Buck — Privacy Policy · นโยบายความเป็นส่วนตัว

Effective date: 8 October 2026 (previously 25 September 2026) · Operator: RailAll Company Limited

This Privacy Policy explains how RailAll Company Limited ("Buck", "we", "us"), operator of the Buck freight-matching application, collects, uses, discloses, and protects your personal data in accordance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

This policy covers the Buck mobile application exactly as published on the app stores:

• Google Play — app name Buck — Freight & Trucks, package com.buck.app, developer Purachet
• Apple App Store — app name Buck — Freight Trucks, bundle ID com.railall.buck, seller Purachet Paputsaro

Both store listings are published under the individual developer account Purachet / Purachet Paputsaro and are operated by RailAll Company Limited, which is the data controller identified in section 1 below.

1. Who we are (Data Controller)

2. Personal data we collect

3. Why we use it, and our legal basis

• To provide the service — create accounts, match jobs, track deliveries, and collect our own booking fee (legal basis: performance of a contract).
• Verification, safety & fraud prevention — KYC, licence checks (legal basis: legal obligation and legitimate interest).
• Support, disputes & claims — resolve issues using delivery evidence (legal basis: contract / legitimate interest).
• Service improvement & ratings (legal basis: legitimate interest).
• Showing your carrier profile — we show your profile to anyone with its link because you asked us to publish it. You can hide it at any time (legal basis: performance of a contract).
• Making sure “verified” really means verified — we check that a bill was acknowledged by the customer, not by the carrier, so the numbers on every profile can be trusted (legal basis: legitimate interest).
• Anonymous statistics, such as average route rates, never a named party's price (legal basis: legitimate interest).
• Marketing / announcements, only where you opt in (legal basis: consent, which you may withdraw at any time).

4. Who we share it with

• The matched counterparty (shipper ↔ carrier) — limited details needed to complete the job.
• A carrier's published PromptPay ID and/or bank account details and account-holder name are shown to the shipper on a booking they have accepted, so the shipper can pay the carrier directly. We do not use a third-party payment gateway; Buck's booking fee is transferred to our own bank account and reconciled by us.
• Anyone with a carrier's bill link can see that bill, the carrier's payment details and its proof photos. The customer's phone/LINE contact is never shown on it.
• Anyone with a profile link sees the name, photo, province, fleet counts, lanes, specialities, intro, photos, contact, document badges and verified figures. Never prices, customer names, ID or licence numbers, plates or document images.
• Service providers acting on our behalf under a data-processing agreement (e.g. cloud hosting, push notifications).
• Authorities or insurers where required by law or to handle a claim.

We do not sell your personal data.

5. International transfers

Some data may be stored or processed on servers located outside Thailand (e.g. cloud hosting in Singapore). Where this happens, we use appropriate safeguards (such as our providers' standard data-protection terms) consistent with the PDPA.

6. How long we keep it

We keep personal data only as long as needed for the purposes above or as required by law. Location trails and delivery photos are retained for a limited period and then deleted unless linked to an open dispute; transaction records are kept as required by accounting and tax law. Profile photos and documents are deleted when you delete your account. A replaced document is deleted straight away.

7. How we protect it

We apply appropriate security measures, including encryption in transit and at rest, access controls, and minimization of retained data.

8. Your rights under the PDPA

Subject to legal conditions, you may: access and obtain a copy of your data; correct it; request erasure or restriction; object to processing; request portability; and withdraw consent where we rely on it. To exercise any right, contact us using the details in section 1. You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC).

9. Children

Buck is a business service and is not directed at children. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy and will post the new version here with a revised effective date; material changes will be notified in-app or by email.

11. Contact