Privacy Policy

5Lab Group Co., Ltd. (“5Lab”, “we”) builds and operates ApolloSuite: Apollo CMS, a content management system; Apollo CIP, an omni-channel customer conversation platform; and Apollo Commerce, a commerce layer built for the Thai market.

We operate under Thailand's Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). Where a customer or an end user sits in another jurisdiction, we apply equivalent data protection principles to the extent that law requires.

This policy covers visitors to apollo.5lab.co, users of the ApolloSuite admin and of the Apollo Work mobile app, and anyone who contacts us directly. If your organisation has signed a separate agreement with us, that agreement applies alongside this policy, and it prevails where the two conflict.

The distinction matters, because it decides who makes the decisions about the data and who you should approach to exercise your rights.

• As data controller — for website visitors, demo requests, sales enquiries, and the administrator accounts we issue to customers. We determine the purposes and means of that processing.
• As data processor — for data our customers bring into ApolloSuite: conversations with their end customers, contact records, orders, and content in the CMS. The customer is the controller; we process only on their instructions.

If you are an end user who messaged a business that runs on ApolloSuite, send your request to that business first — they are your controller. We support our customers in responding to those requests.

• When you visit our website.
• When you email us, request a demo, or ask about pricing.
• When you sign in to the ApolloSuite admin with an account issued to you.
• When your organisation connects a messaging channel, a payment provider, or another external service to ApolloSuite.
• When you submit a form or a page built with a customer's Apollo CMS.
• When you use the Apollo Work mobile app (see section 14).

• Identity and contact data — name, email address, phone number, organisation, and job title.
• Account and authentication data — username, hashed password, two-factor enrolment status, last sign-in time, and an audit trail of actions taken in the system.
• Usage and technical data — IP address, browser type and version, pages viewed, and request timestamps.
• Conversation content — messages, attachments, and contact details flowing through the channels a customer has connected, which we process as a processor.
• Order and payment data — line items, delivery addresses, and payment slips uploaded by buyers. We do not store full card numbers; card acceptance is handled by the payment provider the customer chooses.
• Data from connected services — access tokens and account identifiers for channels a customer has authorised, held only to send and receive messages on their behalf.

ApolloSuite is not designed to hold sensitive personal data under section 26 of the PDPA — health, religion, criminal records and the like. Where a customer chooses to put such data into the system, it is the customer's responsibility to establish a valid legal basis for it.

Our marketing site uses strictly necessary cookies only. The ApolloSuite admin uses cookies to keep you signed in and to protect against cross-site request forgery. These cannot be disabled without breaking the product.

If we later add analytics or marketing cookies, we will ask for your consent before setting them and update this page accordingly.

• To provide the service — deliver, maintain, and support ApolloSuite (contractual necessity).
• To keep the system secure — detect abuse, apply rate limits, and maintain audit logs (legitimate interest).
• To communicate — answer questions, announce service changes, and send what you asked for (contract and consent).
• To improve the product — analyse usage patterns in aggregate, without reading customer conversation content (legitimate interest).
• To comply with the law — issue tax invoices, retain accounting records, and respond to lawful orders (legal obligation).

Thailand's Personal Data Protection Act B.E. 2562 (2019) recognises seven legal bases for processing personal data: consent under section 19, and the six exceptions in section 24. The table shows which of them we rely on.

We do not sell personal data.

ApolloSuite includes model-powered drafting, thread summaries, Gather transcription, and review sentiment analysis. These send relevant text, and microphone audio from transcription-enabled Gather calls whose participants consent, to model providers through the OpenRouter gateway. Downstream providers depend on the organisation's configured model, such as Google or OpenAI.

• Data is sent when a user invokes the feature. In transcription-enabled Gather calls, microphone audio is processed during consented participation. The database is not shipped out wholesale.
• Audio for transcription is temporarily spooled in short chunks on our server; each chunk is deleted after successful processing. Failed chunks may remain for retries. Transcripts, summaries, and Gather chat remain available to authorised channel members under the organisation's retention policy; ending a Gather call does not immediately erase them.
• Camera and shared-screen images are not sent to Gather transcription AI. Muting or leaving stops your microphone transmission but does not erase text already processed.
• Model output is a suggestion, not a decision. Sending a message to an end customer still passes through a human, according to the customer's configuration.
• The model providers behind the gateway may sit outside Thailand. See the section on international transfers.

We disclose personal data only as far as necessary, and only to the following.

