Privacy policy
What personal data the platform processes, why, where it is stored, how long we keep it and how you can control it.
Who is responsible
This policy explains how the operator of the platform processes personal data in the Telegram bot @rent_thai_bot, the Telegram mini-app and the website cashback.rent. It is written under the Thai Personal Data Protection Act B.E. 2562 (PDPA).
Data controller: ClassAI Inc., a Delaware corporation, 1945 S Ocean Dr, Suite 1710, Hallandale Beach, FL 33009, USA. Contact for all privacy matters: team@cashback.rent.
We have assessed that we are currently exempt from appointing a representative in Thailand under Section 38(2) PDPA. If this changes, we will name the representative here. We have not appointed a data protection officer because Section 41 does not currently require one.
Real estate service providers who receive your request are separate data controllers for the data they receive and process it under their own privacy notices.
Points programme: the Thai company that gives the points is the data controller of programme data (your deals, points, requests to apply points and your acceptance of the programme terms). We keep this data for that company as its processor under a data processing agreement. The full notice for the programme is section 11 of the programme terms; we give the company's name, address and contacts on first request.
What we collect from clients
From Telegram, when you start the bot or open the mini-app: Telegram ID, first and last name, username, interface language and public profile photo link.
From Google, if you sign in with Google on the website: name, email and profile photo. We never see your Google password.
From you: the name and contact you enter in a request form (WhatsApp, Telegram, phone or email), preferred date and comment; messages, photos and files you send to the bot; your requirements such as city and area, budget, dates, rental term, number of people and pets; answers to short questionnaires if you choose to give them.
From your actions: favourites, lists, comparisons, viewing and status requests.
Collected automatically: screens opened, filters used, buttons pressed, the link or campaign you came from; on the website, pages visited, device and browser type and IP address in server logs.
What we collect about owners and agents
Name, phone number, LINE, WhatsApp or other contact, notes on how and when to reach you; property details, prices, photos and availability answers; a record of our contacts with you and your answers. These come from you, from a real estate service provider or from a public listing.
For public listings, for example in Facebook groups and Marketplace: the original text, author name, link and photos as published.
For real estate service providers: company and contact person details, agreed terms, requests delivered to them and records of fees they pay us.
If you do not give us data, and sensitive data
You do not have to give us your data, but without your Telegram contact or another contact and your requirements we cannot deliver your request to a real estate service provider or answer you.
We do not ask for sensitive data (health, religion, ethnicity, biometric data and similar). If you send us sensitive data or an identity document, we will not use it for any purpose other than the one you asked for, will ask for your explicit consent where the law requires it, and delete it when no longer needed. Please cover the religion field on Thai ID cards.
Why we use it and on what legal basis
To answer your messages, understand your requirements, show suitable properties and send you updates about your request; to deliver your request (name, contact, requirements, chosen property) to the real estate service provider for that property; and to use an AI assistant for this: contract, taking steps at your request (Section 24(3)).
To verify listings with owners and agents; to collect public listings, rewrite them and show neutral property facts without the author's contact details; for analytics to improve the platform, measure which channels bring clients and prevent fraud and abuse: legitimate interest (Section 24(5)). You can object (Section 32).
Records of fees from advertisers and service providers, invoices and accounting: contract and legal obligation (Sections 24(3) and 24(6)).
Points programme: to calculate, release, apply and cancel points, remind you before they expire, keep the accounting records the law requires and keep proof of what you accepted: contract (Section 24(3)), legal obligation (Section 24(6)) and legitimate interest in that proof and in preventing abuse of the programme (Section 24(5)).
News, offers and properties you did not ask about: only with your consent (Section 19). You can withdraw it and object to direct marketing at any time (Section 32(2)).
If we obtained your details from a public listing, we tell you this, the source and your rights when we first contact you. You can object at any time; for contact about offering property we will always stop.
AI assistant
Messages you send to the bot are processed by an AI assistant that answers common questions and prepares drafts for our support team. For this, the text of the conversation and your saved requirements are sent to AI model providers (currently models from Anthropic and Google, accessed through OpenRouter).
