Privacy Policy
Last updated: 3 November 2026
In short
- Currently every tool (including OCR) runs in your browser. Your files are not uploaded anywhere.
- There are no accounts or payments yet; the sections about them apply once they launch.
- The site is served through Cloudflare, which logs technical data (such as IP addresses) for security.
- We don’t use analytics. Advertising cookies are only used if you allow them.
- We do not sell your personal data.
- This English version is a translation. If it differs from the Thai version, the Thai version prevails.
1. Data controller
The data controller for NextFileTools is CookieCutter, based in Thailand. Contact us about personal data at [email protected].
We have not appointed a Data Protection Officer (DPO), as we do not meet the conditions of section 41 of the PDPA. We have not appointed an EU or UK representative. You can reach us about personal data at the email above.
2. Files you use with the tools
Every current tool (including OCR, document scanning and PDF to Word) processes your files and text on your own device. They are not sent to our servers, so we never see or store them. We don’t show ads in tools that display the contents of your files, so that no third-party scripts run on the same page as your files.
No tool currently sends your files to a server for processing. If we ever offer such a tool, we will say so clearly on that tool’s page before you choose a file, and update this policy with the retention period and the providers involved before it goes live.
3. Data we collect
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Technical data such as IP address, browser type and time of access, logged by Cloudflare as our hosting provider | Security; preventing attacks and abuse | Legitimate interests (PDPA s.24(5); GDPR Art. 6(1)(f)) | As set by Cloudflare. We do not download or keep these logs ourselves. |
| Google AdSense advertising cookies (only if you allow them) | Showing ads to keep the tools free | Consent (PDPA s.19; GDPR Art. 6(1)(a)) | Cookie lifetime (see our Cookie Policy) |
| Sender name, bank, amount and time shown in our bank statement when you send a “buy us a coffee” tip, and any transfer slip you send us | Bookkeeping; refunding duplicate or mistaken transfers | Legal obligation and legitimate interests | As required by accounting and tax law |
| Emails you send us | Answering questions; handling rights requests | Legitimate interests | Up to 2 years after the matter is closed |
We currently use no analytics tools (such as Google Analytics) and have no accounts or payments. If we start, we will add the data collected, the purpose, legal basis and retention to this policy and ask for consent or inform you before collecting anything.
Settings the site needs to work, such as the light/dark theme, your language choice and your cookie choice, are stored in your own browser (localStorage) and are not sent to us.
4. Payments
There are no payments on the website yet. A PromptPay QR tip is a transfer made directly from your banking app; the website receives nothing from the scan, but we see the sender details in our bank statement as usual. We will update this section before payments launch.
5. Who we may share data with
- Cloudflare, Inc. (website hosting and attack protection), which processes data on our behalf under Cloudflare’s data processing terms
- Google (AdSense), only if you consent to advertising cookies. Google is an independent controller for data it collects through its own cookies, under Google’s privacy policy.
- The email provider we use to receive and answer messages
- Government authorities, where required by law or court order
We do not sell, rent or trade your personal data.
6. International transfers
Our providers (Cloudflare, Google if you consent to advertising cookies, and our email provider) may store or process data on servers outside Thailand and outside your country, for example in Singapore or the United States, which may not offer the same level of protection. We transfer only what is needed to provide the website to you and rely on these providers’ data protection agreements (including, where applicable, standard contractual clauses), as permitted by sections 28 and 29 of the PDPA and, for GDPR purposes, Chapter V of the GDPR. You can ask us for more details about these safeguards by email.
7. Security
We use encrypted connections (HTTPS) and a Content Security Policy that limits where pages can send data. We keep personal data to a minimum and restrict access to provider accounts and our mailbox to those who need it. If a personal data breach occurs, we will notify the Thai Personal Data Protection Committee within 72 hours of becoming aware of it, unless it is unlikely to risk people’s rights and freedoms, and if the risk is high we will inform you without delay together with remedial steps.
8. Your rights
Under the PDPA (and the GDPR, where it applies to you) you have the right to:
- access your data and get a copy of it;
- rectify inaccurate or incomplete data;
- erase your data or have it anonymised;
- restrict its use temporarily;
- object to processing based on legitimate interests;
- data portability, in a machine-readable format;
- withdraw consent at any time, for example by turning off advertising cookies with the “Cookie settings” link at the bottom of every page. Withdrawal does not affect processing already carried out;
- complain to the Thai Personal Data Protection Committee (PDPC) or, if you are in the EU/EEA or UK, to your local data protection supervisory authority.
Send requests to [email protected]. We may ask for information to verify your identity first and will reply within 30 days of receiving the request. In some cases we may decline a request as the law allows, for example where accounting or tax law requires us to keep data; we will tell you why.
9. Children
The free tools can be used without giving any personal data. If you are under 20 (the age of majority in Thailand), please ask a parent or guardian before allowing advertising cookies. We do not knowingly collect data from children under 10. If you are a parent and find that your child has given us data, please contact us to have it deleted.
10. Changes to this policy
We may update this policy as the service changes and will show the last-updated date at the top. For significant changes, such as collecting a new type of data, we will give notice on the website or by email before they take effect.
11. Contact
CookieCutter
Email: [email protected]