Privacy notice (PDPA)

What personal data we collect, and where it comes from

All of the data below is given to us directly by you, through the forms on this site. We do not buy personal data and we do not run advertising or analytics trackers on this site.

• Account profile: email address, full name, phone number, LINE ID, preferred language, and your consent record (whether you accepted this notice, when, and which version).
• Rental enquiry (lead): full name, preferred contact channel, phone number, LINE ID, email address, budget range, number of bedrooms, move-in date, lease length, preferred areas, preferred BTS/MRT line, and any free-text notes you add.
• Requirement record: title, whether you are renting or buying, budget range, bedrooms, areas, must-haves, preferences, and notes.
• Sign-in data held by our authentication provider: your email address, hashed password (or the fact you signed in with Google), and sign-in timestamps.
• Activity you create in the app: units you mark as interesting, viewing requests, deal messages and offers, if you use those parts of the product.

Why we use it, and our legal basis

• Handling your rental or purchase enquiry, shortlisting units, and arranging viewings — necessity for performance of a contract with you, or for steps taken at your request before entering into one.
• Creating and running your account, and deciding what you can see (renter, agent, owner, admin) — contract necessity.
• Keeping a record of your consent, and keeping records we are required to keep — compliance with a legal obligation.
• Sending you occasional new-listing updates — consent, which is optional and separate, and which you can withdraw at any time.
• Keeping the service secure (for example, limiting how many enquiries can be sent from one connection) — legitimate interest in preventing abuse.

Who we share it with

We do not sell your personal data. We share it only with the following, and only as needed:

• Our staff and consultants at The Middle Property who work on your enquiry.
• If you enquire about a specific unit, the owner or agent of that unit receives your enquiry so they can reply to you.
• Supabase, our database, storage and authentication provider, acting as our data processor.
• Lovable, our application hosting provider, acting as our data processor.
• A government authority, court or regulator, where the law requires it.

Where your data is stored (transfer outside Thailand)

Plainly: our database and hosting run on servers outside Thailand, operated by the providers named above. This means your personal data is transferred out of Thailand and processed abroad. We use these providers under their standard data processing terms, which include contractual protections for personal data.

How long we keep it

Enquiry and account records are kept for 24 months after our last contact with you, then deleted, unless we have to keep something longer to comply with the law or to defend a legal claim.

Your consent record is kept for as long as your account exists, plus the same 24 months, because it is the evidence that the consent was given.

If you delete your account, your data is deleted immediately — see below.

Your rights under the PDPA

You may, at any time:

• Access your data and ask for a copy of it.
• Have inaccurate or incomplete data corrected.
• Have your data deleted (erasure), or made anonymous.
• Ask us to restrict our use of your data.
• Object to our use of your data.
• Withdraw a consent you gave — withdrawing marketing consent does not affect our handling of an enquiry you already sent.
• Receive your data in a machine-readable format, and ask for it to be transferred (data portability).
• Complain to the Personal Data Protection Committee (PDPC) of Thailand if you believe we have handled your data unlawfully.

How to exercise your rights

We do not yet publish a contact email address, so requests are handled through two routes:

In the app: if you have an account, open your profile page. You can download all of your own data as a file, and delete your account and data yourself, immediately, with no waiting period.

By phone: call the number shown above and ask for a data request. We will confirm your identity before acting, and we answer within 30 days as required by the PDPA.

Enquiries sent without an account

You can send a rental enquiry without creating an account. Those records are not linked to any login, so we cannot authenticate you in the app to delete them. To have such an enquiry deleted, call the phone number above and give us the lead reference shown when you submitted it (or the name and phone number you used). We will verify and delete it.

Cookies and tracking

This site stores a sign-in session in your browser so that you stay signed in, and a small display preference for the price range on the discover screen. There are no advertising cookies and no third-party analytics trackers on this site.

Changes to this notice

If we change this notice materially we publish a new version number and effective date here, and ask account holders to accept the new version.