The assistant's memory stores your requirements, for example budget, area and dates. It does not store your phone number or email. It does not make decisions with legal or similarly significant effects on you; questions it cannot answer safely go to a person.
We use AI providers under terms that do not allow them to use your conversations to train their models. We do not record phone calls. If we start calls or voice messages with recording, we will tell you at the start and ask for your consent where required.
Who we share data with
Real estate service providers receive only what is needed for the property you asked about: your name, contact, requirements and the property. They are separate controllers, including when they arrange viewings and deals.
Service providers process data on our behalf: Supabase, database and server functions (India, AWS Mumbai); Backblaze B2, photo and file storage (United States); Netlify and Cloudflare, website and mini-app hosting (global network); Hostinger, bot server and data collection (Malaysia); OpenRouter, Anthropic and Google, AI assistant (United States and other countries); Apify, collection of public listings (United States); Resend, email delivery (Japan); Google, sign-in with Google (United States). Telegram is the messaging channel and a separate controller.
The Thai company that gives the points receives points programme data as a separate controller. The owner or partner agency in your deal receives only what is needed to settle the rent when you apply points.
We share data with authorities when required by law. We do not sell personal data. Owners' and agents' contact details are never shown to clients; only our team and the relevant real estate service provider see them.
Transfers outside Thailand
The platform is operated from the United States and some providers store or process data outside Thailand. Where we send personal data to countries whose data protection standards have not been recognised by the PDPC, we do so where necessary to perform a contract with you or take steps at your request (Section 28(3)) or under a contract made for your benefit (Section 28(4)), or under standard contractual clauses recognised under the PDPC Notification on transfers under Section 29 (B.E. 2566), such as the EU Standard Contractual Clauses or the ASEAN Model Contractual Clauses. You may request a copy of the relevant safeguards at team@cashback.rent.
How long we keep data
Client profile, requirements and requests: while you use the platform and 24 months after your last activity. Chat messages and AI memory: 24 months after your last activity. AI processing logs: 180 days. Usage events: 24 months, then aggregated without personal identifiers.
Owner and agent contacts and contact history: while the property is offered and 24 months after. Original text of collected public listings: while the listing is used and 12 months after. Fee and accounting records: as required by accounting and tax law, generally 5 to 10 years.
Points programme records (points, deals, payments, requests to apply points and acceptances of the programme terms): 5 years after the accounting period of the last entry, as Thai accounting and tax law requires; up to 10 years only while a claim or tax audit is still possible. Programme service logs (commands, refusals, notifications, session data): up to 24 months.
After these periods we delete or anonymise the data.
Your rights
Under the PDPA you can access your data and get a copy, and ask how we obtained data collected without your consent; receive your data in a machine-readable format; correct it; ask us to delete or anonymise it; restrict processing; object to processing based on legitimate interest and to direct marketing at any time (Section 32); withdraw consent without affecting earlier processing; and complain to the Personal Data Protection Committee of Thailand (PDPC).
Write to team@cashback.rent with the subject "Personal data request", or send the bot the word "privacy". We may ask you to confirm your identity, for example from the same Telegram account. We answer within 30 days.
Owners and agents can stop all contact from us at any time by replying "stop" to any message from us.
Security
Access to personal data is limited to staff who need it for their work, with individual accounts. Owner contacts are kept in closed tables that the client parts of the platform cannot read. Photos are stored privately and shown through short-lived links. If a data breach creates a risk to you, we notify the PDPC within 72 hours and inform you when the risk is high.
Children, cookies and changes
The platform is intended for adults. We do not knowingly collect data from persons under 20 without the consent of a parent or guardian. If you believe a minor has sent us data, write to team@cashback.rent.
The website stores your language, currency, theme and sign-in in your browser so it works. We measure page visits with our own analytics. There are no advertising cookies; if we add them, we will ask for your consent before they load.
We may update this policy; the date at the top shows the last change. We announce material changes in the bot or on the website before they take effect, and ask for consent when a change needs it.