprise customers may request a Data Processing Agreement (DPA) and a current list of sub-processors by contacting privacy@loha.longtumlab.com.

8. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. Build logs are retained according to your plan's retention window and then deleted.

Audit logs and records we must keep for legal, tax, or security reasons are retained for the period required by law. When data is no longer needed, we delete or anonymize it.

9. Your rights under the PDPA

Subject to the PDPA, you may request access to your personal data, correction of inaccurate data, erasure, a portable copy, restriction of or objection to certain processing, and withdrawal of consent where processing is based on consent.

You can export or delete your account data directly from your account settings in the dashboard. For any other request, contact privacy@loha.longtumlab.com. You also have the right to lodge a complaint with the Personal Data Protection Committee.

10. Security

We protect data with encryption in transit and at rest, tenant isolation, role-based access control, audit logging, and automated build-log secret redaction. No system is perfectly secure, but we work to protect your data and to notify affected users and the authorities of a personal-data breach as required by the PDPA.

To report a security issue, see our security disclosure policy at /.well-known/security.txt.

11. Children

The Service is intended for organizations and professional users and is not directed to children. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, for material changes, take reasonable steps to notify you. The "Last updated" date shows the latest revision.

13. Contact

Questions about this policy or your personal data? Contact privacy@loha.longtumlab.com.