A free AI service built by the Thai government began accepting registrations on August 19. The same day, a post criticizing its privacy policy spread on X.
The post came from the anonymous account @saintcattivo and passed 550,000 views as of August 19. Its message was roughly, "Before you celebrate that it's free, find out what you're giving up."
Where do your chats go when you sign up?
The service is called TH-AI Passport (the platform running it is named AiPASS). It's a project under Thailand's Ministry of Digital Economy and Society (DE), and registration at de.aipass.net is open to Thai citizens aged 15 and older. Up to 5 million people can verify their identity through the ThaID or Thang Rath app and then use AI from more than 14 brands, including OpenAI, Google, Microsoft, and Anthropic, free for one year.
Registration opened on August 19, and actual use starts on August 31. According to Thai outlet The Thaiger, depending on which AI service the user picks, conversations are actually sent to and processed on that overseas provider's servers. Thailand's National Electronics and Computer Technology Center (NECTEC) said it asked providers not to use this data for model training and that it applies anonymization.
One exception to the one-year storage clause
@saintcattivo's post goes a step further. It says it read the privacy policy the government published and pointed to five provisions.
In summary: chat records are linked to the user's 13-digit national ID number through ThaID and kept for one year, but an exception for cases of "public interest necessity" means the retention period could effectively be extended. The post also noted that even "Temporary Chat" mode is kept for one year, just like regular conversations.
It also claimed that chat data can be used to develop a national LLM, but that anonymization, which strips names, is mixed with pseudonymization, which can be re-identified, so it's hard to call the processing fully anonymous.
One clause that can override a deletion request
Thailand's Personal Data Protection Act (PDPA) guarantees users the rights to access, delete, object, and port their data. The problem, as @saintcattivo pointed out, is that exercising all of these rights can be restricted at the government's discretion in the face of an exception for "more important public interest."
It should be noted, though, that these five points are not an official government statement but one account owner's interpretation after reading the policy text. In fact, Thailand's opposition party has also demanded transparency on the 1.5 billion baht procurement contract (about $43 million), so the debate over how data is handled is likely to continue for a while.
It doesn't directly apply outside Thailand, but a government-built AI service that hands conversations to overseas LLMs, with a "public interest" exception limiting personal data rights, is a precedent worth referencing when discussing public-sector AI adoption.