Privacy Policy | i360one

1. Introduction

Welcome to i360one, a comprehensive Real Estate Operating System provided by i360city CO., LTD. ("Company," "we," "us," or "our"). We are committed to protecting your privacy and ensuring the security of your personal data in compliance with Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and other applicable data protection laws.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our i360one platform, including our website, web applications, mobile applications, and related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use our Services.

2. Data Controller Information

The data controller responsible for your personal data is:

i360city CO., LTD.

89 Moo 5 Tambon Wichit

Phuket, Phuket 83000

Thailand

Tax Identification Number: 0835567001765

Email: privacy@i360.city

3. Information We Collect

3.1 Information You Provide Directly

We collect information that you voluntarily provide when using our Services:

Account Information: Name, email address, phone number, password, profile picture, and professional credentials
Business Information: Company name, business registration details, DBD registration number, business address, and tax identification number
Professional Credentials: Real estate agent license numbers, certification documents, and verification documents
Property Information: Property listings, floor plans, images, videos, 360° virtual tour content, pricing information, and project details
Transaction Data: Sales proposals, contracts, buyer information, commission details, and payment records
Communication Data: Messages, inquiries, feedback, and support requests
Identity Verification Documents: Government-issued identification documents for verification purposes

3.2 Information Collected Automatically

When you use our Services, we automatically collect:

Device Information: Device type, operating system, unique device identifiers, browser type and version
Log Data: IP address, access times, pages viewed, links clicked, and actions taken within the platform
Usage Data: Features used, time spent on pages, search queries, and interaction patterns
Location Data: General geographic location based on IP address (not precise GPS location unless explicitly permitted)
Performance Data: Error reports, crash data, and diagnostic information

3.3 Information from Third Parties

We may receive information from:

Business Partners: Real estate developers, agencies, and property platforms
Verification Services: Identity and business verification providers
Public Sources: Publicly available business registration databases
Social Media: If you choose to link social media accounts

4. How We Use Your Information

We use the collected information for the following purposes:

4.1 Service Provision

Creating and managing your account
Providing access to platform features and functionality
Processing and managing property listings
Facilitating communication between users (developers, agents, buyers)
Processing sales proposals and contracts
Managing virtual tours and property media
Generating reports and analytics

4.2 Verification and Security

Verifying agent licenses and business credentials
Preventing fraud and unauthorized access
Ensuring platform integrity and security
Complying with legal and regulatory requirements

4.3 Communication

Sending service-related notifications and updates
Responding to inquiries and support requests
Providing important policy or terms updates
Sending marketing communications (with consent)

4.4 Improvement and Development

Analyzing usage patterns to improve our Services
Developing new features and functionality
Conducting research and analytics
Testing and troubleshooting

5. Legal Basis for Processing

Under PDPA, we process your personal data based on the following legal grounds:

Consent: Where you have given explicit consent for specific processing activities
Contractual Necessity: Processing necessary to perform our contract with you or to take pre-contractual steps at your request
Legal Obligation: Processing necessary to comply with applicable laws and regulations
Legitimate Interests: Processing necessary for our legitimate business interests, provided these do not override your rights and freedoms
Vital Interests: Processing necessary to protect vital interests of any person
Public Interest: Processing necessary for tasks carried out in the public interest

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

Active Account Data: Retained while your account is active and for a reasonable period thereafter
Transaction Records: Retained for 10 years as required by Thai tax and accounting laws
Contract Documents: Retained for 10 years from contract completion
Communication Records: Retained for 3 years for service improvement and dispute resolution
Log Data: Retained for 1 year for security and analytics purposes
Visit Statistics on Public Pages: Visit records are retained for 13 months, then only totals that identify no one (see Section 14.9)

When retention periods expire, we securely delete or anonymize your personal data unless longer retention is required by law.

8. Data Security

We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

Encryption: All data transmitted over the internet is encrypted using TLS/SSL protocols
Access Controls: Role-based access controls and authentication mechanisms
Infrastructure Security: Secure cloud infrastructure with regular security audits
Data Backup: Regular encrypted backups with secure storage
Employee Training: Regular security awareness training for all staff
Incident Response: Established procedures for detecting and responding to security incidents
Password Security: Industry-standard password hashing and secure session management

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to continuously improving our security measures.

