Privacy Policy

1. Introduction and Data Controller

JulianDurian LLC ("we", "our", "us") is committed to protecting your privacy and complying with applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your personal information when you use the ThaiCondoAI website or mobile application (the "Service").

Data Controller:
JulianDurian LLC
1209 MOUNTAIN ROAD PL NE STE N
ALBUQUERQUE, NM 87110
United States of America
Email: contact@julianschubert.dev

JulianDurian LLC is the data controller responsible for your personal information under applicable data protection laws, including the EU General Data Protection Regulation (GDPR) where applicable.

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Scope and Applicability

This Privacy Policy applies to all users of the ThaiCondoAI Service, including:

• Property Seekers: Individuals searching for real estate in Thailand
• AI Search Channel Users: People searching through the website, mobile app, LINE, or WhatsApp
• Visitors: Anyone browsing the Service without an account

Applicable Laws: Depending on your location, different data protection laws may apply to our processing of your personal information:

• EU/EEA Users: The EU General Data Protection Regulation (GDPR)
• UK Users: The UK Data Protection Act 2018 and UK GDPR
• California Users: The California Consumer Privacy Act (CCPA)
• Thailand Users: The Personal Data Protection Act (PDPA)
• Other Users: Applicable local data protection laws

We are committed to complying with all applicable data protection laws and providing you with the rights afforded under those laws.

3. Information We Collect

We collect different types of information depending on how you use the Service:

3.1 Information You Provide Directly

Account Information:

• Name and email address; phone number only if you choose to retain one on your account
• Password (encrypted and never stored in plain text)
• Profile photo (optional)
• Account role and administrative access status

Profile and Preference Data:

• User persona (e.g., "Digital Nomad", "Family", "Retiree")
• Language preference (English, Thai, Chinese)
• Currency preference (USD, THB, EUR, CNY)
• Search preferences and saved filters
• Notification preferences

Source and Listing Data:

• Source operator, host, listing identifier, attribution, freshness, and rights-policy version
• Licensed listing text, images, location, price, property characteristics, and source URL
• Licensed source contact channels stored separately from public listing data
• Private source-rights and license evidence used for compliance review

Communication Data:

• Support tickets and correspondence
• Search prompts sent through the website, mobile app, LINE, or WhatsApp
• Optional microphone audio used by the mobile operating system's speech-recognition service to transcribe a voice property search; ThaiCondoAI receives and processes the resulting transcript as a search prompt
• AI results and delivery identifiers needed for idempotency and credit accounting
• Feedback and survey responses

ThaiCondoAI does not collect or forward property inquiries, viewing requests, booking requests, or user-to-owner/agent messages. When you open a source or licensed direct contact channel, the external app or website handles any later communication.

Payment and Transaction Data:

• Transaction IDs, amounts, and timestamps (credit purchases, subscription payments)
• Billing and store-purchase information processed by Stripe for web purchases, by the Apple App Store or Google Play for native app purchases, and by RevenueCat for purchase and entitlement synchronization
• We do not receive or store your full payment card numbers or CVV codes
• Credit balance and usage history

3.2 Information Collected Automatically

Usage and Activity Data:

• Search queries and search history
• Properties viewed, favorited, and compared
• Pages visited and features used
• Time spent on pages and interaction patterns
• Filters applied and map interactions
• AI analysis requests and results
• Outbound events containing listing, source, channel, surface, result position, plan, and optional search-operation ID—but no raw destination, contact value, search text, or direct user ID

Technical and Device Data:

• IP address and approximate geographic location (city/country level)
• Browser type, version, and language settings
• Device type, operating system, and screen resolution
• Referrer URL and UTM parameters
• Session IDs and authentication tokens
• Timezone and locale settings

Log and Error Data:

• Server logs (access times, pages requested, response codes)
• Error logs and crash reports
• Performance metrics and load times
• Security events and authentication attempts

3.3 Information from Third-Party Sources

• Authentication Providers: If you sign in using a third-party service (e.g., Google), we receive basic profile information (name, email, profile photo) as permitted by that service
• Licensed Listing Sources: We collect only the listing fields and contact channels permitted by the applicable versioned source-rights policy
• Map and Location Services: Geographic, map, and routing data from Mapbox for location-based features

3.4 Cookies and Similar Technologies

We use cookies, local storage, session storage, and similar technologies to collect information about your browsing activities. See Section 8 for detailed information about our use of cookies.