• Sub-processors that provide our infrastructure. The full list is on our sub-processors page.
• External services a customer chooses to connect, such as messaging channels and payment providers, which are governed by their own policies.
• Professional advisers such as auditors and lawyers, under confidentiality obligations.
• Government authorities or courts, on a lawful order.
• A counterparty in a merger or business transfer, with reasonable prior notice.

ApolloSuite's primary infrastructure runs in Google Cloud's South-East Asia region (Singapore). The content delivery network and the language model services we use operate globally, so some processing may occur outside Thailand.

Where data leaves the Kingdom, we rely on the safeguards set out in sections 28 and 29 of the PDPA: contractual terms with the provider, and keeping the data sent abroad to the minimum the feature requires.

• Customer account data — kept for the life of the agreement, then deleted or returned within the period agreed on termination.
• Audit and security logs — kept as long as needed to investigate incidents and to meet legal obligations.
• Accounting and tax records — kept for the period Thai law requires.
• Sales contact data — kept until you ask us to delete it, or until it no longer serves a business purpose.

After those periods we delete the data or render it non-identifiable.

• TLS on connections between users and the system, and between the system and its database.
• Passwords stored with a one-way hash, with two-factor authentication available.
• Role-based access control, with data scoped per organisation on shared deployments.
• Key-based server access, with public traffic filtered at a defined network layer.
• Audit logging of significant actions so that changes can be traced after the fact.

No system is perfectly secure. In the event of a personal data breach likely to affect the rights and freedoms of individuals, we will notify Thailand's Personal Data Protection Committee within 72 hours where feasible, and affected customers without undue delay.

Under the PDPA you have the following rights, exercisable by contacting us at the address in the final section.

• Access your personal data and obtain a copy of it.
• Have inaccurate or out-of-date data corrected.
• Have data erased or destroyed when it is no longer necessary for the purpose.
• Have processing suspended.
• Object to processing in certain circumstances.
• Have your data ported to another controller in a machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out lawfully.
• Lodge a complaint with the Office of the Personal Data Protection Committee.

We respond within 30 days of receiving a complete request. If we need longer, we will tell you why.

ApolloSuite is a tool for organisations and is not directed at minors. We do not knowingly collect data from minors, and we delete such data if we find it has been collected without valid consent.

The Apollo Work app for iOS and Android gives members of an organisation that uses ApolloSuite access to its conversations, projects, and files. Everything in this policy applies to the app; this section covers only what the app adds. For the conversations, projects, and files you see in the app, your organisation is the controller and we are its processor (section 2). For signing in, notifications, and app updates, we are the controller.

• Signing in — you sign in with a one-time code sent to your email address. The app keeps the resulting session token in the device's secure storage (the iOS Keychain or the Android Keystore).
• Notifications — if you allow them, the app registers a push token, a random installation identifier, and your device's name, platform, and app version so that we can deliver notifications to you. They are delivered through Apple Push Notification service and Google Firebase Cloud Messaging, and a notification may contain a short preview of a message. Push tokens are deleted when you sign out, or when Apple or Google report them as no longer valid.
• App updates — the app downloads updates from Expo (650 Industries, Inc.), which receives the technical details of the request, such as IP address, platform, and app version.
• On your device — recent conversations and projects are cached on the device so you can read them offline. Signing out deletes the cache and the session token.
• Camera and photos — the app asks for access when you choose an attachment or enable your camera in Gather. Selected attachments are uploaded; Gather camera video is transmitted live to participants through our media server.
• Microphone — Gather calls start muted. You choose to grant permission and unmute to send live audio to participants. In an AI transcription-enabled room, you must consent before joining and the transcription state is displayed. See section 7 for processing and retention.
• Screen sharing — capture starts only after you request sharing and confirm the operating system's prompt. Visible content, including other apps or notifications, may be transmitted live to Gather participants. Shared-screen images are not recorded for AI transcription. Sharing does not automatically enable your microphone or transmit device audio. You can stop in the app or with the system control.
• Calls and background operation — on iOS, CallKit and VoIP notifications present and control Gather calls through the system call interface. A call or screen share you start may continue when switching apps and stops when you leave the Gather call.

The app does not collect your location or contacts, uses no advertising identifier, contains no analytics or advertising SDKs, and does not track you across other companies' apps or websites.

Deleting your account — your account is created and managed by your organisation. “Delete account” in the app opens a pre-filled email request to hello@5lab.co; you can also write to us directly. We act on it together with your organisation within the 30 days set out in section 12. Your other rights, and how long data is kept, are as described in sections 12 and 10.

We may update this policy as the service or the law changes. The effective date above always identifies the current version. For material changes we give active customers reasonable notice by email or by a notice in the admin.

For questions about this policy, or to exercise your rights as a data subject, contact: