Security & personal data

Where your data lives and what we can access

All business data, including the employee register, clock-in records, leave, overtime, payroll, payslips and reports, is written to your company's own Google Sheet and Google Drive. The system creates the files when you first connect Google and reads or writes them, on every use, through the permission the company owner granted.

Aim HR Expert's own database holds only identity and settings: user accounts, companies, members, roles and permissions, subscriptions and an activity log. There is no payroll, attendance or leave table on our servers.

What we do with data from LINE

From LINE we receive a userId, display name and profile picture (and an email address if you allow it). We use them to recognise who is signing in, link staff to their company, and deliver notifications such as payslips or approval results to that person's LINE.

We do not read your chat messages and we do not send advertising to your staff.

Encryption in transit and sessions

Every connection uses HTTPS, both between your browser or LINE and Aim HR Expert, and between Aim HR Expert and Google or LINE. Google access tokens are encrypted before storage, and no card numbers exist in our system (payments are handled by Stripe).

The sign-in session is a cookie that scripts in the browser cannot read. It lasts 7 days and is cleared when you sign out.

Deleting data when you cancel

After cancelling, the Google Sheet stays in your Drive because it was your file from the start. Keep using it, download it or delete it whenever you like, and revoke Aim HR Expert's access from your Google account page.

Identity data in our database (accounts, company, members, settings) is deleted within 30 days of a request to contact@aimexpensys.com, or automatically once an account has been inactive for more than 12 months, as stated in the privacy policy.

Data controller and data processor under PDPA

Your company is the data controller for its employees' personal data, because it decides what is collected and what it is used for, and the files live in your Drive. Aim HR Expert is the data processor, acting on your instructions through the system and never using employee data for any other purpose.

Every employee accepts the terms and privacy policy before first use, and can withdraw marketing consent on their profile page.

Report an issue or contact the data officer

Found a vulnerability, suspect a leak, or want to exercise your PDPA rights? Contact contact@aimexpensys.com or LINE OA @aimhrexpert. We reply within 3 business days.