9. Your Rights Under PDPA

Under Thailand's PDPA, you have the following rights regarding your personal data:

Right of Access: You have the right to request access to your personal data and obtain a copy of it
Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data
Right to Erasure: You have the right to request deletion of your personal data under certain circumstances
Right to Restriction: You have the right to request restriction of processing of your personal data
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used format
Right to Object: You have the right to object to processing of your personal data based on legitimate interests
Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time
Right to Lodge a Complaint: You have the right to lodge a complaint with the Personal Data Protection Committee of Thailand

To exercise any of these rights, please contact us using the information provided in Section 16. We will respond to your request within 30 days as required by PDPA.

Note: Certain requests may be subject to legal limitations. For example, we may be required to retain certain data for legal compliance or legitimate business purposes.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform:

10.1 Types of Cookies We Use

Essential Cookies: Required for the platform to function properly (authentication, security, preferences)
Performance Cookies: Help us understand how visitors interact with our platform
Functionality Cookies: Remember your preferences and settings
Visit Statistics: No cookie. Only after you accept, a random identifier is kept in your browser's storage for 12 months (see Section 14.9)

10.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to:

View what cookies are stored and delete them individually
Block third-party cookies
Block all cookies from specific sites
Block all cookies
Delete all cookies when you close your browser

Please note that disabling essential cookies may affect the functionality of our Services.

11. International Data Transfers

Your personal data may be transferred to and processed in countries other than Thailand, including countries where our service providers are located. When we transfer data internationally, we ensure appropriate safeguards are in place:

Transfers to countries with adequate data protection laws as determined by Thailand's PDPA
Standard contractual clauses approved by relevant authorities
Binding corporate rules for intra-group transfers
Your explicit consent for specific transfers

Our primary cloud infrastructure is hosted in secure data centers with industry-standard security certifications.

12. Children's Privacy

Our Services are not intended for individuals under the age of 20 years (the age of majority in Thailand) unless they have parental or guardian consent. We do not knowingly collect personal data from children under 20 without appropriate consent.

If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that information. If you believe we have inadvertently collected such data, please contact us immediately.

13. Third-Party Services

Our Services may contain links to or integrations with third-party websites, services, or applications. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our platform.

We are not responsible for the privacy practices or content of third-party services, even if accessed through our platform.

14. WhatsApp Messaging and the AI Sales Executive

Businesses that use i360one (developers and agencies, "Vendors") can connect their WhatsApp Business number, and other messaging channels such as Telegram and LINE, to i360one. When they do, i360one receives the messages their customers send to that number through Meta's WhatsApp Business Platform, and sends the Vendor's replies back the same way. This section explains what happens to that data.

14.1 Who Is Responsible

The Vendor you are messaging decides how your messages are used and is the data controller for them. i360city CO., LTD. processes these messages on the Vendor's behalf, only to provide the Services to that Vendor.

14.2 What We Receive

Contact details: your WhatsApp phone number and profile name
Message content: the text of your messages, voice notes, and any photos or documents you send (videos are not stored)
Message information: the time of each message and whether it was delivered and read
Details you choose to share: for example your name, e-mail address, or what kind of property you are looking for

14.3 How It Is Used

To show the conversation in the Vendor's inbox, so their staff can read it and reply
To answer your questions about the Vendor's published projects and units with the AI Sales Executive, when the Vendor has switched it on
To save you as a contact in the Vendor's customer records when you share your name, so their sales team can follow up
To send you documents you ask for, such as a project brochure
When the Vendor's staff, after checking that it is you, link your chat to your purchase or rental (a "deal"): to answer your questions about that deal — for example your payment schedule, invoices, construction progress and documents waiting for your signature — when the Vendor has switched its Customer Care Assistant on. Only the deals linked to your chat are used, and nothing is changed from the chat

You can ask to talk to a person at any time; the conversation is then handed to the Vendor's staff.

We do not sell this data, use it for advertising, use it to build profiles across Vendors, or show one Vendor's conversations to any other Vendor. We use data received from Meta only to provide the messaging service described here.

14.4 AI Processing

The AI Sales Executive writes replies with Claude, an AI model provided by Anthropic, PBC (United States). To write a reply, the conversation text, the photos and documents you send, the Vendor's published project information and — for a chat linked to your deal (Section 14.3) — the details of that deal are sent to Anthropic. Anthropic processes this data as our service provider and, under its commercial terms, does not use it to train its models. International transfers follow Section 11.

