Last updated: 10 October 2026

Privacy policy

TipWai is an online service that restaurants in Thailand use so their guests can thank the staff, leave a tip by PromptPay and rate their visit. This page explains what personal data TipWai handles, why, and what you can ask us to do with it.

TipWai does not hold money: a tip goes from the guest's banking app straight to the person's PromptPay, and a bill straight to the restaurant's PromptPay. A tip a guest adds to a bill is paid to the restaurant together with the bill, and the restaurant passes it on to its staff.

1. Who is responsible

TipWai (tipwai.com). Write to us at hello@tipwai.com.

2. What we collect

Restaurant owners and managers: your e-mail address, your password (kept only as a hash) or your Google sign-in, your restaurant's details, and the time and IP address of each sign-in, for security.
Staff, entered by their restaurant: name, name in Thai, role, photo, PromptPay number (kept encrypted and shown only as its last digits), their goal, and the tips and ratings they receive.
Guests: we do not ask for your name, phone number or e-mail. When you open a staff page we record the visit: the time of each step, the tip amount you choose, your rating and comment if you leave one, your language, your device type, operating system and browser (from what your browser tells every website), and the country of your internet connection. We do not keep your IP address. A random code that counts your return visits is kept on your phone; it holds no name and no number. To remove it, tap “Forget this phone” at the bottom of a staff page.
Guests who pay the bill through a restaurant's page: the amount, the time, the server you chose, the tip you add to the bill and who it is for, the same device details as for any visit, and the slip if you attach it or the server photographs it. A slip is a bank document: it can show your name and part of your account number. It is shown only to that restaurant's people — and to TipWai's own support staff when they help that restaurant. We do not check slips with any bank.
People who write to us: what you send.

3. Why we use it, and on what basis under the PDPA

To run the service a restaurant has signed up for — contract.
To keep accounts safe and stop abuse, such as fake tips — legitimate interest.
To show a restaurant its statistics: visits, tips, ratings and return visits (counted with the random code on your phone) — legitimate interest. You can object at any time: tap “Forget this phone”.
To let a restaurant see the bills its guests paid, confirm that the money arrived, and notice when the same slip picture is used twice — legitimate interest.
To send account e-mails, such as sign-up and alerts about low ratings — contract.

We do not sell personal data and do not use it for advertising.

4. What is kept on your device

Sign-in cookies for restaurant accounts — needed to sign in.
Your language and your light or dark theme.
On guest pages: the random code that counts return visits — until you tap “Forget this phone”; after that, only a note that you asked us to forget.
On a bill's page: how far you got with the payment — in that browser tab only, until you close it.
On a server's phone page for bills: whether the sound is switched on.

No advertising cookies, no Google Analytics, no Facebook Pixel. Do not want the code? Tap “Forget this phone” at the bottom of a staff page, or clear this site's data in your browser.

5. Who handles data for us

Render — runs our server (Singapore).
Neon — our database (Singapore).
Vercel — serves our web pages.
Cloudinary — keeps staff photos, restaurant logos and the slips of bill payments.
Resend — sends our e-mails.
Google — “Sign in with Google”. Our pages also load fonts from Google Fonts, so your browser connects to Google's servers.

A restaurant sees only its own data.

6. Data outside Thailand

Our main data is kept in Singapore. Some of the providers above may handle data in other countries, including the United States, under their own security and privacy terms.

7. How long we keep it

While the restaurant's account exists.
When a restaurant closes its account, the account is switched off and its data is kept until the restaurant asks us to delete it.
The picture of a bill's slip is deleted after 30 days; the record of the payment — amount, the tip in it, time, server — stays with the restaurant's account.
Ask us at hello@tipwai.com to see, copy, correct or delete your data. We answer within 30 days.

8. Your rights under the PDPA

You can ask to know what we hold and get a copy, to have it corrected, deleted or its use restricted, and you can object to its use and withdraw your consent at any time. Write to hello@tipwai.com. You can also complain to Thailand's Personal Data Protection Committee (PDPC).

9. Children

TipWai is for restaurants and their adult guests. Guests do not need to give us any personal data to use it.

10. Changes

When anything changes we update this page and the date at the top.