8. Cookies and Tracking Technologies

We use cookies, local storage, session storage, and similar technologies to enhance your experience, analyze usage, and provide personalized features.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and understand how you use the site.

Types of Cookies and Technologies We Use:

1. Strictly Necessary (Always Active):

• Authentication: Session tokens to keep you logged in and verify your identity
• Security: CSRF tokens and security measures to protect against attacks
• Load Balancing: Routing cookies to ensure proper server distribution
• Cookie Consent: Remembering your cookie preferences
• These cookies are essential for the Service to function and cannot be disabled without breaking core functionality

2. Functional Storage (Active When You Use These Features):

• Preferences: Language, currency, theme (light/dark mode), and display settings
• Local Storage: Saved searches, recent properties, and UI state
• Session Storage: Temporary data for current browsing session
• You can remove locally saved values through the relevant feature or device controls

3. Optional Product Analytics (Requires Consent):

• PostHog: Normalized web page and mobile screen paths plus explicit product events such as completed searches, property views, saved results, and purchase-funnel steps.
• We do not send raw search text, form contents, messages, contact details, property IDs, URL query strings, or opaque route IDs to optional product analytics.
• PostHog automatic click capture, heatmaps, exception capture, and session recording are disabled in our integration.

4. Marketing and Advertising:

We do not currently install advertising pixels, retargeting cookies, or cross-site behavioral advertising trackers. Sponsored or affiliate links may take you to another provider, whose privacy policy applies after you leave our Service.

Managing Your Cookie Preferences

Consent Controls: On the website, the first-visit banner lets you accept or reject optional analytics. You can change the web preference at any time on our Cookie Settings page. In the mobile app, use Settings → Analytics & privacy.

Browser Settings: Most web browsers allow you to control cookies through their settings:

• Block all cookies
• Block third-party cookies only
• Delete cookies when you close your browser
• View and delete individual cookies

Additional Controls:

• PostHog respects supported browser Do Not Track signals in addition to your saved preference.
• The mobile app provides its own first-run choice and in-app analytics control.
• Blocking optional analytics does not disable core product functionality.

Impact of Disabling Cookies: Blocking or deleting cookies may affect your ability to use certain features of the Service, such as staying logged in, remembering preferences, or accessing personalized content.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention Periods:

Account Data:

• Active accounts: Retained for as long as your account remains active
• Deleted accounts: Most data deleted immediately upon account deletion, with some data retained for up to 90 days for backup and recovery purposes
• Inactive accounts: Accounts inactive for more than 3 years may be deleted after notification

Transaction and Payment Data:

• Retained for 7 years to comply with tax, accounting, and financial regulations
• Includes transaction IDs, amounts, dates, and credit purchase history

Search History and Usage Data:

• Search queries and favorites: Retained while your account is active, deleted upon account deletion
• Optional product analytics: Retained for no longer than 12 months, subject to shorter deletion or aggregation where the provider supports it

Communication and Support Data:

• Support tickets and correspondence: Retained for 3 years for quality assurance and legal purposes
• WhatsApp bot sessions expire after 30 minutes. Hashed fair-use records and webhook delivery metadata are retained for no longer than 30 days. A linked WhatsApp account hash is retained until you disconnect it or delete your account.
• LINE search-channel identifiers and recent search context are retained only as needed to deliver and secure that channel, then deleted or de-identified under the applicable operational retention schedule.
• Legacy user-to-provider chats, messages, inquiries, bookings, leads, outreach content, and related attachments are deleted or anonymized as part of the search-only cutover; they are not retained as active product data.

Logs and Technical Data:

• Server logs: Retained for 90 days for security, debugging, and performance monitoring
• Error logs: Retained for 180 days for troubleshooting
• Security logs: Retained for 1 year for fraud prevention and security investigations

Marketing Data:

• Email marketing lists: Retained until you unsubscribe or delete your account

Legal Holds: In some cases, we may be required to retain data for longer periods due to legal obligations, disputes, investigations, or regulatory requirements. We will notify you if your data is subject to a legal hold.

