Privacy policy

The short version

• The server is read-only. The database role it runs under holds SELECT grants and nothing else, so it physically cannot alter the company database.
• There is no AI model inside this server. Your prompts and conversation stay in your own client; the server sees only the arguments of the specific tool call your client chose to make.
• We do not store the content of your queries, and we do not use anything you do here to train any model.
• We never sell personal data, and we run no advertising or third-party trackers on any page of this domain.

What we collect, and why

Account identity

Your name and email address, from the Max Data account you sign in with (OAuth) or that the API key was issued to. We need it to know whose credits to charge and to answer your support mail.

API keys

Only a one-way SHA-256 hash of the key is stored, alongside its first twelve characters so you can recognise it in a list. The key itself is shown once at issue and never written down by us; if you lose it, we cannot recover it, only replace it.

Usage records

For each call: the timestamp, the tool name, the credits charged, the size of the response in bytes, and a one-way hash of the call’s arguments. The hash exists only so that a network retry of the same call is recognised and not charged twice — it cannot be reversed into the arguments. This is an append-only billing and audit record: we correct it by adding rows, never by editing them.

Saved cohorts

When you build a company list with the cohort tool, the server stores the resulting Thai company registration numbers so a later call can refer back to them by handle. These expire automatically after 24 hours.

Server logs

Our hosting provider records standard HTTP access logs — IP address, timestamp, path, status code — and our error logs record failures with the tool name and the affected account id. Nothing in the service makes decisions about you based on your IP address; rate limits are counted per account.

Not collected: the text of your prompts, your conversation with the AI client, the SQL you pass to query_maxdata, or the arguments of any tool call in readable form. Cookies are not used anywhere on this domain; authentication is a bearer token in a request header.

The company data this service returns

Max Data holds records on registered Thai juristic persons, compiled from public registry filings and publicly available web sources. Most of it is information about companies rather than people — but some fields, in particular the names and board positions of directors and the business contact details published by a company, are personal data under Thailand’s PDPA and comparable laws.

We process that data on the basis of legitimate interest in providing business, credit and counterparty intelligence to professional users, and because the source records are published by the registrar or by the company itself. It is provided for business due diligence, market analysis and B2B contact, and not for any decision about a person in their private capacity.

If you are named in these records — as a director, for example — you may ask us for a copy of what we hold, ask us to correct it, or object to its processing. Write to nikolozk@maxsolutions.co.th. Where the record reflects a public registry filing, we may not be able to erase it, but we will correct what is inaccurate and record your objection.

Signals the tools label as red_flags are computed indicators for human review — late filings, negative equity, unusual board overlap. They are not findings of wrongdoing about any company or person.

Who else is involved

Both act as processors on our instructions, under their own data-processing terms, and neither is permitted to use the data for its own purposes. We disclose personal data to no one else, except where we are legally required to.

Your AI client is not ours. Anthropic, OpenAI, Google or whoever operates the client you connect from handles your conversation under their privacy policy, not this one. This policy begins at the moment a tool call reaches https://mcp.maxdatathailand.com/mcp.

How long we keep it

Security

• All traffic is over HTTPS; the endpoint refuses plain HTTP.
• API keys are stored only as SHA-256 hashes and can be revoked at any time.
• The company database is reached through a role with SELECT grants and read-only transactions — a defect in our code cannot turn into a write.
• Every query is parameterised, and the one raw-SQL tool is additionally bounded by a grammar gate, a row cap and a statement timeout.
• Credit balances cannot go negative, and every movement is written to the append-only ledger.

Your rights

Depending on where you are, you may have the right to access the personal data we hold about you, to have it corrected, to have it erased, to receive it in a portable form, to object to or restrict its processing, and to withdraw consent where consent is the basis we rely on. You may also complain to your data protection authority — in Thailand, the Office of the Personal Data Protection Committee.

To exercise any of these, write to nikolozk@maxsolutions.co.th. We will respond within 30 days. We may need to verify your identity before acting on a request.

Children

This is a professional business-intelligence service. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Changes

If this policy changes materially we will update the date at the top of this page and, where the change affects how we handle your data, notify account holders by email. This version is dated 21 September 2026.

Contact