Privacy

When you send an enquiry

We receive what you type into the form: your name, your business name, the email address or phone number you choose to give, the products you selected, what you want to improve, and anything optional you add. That includes the summary from the Solution Finder, or from an example you opened, and the business type shown with it, if you leave them in the form.

We need one way to reach you, an email address or a phone number, to reply; without one we cannot answer.

We use it to reply to you and to work out a scope and proposal. Sending an enquiry does not add you to a mailing list.

Your selected services are included alongside products. The enquiry can also include the public page where you arrived, a referring website's hostname and limited campaign labels. Full referrer URLs and arbitrary query parameters are not included. This helps us understand which information brought a suitable enquiry.

The enquiry is first saved in the website's own database, which Cloudflare hosts for us, and then copied to a spreadsheet in O2's Google Workspace account, normally within seconds. Once the copy is confirmed, the enquiry is erased from the website's database; only its reference and the time stay there for two weeks, so that sending the same form twice does not create two enquiries. The team gets an email saying a new enquiry has arrived; that email does not contain your details. Nothing is sent until you press Send enquiry.

When you use O2 AI Adviser

What you write to the adviser is sent to our server and passed to an open-source AI model that Cloudflare, our hosting provider, runs for us (Workers AI), so that it can be answered. Cloudflare states that it does not use this content to train AI models.

Unlike the guided finder, the adviser keeps a working session, so that you can come back to it, correct it and carry on. Your messages, its answers, the brief built from them and any sample built for you from them are stored in the website's database, which Cloudflare hosts for us. They are erased 24 hours after the session starts. You can erase them at any moment with Delete session data on the adviser's page.

The session is not tied to your name. The adviser does not ask who you are or how to reach you, and nothing in a session reaches the O2 team. If you press Discuss this brief with O2, the contact form is filled in with the brief for you to read and change; only what you then send is sent.

If you press Build a sample for my business, the same AI fills in one of our working systems with the name of your business, what kind of business it is and a few things you sell or offer, taken from what you wrote. Everything else in the sample is invented sample data. What you enter inside it, such as a sample booking, stays in that page of your browser and is gone when you reset it or leave. It is not sent to us.

When the adviser is not available, its page offers a guided finder that works from fixed rules and says so. What you type there is sent to our server to work out a recommendation and is not saved.

Please do not put customer records, passwords or anything confidential into either.

When you run a website audit

Our server reads the public website you name: its robots.txt, its home page, up to seven more pages and a small sample of its links. It says who it is (O2WebsiteAudit), follows the site's robots.txt, and only reads: it submits no form, signs in to nothing and opens nothing that needs an account.

The address of the home page is also sent to Google's PageSpeed Insights service, which loads the page to measure how it loads on a phone. No AI model reads the pages: every finding is a measurement made by our own code.

The report and its evidence (facts and short excerpts taken from the pages, and that one screenshot) are stored with your session in the website's database and erased after 24 hours, or at once when you press Delete this audit and its data. The audit asks for no contact details. A report you download is a file on your own device, which we cannot take back.

When you use O2 Engine

What you write about your business, each change you ask it for and each change you save is sent to our server and to AI models that Cloudflare, the company that hosts this website, runs for us (Workers AI). We choose a model for each step: to check that it is a business O2 serves, to study the brand, to design and write your website, and to change it as you ask. Descriptions of its pictures, which those models write, go to an image model that Cloudflare also runs for us, which draws them.

Your draft (its words, its design, its pictures, its language, the brand study, what you first wrote and each change you asked for) is kept in the website's database, which Cloudflare hosts for us, with a key that only your browser holds. It is erased after 7 days. It is not tied to your name, and O2 looks at a draft only if it is reported to us or the law requires it.

For each request to O2 Engine our server records the time, what was done (built, changed, saved, refused or reported) and the network (IP) address it came from, and keeps that record for 90 days, as Thailand's Computer-Related Crime Act asks of a service provider. It is not used for anything else.

If you share a demo link of your draft, anyone who has the link can open the draft as it was last saved, without signing in. It is not offered to search engines, and it stops working when the draft is erased, when you stop sharing it or make a new link, and in any case 7 days after it was made. Each time a page of it is opened we record the time and the network (IP) address it came from, and keep that record for 90 days, as above.

If you report a site, we keep what you write and, if you give it, how to reach you, and for a formal complaint your name and address, to review the report, act on it and answer you; a report is erased one year after it was made.

Signing in and publishing a site are not open yet. Before they open, this notice will say what they keep.

Please do not put customer records, passwords or anything confidential into it.

Website measurement

Where first-party measurement is enabled, our server records public page paths and a limited set of actions, such as opening a product or starting the contact form. These usage records do not include your form text, name, email, phone number or a visitor identifier. The measurement database does not store IP addresses. Our hosting provider still processes technical request data to deliver and protect the site.

After an enquiry is successfully stored, a separate measurement record may retain its receipt reference, selected product/service IDs and limited acquisition context, without the personal message or contact details. We use the reference to compare enquiry sources with the team's later assessment. A click or fictional example order is never recorded as a completed enquiry.

