Privacy

Who operates this site

PromptHR, operated by Uphasia Artificial Intelligence Co., Ltd. A Data Protection Officer has not yet been formally appointed, so no DPO is named here. Contact details for data subject requests will be published once they are confirmed.

Usage measurement, only if you accept

If you accept cookies, we record which sections of a page are shown to you and which you interact with. Each recorded line holds a schema version, the time in UTC, the site name, a random identifier for your visit, the event name, the section identifier, and the page path with any query string and anchor removed.

We do not store your IP address, your browser user agent, or your email in these records. Our server does receive your IP address with every request, as any web server does, and the measurement pipeline discards it rather than never seeing it.

Raw lines are kept for 90 days and then deleted. After that only daily totals per section and per page remain, with no visit identifiers. The data stays on Uphasia's own server and is not sent to any third party. It is viewed on an internal dashboard behind company sign-in.

If you decline, nothing is recorded. No identifier is created and no line is written.

Server logs

Independently of your cookie choice, our web server keeps a standard access log of every request. It records the time, your IP address, the host and request path, the response status, your browser user agent and client hint headers, your Accept-Language header, the referring page, and the TLS version and cipher.

These logs are kept for about 14 days. The draft legal basis is legitimate interest under section 24(5) of the PDPA, for operating, securing and debugging the service and preventing abuse. This basis is pending legal review.

Where your data is processed

This site runs on a single server hosted with Amazon Web Services in the ap-southeast-1 region, which is Singapore. No content delivery network sits in front of it. That means your data is processed outside Thailand, which is a cross-border transfer under the PDPA.

Separately, the interview product uses external processors: Supabase for its database, and an OpenAI-compatible provider for speech and language processing. Those transfers are documented in our internal compliance record and are pending Data Protection Officer review before production use with real candidate data.

Your rights

Under the PDPA you may request access to, correction of, or deletion of your personal data, request portability, and object to processing. Once contact details are confirmed they will be published here so you can exercise those rights.