Data we collect
Account data: first and last name, email address, phone number, a hashed password, and the identifier issued by an external login provider when you choose to sign up or sign in with Google, Facebook, LINE or Microsoft.
Business data: dormitory project names, locations, building and room counts, images, and the settings you save into the system.
Payment data: your plan, invoice history and payment status. We do not store card numbers or CVV codes on our systems — card details go directly to a PCI DSS compliant payment provider.
Usage data: sign-in records, last access time, and the event logs required for security and auditing.
Tenant data you enter into the system
When you, as a dormitory owner, record tenant details such as names, phone numbers, lease agreements or rent payment history, you are the data controller for that personal data and we act as a data processor following your instructions.
That means it is your responsibility to inform tenants of the purpose and obtain their consent where the law requires it. Ours is to process the data only as far as delivering the service requires, never for our own purposes, and to keep it secure.
When you end your subscription you may ask us to export or delete the tenant data held under your account.
Purposes and legal bases
Performance of a contract: creating and maintaining your account, giving you the features included in your plan, and issuing invoices and receipts.
Legitimate interests: keeping the platform secure, preventing fraudulent use, improving service quality, and contacting you about your usage.
Legal obligation: retaining accounting and tax records for the period the law requires.
Consent: sending marketing news or promotional offers. You may withdraw consent at any time without affecting your use of the service.
Disclosure to third parties
We do not sell your personal data. We disclose only what is necessary to the providers that work on our behalf: payment providers, email and SMS providers, cloud infrastructure providers, and the external login provider you chose to use.
These providers can access data only as far as the work we engaged them for requires, and are bound by confidentiality agreements.
We may disclose data where required by law or court order, or to protect our rights and the safety of our other users.
Cookies
We use cookies that are strictly necessary for the platform to function, such as remembering that you are signed in and which language you selected. Without them the service cannot operate.
You can configure your browser to refuse cookies, but parts of the service may then not work as intended.
Retention
We keep account data for as long as you use the service, and for no more than 90 days after an account is closed so that you can reactivate it.
Accounting and tax records such as invoices and receipts are kept for the period the law requires, currently 5 years.
Security event logs are kept for no more than 12 months.
Security
We transmit data over encrypted connections, store passwords in a form that cannot be reversed, and restrict access to data according to each user's role.
No system is completely secure. If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the Personal Data Protection Committee within 72 hours and inform you without undue delay.
Your rights as a data subject
You have the right to access and obtain a copy of your data, correct inaccurate data, request erasure or anonymisation, request restriction of processing, request data portability to another provider, object to processing, and withdraw consent you previously gave.
To exercise a right, contact us using the details at the end of this policy. We will respond within 30 days of receiving your request.
If you believe we are not complying with the law, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee.
International transfers
Your data is stored primarily on servers in Thailand. Where a provider processes data abroad, we put in place the safeguards the law requires.
Changes to this policy
We may update this policy from time to time. If a change is material we will notify you by email or an in-app notice before it takes effect. The current effective date is shown at the top of this page.