Voice notes are turned into text with Cloudflare Workers AI (Cloudflare, Inc.) so the AI can read them; the recording itself is stored with the conversation like any other file.

14.5 Service Providers for Messaging

Meta Platforms, Inc.: WhatsApp Business Platform (delivers messages)
Telegram and LY Corporation (LINE): deliver messages when the Vendor uses those channels
Anthropic, PBC: AI replies (Section 14.4)
Cloudflare, Inc.: stores the photos, documents and voice notes you send, in private storage, and turns voice notes into text (Section 14.4)
Cloud hosting providers: store the messages and files securely

14.6 How Long Messages Are Kept

Conversation messages are kept for up to 24 months and then deleted automatically. A contact saved in a Vendor's customer records stays until the Vendor deletes it or closes its account, or until you ask us to delete it (Section 14.7). Meta keeps its own copy of WhatsApp messages under the WhatsApp terms and privacy policy.

14.7 Deleting Your Data

To have your messages and contact details deleted:

E-mail privacy@i360.city with the subject "Delete my data"
Include the phone number you messaged from, and the name of the business you messaged if you know it
We confirm your request, delete your messages and any contact created from them within 30 days, tell the Vendor concerned, and reply to confirm that the deletion is done

You can also ask the business you messaged directly. Data we must keep by law (for example tax records) is kept only for as long as the law requires.

14.8 Team Chats for a Vendor's Staff

A Vendor's owner can link a team member's own chat on one of the Vendor's messaging channels to that person's i360one account, using a one-time code. The AI then answers that team member's questions about the Vendor's business with the information their i360one account is allowed to see — for example projects and units, deals and the buyers' contact details on them, invoices, the status and signers of documents (never a document's text), and management dashboard figures — and only the areas the Vendor has switched on.

AI processing: to write an answer, the question and the business information it needs are sent to Anthropic, as described in Section 14.4
Read-only: the AI only reads; nothing is created, changed, sent or deleted from a team chat
Who can read a team chat: the team member and the Vendor's owners. Team chats are not shown in the Vendor's shared inbox, and our platform administrators cannot open them in i360one
Record of reads: we record which business records the AI read, for whom and when, as part of the Vendor's activity records
Ending a link: the team member can type STOP; the owner can unlink at any time; a link also ends when the person leaves the Vendor's team or has not used it for 30 days
How long they are kept: team chat messages follow Section 14.6

The Vendor is the data controller for the business information and its team's messages; i360city CO., LTD. processes them on the Vendor's behalf, as in Section 14.1.

14.9 Visitor Statistics on Public Pages

When you visit a public page on i360one, we record the visit so the business that owns the page can see how its pages are used. Public pages are a Vendor's website, project and unit pages, forms, shared folders, signing pages, profiles, and the i360one marketplace. The full details are in the Vendor's notice (the "Privacy notice" link on its website). In short:

What is recorded: pages, actions, time on page, referring site, device type, approximate location (from your IP address), and language
IP address: your full IP address is kept for 90 days, then shortened
Without consent: nothing is stored on your device. Visitors are counted with a code that changes daily
With consent ("Accept"): a random identifier is stored in your browser for 12 months. It lets the Vendor see return visits. "Do Not Track" and Global Privacy Control are respected. After you accept, a small "Privacy" button on the page shows the identifier, and its "Forget me" button stops you being recognised at any time
How long: visit records are kept for 13 months. A copy without any IP address or identifier is kept for up to 3 years. After that only totals remain, which identify no one. Deleted visits leave our backups within 2 months
Where: servers in Singapore; storage in the Asia-Pacific region
Who decides: for a Vendor's pages, the Vendor is the data controller and we process the data on its behalf (as in Section 14.1). For i360one's own pages, and for the pages of projects whose developer is not yet on i360one, we are the controller
Deleting your visits: e-mail privacy@i360.city with your IP address (for visits in the last 90 days) or the identifier stored in your browser

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

We will update the "Last Updated" date at the top of this policy
We will notify you via email or prominent notice on our platform
For significant changes, we may request your renewed consent

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes constitutes acceptance of the updated policy.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Officer