Backups: Deleted data may persist in backup systems for up to 90 days before being permanently removed. Backup data is not accessible for normal operations and is used only for disaster recovery.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data only when we have a valid legal basis under the GDPR:

Contract Performance (Art. 6(1)(b) GDPR):

• Creating and managing your account
• Providing subscribed search, maps, details, alerts, and property intelligence
• Processing subscriptions, credit top-ups, and credit delivery
• Resolving licensed external source and contact destinations you select
• Delivering AI-powered property analysis and recommendations

Legitimate Interests (Art. 6(1)(f) GDPR):

• Detecting and preventing fraud, abuse, and security threats (our legitimate interest in protecting our Service and users)
• Maintaining logs for debugging and system stability (our legitimate interest in operating a reliable service)
• Sending service-related communications and updates (our legitimate interest in keeping users informed)

Consent (Art. 6(1)(a) GDPR):

• Marketing communications and newsletters (you can withdraw consent at any time)
• Optional product analytics (managed via the web consent banner or the mobile app analytics setting)
• Optional features like location services

Legal Obligation (Art. 6(1)(c) GDPR):

• Complying with tax and accounting requirements
• Responding to lawful requests from authorities
• Maintaining records as required by law

5. How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery and Account Management:

• Create, maintain, and secure your account
• Authenticate your identity and manage access
• Process subscriptions and top-ups and manage monthly and top-up credit balances
• Provide customer support and respond to support requests
• Send transactional emails such as login links, purchase confirmations, alerts, and support replies

Core Features and Functionality:

• Process natural language search queries using AI
• Generate personalized property recommendations based on your persona and preferences
• Provide AI-powered property analysis and insights
• Display properties on interactive maps with location-based features
• Enable saving favorites, comparing properties, and tracking search history
• Resolve a permitted source or direct-contact destination after entitlement, rights, and measurement checks

Personalization and Improvement:

• Customize search results and recommendations based on your preferences and behavior
• Remember your language, currency, and display preferences
• Analyze usage patterns to improve features and user experience
• Evaluate and improve search quality using aggregated or de-identified data

Security and Fraud Prevention:

• Detect and prevent fraudulent activity, abuse, and security threats
• Monitor for suspicious behavior and unauthorized access
• Enforce our Terms of Service and other policies
• Maintain audit logs for security and compliance purposes

Analytics and Business Intelligence:

• Analyze aggregate usage statistics and trends
• Measure feature adoption and user engagement
• Generate reports on platform performance and user behavior
• Inform business decisions and product development

Marketing and Communications (With Your Consent):

• Send newsletters, product updates, and promotional offers
• Notify you about new features, cities, or services
• Conduct surveys and request feedback
• You can opt out of marketing communications at any time by clicking the unsubscribe link in emails or adjusting your notification preferences

Legal and Compliance:

• Comply with legal obligations and respond to lawful requests
• Enforce our legal rights and defend against claims
• Maintain records as required by tax and accounting regulations

6. Disclosure and Third-Party Services

We do not sell your personal information to third parties. We share your information only in the following circumstances:

6.1 Service Providers and Business Partners

We engage third-party companies and individuals to perform services on our behalf. These service providers have access to your personal information only to perform specific tasks and are obligated not to disclose or use it for other purposes.

Infrastructure and Hosting:

• Supabase (US-based): Database hosting, authentication, and backend infrastructure. Data may be stored in US or EU regions depending on configuration.
• Cloudflare: Application hosting through Workers, content delivery, and protection against abusive traffic. Requests may be processed across its global network.

Payment Processing:

• Stripe (US-based): Payment processing for web subscriptions and top-ups. Stripe handles all credit card information directly - we never receive or store your full credit card numbers, CVV codes, or other sensitive payment data. Stripe is PCI-DSS Level 1 certified.
• Apple App Store and Google Play: Native app purchases are processed by the store associated with your device and are subject to that store's payment and privacy terms.
• RevenueCat (US-based): Synchronizes native store products, transaction identifiers, purchase status, and entitlements between the Apple App Store or Google Play and your ThaiCondoAI account. RevenueCat does not provide us with your full payment card number or CVV code.