Measurement reports cover the last 30 days; older measurement records are erased when the collector or reporting tool next runs. Browser usage events and acquisition storage are disabled when your browser sends Do Not Track or Global Privacy Control. Enquiry storage and receipt records still operate so that your request can be delivered reliably. Cloudflare's traffic analytics is separate from these first-party records.

What stays in your browser

The products you save to your shortlist, and your choice of light or dark mode, are remembered on your device so they are still there on the next page. Drafts of the finder and the contact form are kept for the current browser session and cleared when you send the form. This site does not set advertising or analytics cookies.

When browser measurement is allowed, the first and most recent arrival source are remembered in session storage for this tab. Only known public page paths, limited campaign labels and an external hostname are kept. Ordinary navigation between our pages does not replace the original source.

If you send a message to the adviser or start a website audit, the site sets one cookie, named o2ai. It tells our server which working session is yours, page scripts cannot read it, it is sent to this site's own functions and to nothing else, and it is not used to follow you. It expires with the session, and Delete session data removes it. A message you have started typing is kept for the current browser session.

If you use O2 Engine, the keys to your drafts and the language you chose for its page are remembered in this browser, so that a draft opens again here.

The examples on this site are fictional businesses with sample data. What you do inside one, such as a sample order, a sample booking or details you type into its forms, is kept in that browser tab only, so the example can show it back to you. It is never sent to us or to anyone else, and it is gone when you close the tab. The kind of business you choose while looking at examples is remembered for the tab in the same way.

If you press Discuss this setup in an example, the contact form is told which example and which product you were looking at. Nothing you typed or chose inside the example goes with it, and nothing reaches us until you send the form.

If you are a client

When you become a client we also keep what a project needs: the names and contact details of the people we work with, the service order you accept, invoices, payments and tax documents, any evidence of who the client is that our Terms allow us to ask for, and the access you give us. We ask for no more than the work needs, and keep these records for the engagement and afterwards for as long as accounting, tax and legal records must be kept.

On the websites and systems O2 builds and runs for a client, the client decides what its own customers' personal data is collected for: the client is the data controller, and O2 processes that data for it, on its instructions. The client's own privacy notice applies there.

Why we may use it

• An enquiry, our replies and a client's project: to take the steps you ask for before a contract, and to carry out the contract (Personal Data Protection Act B.E. 2562, section 24(3)).
• O2 AI Adviser, the website audit and O2 Engine's drafts, which you start yourself, and measuring how the site is used without identifying you: our legitimate interest in answering you, showing what we could build and improving the site (section 24(5)).
• The record of requests O2 Engine keeps for 90 days, tax records, and answering an authority entitled to information: a legal obligation (section 24(6)).
• Reviewing reports and keeping the websites we run lawful: our legitimate interest and our legal obligations (sections 24(5) and 24(6)).
• Where we rely on a consent you gave, you may withdraw it at any time; what was done before stays lawful.

Who processes it for us

• Cloudflare hosts the site, runs its server functions and holds the database where an enquiry waits until it has been copied to our spreadsheet. Like any host, it also handles technical data such as your IP address to deliver and protect the site.
• Google provides the spreadsheet and email we use for enquiries.
• Cloudflare also runs the open-source AI model behind the adviser (Workers AI), and its database holds your working session until it is erased.
• Google's PageSpeed Insights loads and measures the home page of a website you ask us to audit.

Outside Thailand, and authorities

Cloudflare and Google run their services from data centres in many countries, so personal data sent to them may be processed outside Thailand, including in the United States, under the data-protection terms of their agreements with us.

We give information to the police or another authority only when the law entitles them to it.

How long we keep it, and your choices

We keep an enquiry for five business days. After that it is deleted from the spreadsheet automatically. If we are in conversation by then, our messages with you remain, like any other correspondence.

Cloudflare keeps a recovery history of the website's database for up to 30 days. We use it only to restore the service after a fault. If an enquiry could not be copied to the spreadsheet within ten days, it is erased from the database.

A working session with the adviser or the audit, and everything in it, is erased 24 hours after it starts, or at once when you delete it. Deleting removes it from the live database; Cloudflare's recovery history of that database, which we use only to restore the service after a fault, can hold a copy for up to 30 days.

For 30 days we keep a small record of each run of these tools: what kind it was, how long it took, whether it worked, which version of our rules it used and, if it failed, the kind of failure. It holds none of what you wrote, no address you audited and no contact detail.

You have the rights the Personal Data Protection Act B.E. 2562 gives you: to see what we hold and get a copy, and to ask how we got it; to receive it in a form you can take elsewhere; to object to its use; to have it deleted, or its use restricted; to have it corrected; and to withdraw a consent you gave. Email us and we answer within 30 days. You may also complain to the Personal Data Protection Committee (PDPC).

Contact

The controller of this information is O2 Design Studio Co., Ltd. (บริษัท โอ2 ดีไซน์ สตูดิโอ จำกัด), company registration 0105569169261, 12 Soi Krungthep Kreetha 20, Yaek 10, Thap Chang, Saphan Sung, Bangkok, Thailand. For anything about your information, email admin@o2-designstudio.com. Other ways to reach us

Last updated 20 October 2026.