In short: we collect only what you give us — your name, email, school, and message — so we can reply to enquiries, send resources you asked for, and improve the site. We never sell your data. You can ask us to delete it at any time by emailing privacy@learnnovation.ai.
1. Who we are
Learnnovation Co., Ltd. (“Learnnovation”, “we”, “us”) is the data controller for personal data collected through learnnovation.ai and its related services. We are registered in Bangkok, Thailand.
This policy applies to visitors to our website, people who contact us or download our resources, teachers and staff at partner schools, and parents or guardians who register for our platforms.
2. What we collect and why
| Data | Why we need it | Lawful basis |
|---|---|---|
| Name, email, phone | To reply to your enquiry and send resources you requested | Consent / contract |
| School or organisation, role | To tailor our reply and understand who our audience is | Legitimate interest |
| Message content | To answer your question | Consent |
| Newsletter subscription | To send the resources and updates you signed up for | Consent |
| Usage data (pages, device, approximate location) | To measure which content is useful and fix problems | Consent (analytics cookies) |
We do not knowingly collect personal data directly from children under 10 through this website. Where our learning platforms are used by students, accounts are created and managed by the school or by a parent or guardian who provides consent on the child’s behalf.
3. Who we share it with
We share data only with service providers who help us operate, under contracts that require them to protect it:
- HubSpot — forms, email, and customer records (servers in the EU/US)
- Google Analytics — anonymised website statistics
- YouTube — video hosting; embedded videos may set cookies when played
- Our hosting provider — website delivery and security
- Platform partners (e.g. Pastopia) — only where you have registered for their service through us
Some of these providers are located outside Thailand. Where data is transferred abroad, we rely on the provider’s standard contractual protections and on Section 28 of the PDPA. We never sell personal data or share it with advertisers.
4. Cookies
Cookies are small files stored on your device. We group ours into three categories, and you choose which to allow when you first visit — you can change your choice at any time using the “Cookie settings” link in the footer.
| Type | Purpose | Consent needed? |
|---|---|---|
| Necessary | Keep the site working — page delivery, security, remembering your cookie choice and language | No — always on |
| Analytics | Google Analytics: which pages are read, how visitors arrive, where they leave | Yes |
| Marketing | HubSpot and YouTube: recognise returning visitors, measure campaigns, embedded video | Yes |
5. How long we keep it
We keep enquiry and contact records for three years from your last interaction with us, newsletter subscriptions until you unsubscribe, and school contract records for ten years as required by Thai accounting and tax law. Website analytics are retained for 14 months. After these periods, data is deleted or irreversibly anonymised.
6. Your rights under the PDPA
Under the PDPA you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectify — correct data that is inaccurate or incomplete
- Erase — ask us to delete your data (“right to be forgotten”)
- Restrict or object — limit how we use your data, or object to a particular use
- Port — receive your data in a machine-readable format
- Withdraw consent — at any time, without affecting processing already carried out
- Complain — to the Personal Data Protection Committee (PDPC) of Thailand
To exercise any of these rights, email privacy@learnnovation.ai. We respond within 30 days. We may ask you to verify your identity first.
7. Security and changes
We protect your data with encrypted connections (HTTPS), access controls limiting staff access to those who need it, and regular reviews of our providers’ security. No system is perfectly secure — if a breach occurs that risks your rights, we will notify the PDPC within 72 hours and inform you where required.
If this policy changes materially, we will post the updated version here and, where the change affects how we use data you have already given us, notify you by email.