Privacy Notice

This notice explains how TinTax collects, uses, shares and protects your personal data when you use our website, your account and our services (ITIN, EIN, US LLC and US tax returns). It follows Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

1. Who we are

TinTax (“we”) is operated by its owner, a sole proprietor in Thailand, who is the data controller of your personal data. For anything about your data, email [email protected] or message us on LINE (link on the Support page). Ask us for our postal address if you want to send a request by registered mail.

2. Information we collect

Depending on the service and your answers, we collect:

• Account details: your email and name, and your Google name and email if you sign in with Google.
• Your current legal name, date of birth, gender, and country of birth, and your full name at birth if different.
• Your mobile phone number, email address, and LINE contact.
• Your most recent U.S. entry date, your residential address, and a U.S. mailing address if you have one.
• Passport, U.S. visa, national ID, or driver's-license details and images.
• The purpose of your ITIN and any related tax documents; for EIN, US LLC and US tax-return services, the business and income details those forms ask for.
• Your payment slip and transaction details, and the bank details you give us to withdraw invite-a-friend rewards.
• Messages, reviews and community posts you send us.
• Technical data: IP address, device and browser, and sign-in and activity logs. This includes the devices you are signed in on (each with its IP address and a device label such as “Chrome on Windows”) and records of failed sign-in attempts.
• Records of your acceptance of our Service Agreement and of your reading this notice: which version, when, where on the site (for example sign-up or payment), the order it was for, your IP address and a device label.

Thai ID cards show your religion and sometimes your blood type, which the law treats as sensitive data, and a laser code on the back. We don't need them — please cover them before you upload. We do not ask for your consent to keep them: if they are visible on an image you send, we do not use them, and we ask you to send a copy with them covered to replace it.

3. Why we use it, and on what legal basis

• To prepare and file your application or service and keep you informed — needed for our contract with you (PDPA section 24(3)).
• To check payments and keep accounting and tax records — our contract and our legal duties (section 24(3) and (6)).
• To keep your account and our systems secure, prevent fraud, and keep activity and traffic logs — our legitimate interest (section 24(5)) and the Computer Crime Act (section 26).
• To keep proof of which version of our Service Agreement you accepted and which version of this notice you were shown — our contract and our legitimate interest (section 24(3) and (5)).
• To email you news and offers — only with your consent (section 19), which you can withdraw at any time.

The IRS requires the information marked as required. Without it we cannot prepare or file your application. We do not sell your data.

If you sign up through a TinTax partner's link (for example your accountant), you're told who the partner is when you sign up. That partner can see only your first name, the first letter of your last name, and the status of orders made through their link — never your contact details, form answers or documents. They may earn a commission from us on those orders.

4. Emails we send you

Emails about your own order — payment, documents, progress, IRS letters — are part of our service and are always sent. News, offers, renewal offers and review requests are sent only if you ticked the box when you signed up or turned them on in your account. Each has an unsubscribe link, and you can turn them off in your account at any time; we stop straight away.

5. Who receives your data, and transfers outside Thailand

We share data only as far as needed:

• The U.S. Internal Revenue Service (IRS, USA), to file your application.
• Couriers (for example FedEx, DHL, UPS, USPS or Thailand Post) for your document parcel.
• Our U.S. mailing address service (USA), which receives your IRS letters for us so we can scan them for you.
• Service providers that process data for us: Cloudflare (website security and delivery; worldwide), Zoho Mail (email; USA), Google (only if you sign in with Google; USA), SlipOK (payment-slip checks; Thailand — keeps a copy of the slip) and Omise/Opn (only if you pay by card).

Sending data to the USA and other countries is needed to perform our contract with you (PDPA section 28) or is covered by the provider's data-protection terms (section 29). Our team's instant alerts (Telegram) contain an order number only, never your personal details.

6. Storage & security

Your data and documents are stored encrypted on systems we control in Thailand, and our backups are encrypted too. Your application is only available when you are signed in to your account. Only our staff can open document images, after signing in with a password and a second step; every staff access to documents is recorded.

7. How long we keep it

• Your account, applications and documents: while your account is open, so we can help with IRS letters, corrections and renewals (an ITIN expires if it isn't used on a U.S. tax return for 3 years in a row). You can delete your account at any time.
• When you delete your account, we delete your form answers, documents, messages, saved devices and sign-in sessions straight away. Order and payment records are kept without your name for accounting and tax.
• Sign-in and activity logs, including IP address: 1 year. System logs: 2 years.
• Signed-in devices (with IP address and device label): while you stay signed in, and up to 30 days after you sign out or the sign-in ends.
• Records of failed sign-in attempts: about 2 days, stored as scrambled codes rather than your email or IP address, to stop password guessing.
• Records of your acceptance of the Service Agreement and of this notice: kept as proof for as long as your account exists. When you delete your account, we remove the IP address and device label and keep the rest under a scrambled tag instead of your name or email, as proof of what was agreed, while relevant and at least 2 years.
• Records of your consent and of privacy requests: kept as proof while relevant, and at least 2 years.
• Encrypted backups are replaced as new ones are made, so deleted data leaves them over time.

8. Your rights

You may ask to see or get a copy of your data, receive it in a machine-readable form, correct it, delete it, restrict or object to its use (including, at any time, for direct marketing), and withdraw your consent. Download your data or delete your account from “Your account & data” on your dashboard, or contact us by email, LINE, or registered mail (see section 1). We may check your identity first, and we reply within 30 days. It's free. You can also complain to the Office of the Personal Data Protection Committee (PDPC), www.pdpc.or.th.

9. If something goes wrong

If there is a breach of your personal data, we report it to the PDPC Office within 72 hours unless it is unlikely to put you at risk, and if the risk to you is high we tell you without delay, with what you should do.

10. Applicants under 20, and orders for family members or clients

If the applicant is under 20 and not married, a parent or legal guardian places the order and agrees on their behalf. A person under 20 who is legally married is of age under Thai law and agrees for themselves.

You can order for other people too, for example your family members or your clients. When you do, you give us their information, and you confirm that each applicant who is of age has given you permission to do so and has been shown this notice, and that you are the parent or legal guardian of any applicant under 20 who is not married. We record that confirmation: who, when, the IP address it came from, a device label such as “Chrome on Windows”, the language, and the exact wording you confirmed. For an applicant under 20, the applicant's form also asks whether they are married. If they are not, it collects the parent's or legal guardian's name and relationship to the applicant, their phone and email if you give them, and their consent, with who ticked it and when. We use all of this only to prepare and file the application and to keep proof of the consent, in the same way as described above. The applicant and their parent or guardian can contact us directly to use their rights (section 8).

11. Cookies & analytics

We only use cookies that are needed for the site to work, such as keeping you signed in and remembering an invite link. Cloudflare may set cookies needed for security. To count visits we use Cloudflare Web Analytics, which does not use cookies and does not identify you. Classroom videos are embedded from YouTube (Google), which receives your IP address when you play them.

12. Changes to this notice

This is version 5. If we make an important change, we email you before it takes effect. Versions that customers have read stay available on this site.

What changed in versions 4 and 5 (both in effect from 4 November 2026; until then version 3 applies): sections 2, 3 and 7 now also describe the devices you are signed in on, records of failed sign-in attempts, and the records we keep of your acceptance of our Service Agreement and of this notice. Section 2 no longer treats sensitive data left visible on a Thai ID card image as your consent, and section 3 no longer lists consent as a basis for it. Version 5 adds to section 10 what applies when you order for family members or clients.