Artificial Intelligence and Machine Learning:

• OpenAI (US-based): We use OpenAI's APIs to process search queries, generate property analyses, and provide AI-powered recommendations. We minimize personal data sent to OpenAI by:
  • Sending only search query text and selected property data
  • Not including your name, email, or direct identifiers in API requests
  • Using pseudonymized user IDs where necessary
  • Note: Search queries may contain personal preferences or location information you provide

Communication Services:

• Resend (US-based): Transactional email delivery (login links, purchase confirmations, alerts, support replies, and password resets).
• Meta WhatsApp Business Platform: When you message the ThaiCondoAI WhatsApp bot, Meta delivers your message, WhatsApp identifier, and delivery metadata to us. We use the message to perform the requested property search. We store a one-way hash rather than your WhatsApp phone number for bot sessions, fair-use counters, and account links.

Analytics and Monitoring:

• Sentry: Operational error and stability monitoring. Default personal information collection and session replay are disabled in our client configuration.
• PostHog: When activated, consent-gated web and mobile product analytics use a dedicated ThaiCondoAI project. Session replay and automatic interaction capture are disabled.

Maps and Location Services:

• Mapbox: Interactive maps, geocoding, routing, and location-based features. Subject to Mapbox's privacy policy.

Platform Speech Recognition:

• Apple or Google speech-recognition service: If you choose voice search and grant microphone and speech-recognition permission, the mobile platform may process microphone audio to produce a transcript. The platform provider's privacy terms apply to that processing; you can always type a search instead.

6.2 Listing Sources and External Contact Apps

ThaiCondoAI does not send your account profile, search text, or a property inquiry to a listing source. After a successful entitlement, rights, URL-safety, and measurement check, we return the selected external destination to your device. If you choose to open it, the source website or external phone, email, LINE, or WhatsApp app processes the information you provide there under its own privacy policy.

6.3 Legal Requirements and Protection

We may disclose your information if required to do so by law or if we believe in good faith that such action is necessary to:

• Comply with legal obligations, court orders, or lawful requests from authorities
• Enforce our Terms of Service and other agreements
• Protect and defend our rights, property, or safety
• Protect the rights, property, or safety of our users or the public
• Detect, prevent, or address fraud, security, or technical issues
• Investigate potential violations of our policies

6.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal information may be transferred to the successor entity. We will notify you via email and/or a prominent notice on our Service of any such change in ownership or control of your personal information.

6.5 Aggregated and De-Identified Data

We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you. This includes statistics about platform usage, popular search terms, market trends, and similar insights.

7. International Data Transfers

Cross-Border Data Transfers: ThaiCondoAI is operated from the United States, and our primary service providers are also based in the United States. If you are accessing the Service from outside the United States (including from the European Economic Area, United Kingdom, Switzerland, or Thailand), please be aware that your personal information will be transferred to, stored, and processed in the United States and potentially other countries where our service providers operate.

Data Protection Standards: The United States and other countries may have data protection laws that differ from those in your country of residence. However, we take steps to ensure that your personal information receives an adequate level of protection:

• We implement appropriate technical and organizational security measures regardless of where data is processed
• Our service providers are contractually obligated to protect your data and use it only for the purposes we specify
• Where required by law, we use Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA to countries without adequacy decisions

For EEA, UK, and Swiss Users: By using the Service, you acknowledge and consent to the transfer of your personal information to the United States and other countries for the purposes described in this Privacy Policy. If you do not wish for your information to be transferred outside your country, please do not use the Service.

Data Localization: Where technically feasible and required by local law, we may store certain data in specific geographic regions. For example, some data may be stored in EU-based data centers through our infrastructure providers.

10. Your Data Rights

Depending on your location, you have certain rights regarding your personal information. We are committed to honoring these rights regardless of where you are located.

Rights Under GDPR (EU/EEA/UK Users):

1. Right of Access (Art. 15 GDPR):

• You have the right to obtain confirmation of whether we process your personal data and to access that data
• Use the "Export My Data" feature in your account settings to download a copy of your data

2. Right to Rectification (Art. 16 GDPR):

• You have the right to correct inaccurate or incomplete personal data
• Update your information directly in your account settings or contact us for assistance

3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR):

• You have the right to request deletion of your personal data in certain circumstances
• Use the "Delete Account" feature in your account settings to permanently delete your account and data. You can also review the dedicated account and data deletion instructions.
• Note: Some data may be retained for legal compliance (e.g., transaction records for tax purposes)

4. Right to Restriction of Processing (Art. 18 GDPR):

• You have the right to request that we limit how we use your data in certain situations
• Contact us at contact@julianschubert.dev to request processing restrictions

