Privacy Policy

4 November 2026

Erawan provides a cloud hosting platform for applications built by developers and AI coding agents. This Privacy Policy outlines the personal data we collect, how and why we process it, where it is stored, and the rights you hold under Thailand's Personal Data Protection Act (PDPA), which is the law this service is operated under.

Information We Collect

• Account and Contact Information: Your email address provided at sign-up, or retrieved from Google when you authenticate using Google OAuth (along with your unique Google account identifier). We do not store and never possess your Google password.
• Application Source Code and Artifacts: Source code deployed to our platform, container images built during deployment, and the full Git version history.
• End-User Identity for Hosted Applications: When a customer application utilizes the Managed Auth Add-on, we store the email address, name, and authentication timestamps of end users who log in to that application. For this identity data, Erawan and the application owner act as joint data controllers to facilitate authentication and access control.
• Environment Variables and Secrets: Application configuration values and secrets. These are encrypted at rest using industry-standard cryptography and decrypted in memory only when executing your application.
• Deployment and Operational Logs: Deployment history, build output, container execution logs, and runtime diagnostic data.
• Security Audit Logs: An immutable audit trail of actions performed on your account. It records modification timestamps and variable names, but never confidential values.
• Email Transaction Records: Metadata for emails dispatched via the email add-on (recipient, subject line, timestamp) for quota monitoring and accounting.
• Agent Access Tokens: Cryptographic hashes of tokens generated for connected coding agents, ensuring compromised database copies do not reveal usable credentials.

Data Protection Principles and Exclusions

• We do not inspect, query, or process data stored within your application's private databases.
• We do not employ third-party advertising or cross-site tracking cookies, and no analytics service operated by anyone other than us runs on our website or console. Our own measurement is described under Website Analytics below.
• We do not sell, rent, or trade your personal data to any third party.
• We do not collect or store card numbers or bank account details. Payments are made on the payment page of Beam (Beam Data Co., Ltd.). We receive only whether a payment succeeded, the plan and period it paid for, and how it was paid (for example "PromptPay").

Cookie Policy

Our platform uses only two strictly necessary first-party cookies: a secure session cookie to maintain your authenticated state, and an anti-CSRF token echoed by the console to prevent unauthorized cross-site actions. Both cookies are automatically invalidated upon signing out. We also store one identifier outside of cookies, described next.

Browser Storage and Visitor Measurement

Our website and console each store a single random identifier (erw_aid) in your browser's local storage, so that repeat visits are counted as one person rather than several. It is generated in your browser, contains nothing about you, and is never sent to any third party. Because our website and our console are separate sites, the identifier travels between them in the link you follow and is removed from the address as soon as the page loads. We use it only to understand where our own signup flow loses people. Clearing your browser's site data removes it, and everything continues to work without it.

Website Analytics

We count page views on our website and console with Umami, an open-source analytics tool that we run ourselves, on our own servers, at analytics.erawan.cloud. The measurement never leaves our infrastructure, no third party receives it, and the tool’s own product telemetry is switched off. Umami sets no cookie and stores nothing in your browser. A visit is counted from a value derived from your IP address and browser identification mixed with a secret key that changes every month, so the record cannot be traced back to you and does not follow you into the next month. Your IP address itself is never stored: what is kept is the page you visited, the site that referred you, and the country, browser, operating system, language and screen size your browser reports. Session recording and behaviour replay are switched off.

Cookie Scope on Hosted Applications

Applications operating on default subdomains under erawan.app share a registrable domain in browser scope. Consequently, cookies set without domain restrictions may be accessible to neighboring applications on the same domain. We strongly recommend configuring a custom domain for any application implementing user authentication, ensuring complete domain and cookie isolation.

Third-Party Sub-processors

We share data exclusively with trusted infrastructure providers required to operate the service:

• Google LLC: Identity provider for authentication (applicable only when choosing Google sign-in).
• Limitrack: Dedicated server infrastructure and data center facilities located in Thailand. Customer applications, their databases, files and backups of them run here.
• Hetzner Online GmbH: Cloud server infrastructure and secure data center facilities located in Singapore. The control plane, account records and the offsite copy run here.
• Cloudflare, Inc.: DNS routing, DDoS protection, edge security, and administrative email forwarding.
• Let's Encrypt (ISRG): Automated issuance and renewal of TLS/SSL security certificates.
• Resend, Inc.: Transactional email delivery service for applications utilizing the email add-on.
• OpenRouter, Inc.: Model provider. It receives what you type into the coding environment, and — when you use erawan ask without asking for a person — the text of your question together with your account's own state (plan, app names, statuses and the last build failure). It never receives your environment variables, add-on credentials, application data, or anything belonging to another account. Pass --human to erawan ask and your question is answered by a person and is not sent here at all.
• Beam Data Co., Ltd. (Bangkok, Thailand): Payment processing for paid plans by PromptPay and mobile banking. Beam receives the amount, our order reference and the payment details you enter on its page; we never see the latter.
• Stripe, Inc.: Processed card payments for paid plans before we moved to Beam, and keeps the records of those payments.
• Support chat (our CRM): The support chat on our website and in the Academy. It runs on our own infrastructure at customer.erawan.cloud; what you type into it is answered by a model provider, and a person on our side reads the same conversation. Do not put a password or a card number into it. If you leave your name, phone number or email in the chat's call-back form, we keep them with the conversation and use them only to contact you about what you asked. The chat keeps a session token in your browser's local storage under crm:token:erawan, remembers under crm:lead:erawan whether you have already answered the form, sets no cookie, and starts nothing until you open it.

Data Storage and International Transfers

Platform infrastructure, servers, and primary storage systems are hosted in enterprise data centers located in Thailand and Singapore. Applications and their data are served from Thailand; account records and the recovery copy are held in Singapore. If you access the service from outside these regions, your data is transferred and stored in compliance with international data security and privacy standards.

Data Retention and Account Deletion

Personal data is retained for the duration of your active account. If an account is suspended due to non-payment, data is preserved for a grace period of ninety (90) days before permanent removal.

When an application is deleted, its container images, environment variables, and runtime logs are purged immediately. Email dispatch records and audit logs are retained until the parent account is closed.

You may terminate your account at any time via Account Settings. Account closure immediately and permanently deletes all associated applications, databases, files, and system logs with no restorable backup copies.

Your Legal Rights

Under Thailand's PDPA — and we extend the same to everyone, wherever they are — you have the right to request access to, rectification of, portability of, or erasure of your personal data, as well as the right to restrict or object to processing. To exercise any of these rights, contact us at hello@erawan.cloud.

Technical and Organizational Security Measures

Account passwords are hashed using Argon2. Environment variables and database credentials are encrypted at rest. Agent tokens are hashed and can be revoked instantly via the console. Application code and repository histories are backed up offsite daily with strong encryption. For your application's private database contents, we recommend maintaining regular independent exports of critical data.

Amendments to this Policy

Material changes to this Privacy Policy will be communicated via your registered email address prior to their effective date.

Contact Us

For inquiries regarding privacy, data protection, or compliance, please reach out to hello@erawan.cloud.