5. Right to Data Portability (Art. 20 GDPR):

• You have the right to receive your personal data in a structured, commonly used, machine-readable format
• Use the "Export My Data" feature to download your data in JSON format

6. Right to Object (Art. 21 GDPR):

• You have the right to object to processing based on legitimate interests or for direct marketing purposes
• Opt out of marketing emails by clicking the unsubscribe link or adjusting notification preferences
• For other objections, contact us at contact@julianschubert.dev

7. Right to Withdraw Consent (Art. 7(3) GDPR):

• Where processing is based on consent, you have the right to withdraw that consent at any time
• Manage analytics consent via the website Cookie Settings page or mobile Settings → Analytics & privacy
• Unsubscribe from marketing communications via email links or account settings

8. Right to Lodge a Complaint (Art. 77 GDPR):

• You have the right to lodge a complaint with a supervisory authority in your country
• EU users can find their data protection authority at: EDPB Member List

Rights Under CCPA (California Users):

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request information about the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information, so no opt-out is necessary
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

How to Exercise Your Rights:

Self-Service Options:

• Account Settings: Update profile information, change preferences, manage notifications
• Export My Data: Download a complete copy of your data
• Delete Account: Permanently delete your account and data
• Analytics Settings: Manage web cookie preferences or the mobile product analytics preference

Contact Us:

• Email: contact@julianschubert.dev with subject line "Data Rights Request"
• Include: Your name, email address, and specific request
• We will respond within 30 days (or as required by applicable law)
• We may need to verify your identity before processing certain requests

11. Security of Your Information

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction.

Security Measures:

Encryption:

• In Transit: All data transmitted between your device and our servers is encrypted using TLS/SSL (HTTPS)
• At Rest: Sensitive data stored in our databases is encrypted using industry-standard encryption algorithms
• Passwords: All passwords are hashed using bcrypt with salt before storage

Access Controls:

• Role-based access control (RBAC) limits employee access to personal data based on job function
• Multi-factor authentication (MFA) required for administrative access
• Regular access reviews and immediate revocation upon employee departure

Infrastructure Security:

• Application and database hosting with Cloudflare and Supabase
• Regular security updates and patches
• Automated backups with encryption
• DDoS protection and rate limiting

Monitoring and Response:

• 24/7 automated monitoring for security threats and anomalies
• Logging and audit trails for security-relevant events
• Incident response plan for data breaches
• Regular security assessments and penetration testing

Data Breach Notification: In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of becoming aware of the breach.

Your Responsibility: While we implement strong security measures, you also play a role in protecting your information:

• Use a strong, unique password for your account
• Do not share your password or authentication credentials
• Log out of your account when using shared or public devices
• Keep your email account secure (as it can be used for password resets)
• Report any suspicious activity or security concerns immediately

Limitations: Despite our efforts, no security measures are perfect or impenetrable. We cannot guarantee absolute security of your personal information. Transmission of data over the internet is inherently insecure, and we cannot guarantee the security of data transmitted to or from our Service.

12. Children's Privacy

Our Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18.

If you are under 18 years old, please do not use the Service or provide any personal information to us. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at contact@julianschubert.dev, and we will take steps to delete such information from our systems.

If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will take steps to remove that information from our servers as quickly as possible.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this Privacy Policy
• For material changes: Send an email notification to your registered email address
• For material changes: Display a prominent notice on the Service
• For significant changes affecting your rights: Request your consent where required by law

Your Continued Use: Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the changes, you should stop using the Service and may delete your account.

Review Regularly: We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

14. Contact Us and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Email: contact@julianschubert.dev

Mailing Address:
JulianDurian LLC
Attn: Privacy Officer
1209 MOUNTAIN ROAD PL NE STE N
ALBUQUERQUE, NM 87110
United States of America

Response Time: We will respond to your inquiry within 30 days (or as required by applicable law).

Supervisory Authorities:

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the right to lodge a complaint with a data protection supervisory authority if you believe our processing of your personal information violates applicable law.

EU/EEA Users: Find your local data protection authority at https://edpb.europa.eu/about-edpb/board/members_en

UK Users: Information Commissioner's Office (ICO) at https://ico.org.uk

Swiss Users: Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch

However, we encourage you to contact us first so we can address your concerns directly.