Privacy Policy

Version 1.0 · Effective 13 September 2026

1. Who we are

Arenta ("we", "us") operates the Arenta property platform (the "Service") in Thailand. We are the data controller for the personal data described in this Policy.

For anything to do with privacy or your personal data, write to privacy@arenta.app.

2. Scope

This Policy covers the Service in every form in which we deliver it — our website, our installable web application and our Telegram Mini App — and any contact you have with us.

We process personal data in accordance with the Personal Data Protection Act B.E. 2562 (2019) of Thailand (the "PDPA"). Where the EU General Data Protection Regulation applies to you, we also honour the rights it gives you.

3. What we collect

We describe the data we collect by category. The examples show what a category typically includes; they are not an exhaustive list of every field.

3.1 Data you give us

• Account and profile — such as your name, profile photo, email address, mobile number, Telegram account, your settings, and the details of any agency or showroom profile you publish.
• Listings — the content of the advertisements you publish, including property details, price, location and images.
• Content and communications — such as your messages to other Users, reviews, reports and support requests, and anything you include in them.
• Saved activity — such as favourites, hidden listings, saved searches and filters, and the agents you follow.
• Identity verification — images of an identity document and of your face, and the biometric data derived from them, if you complete verification. See section 5.
• Payment — your plan and transaction records. We do not store full card numbers; payments are handled by our payment provider.

3.2 Data we collect automatically

• Device and connection — such as your IP address, device, browser and operating system, and approximate city-level location derived from your IP address.
• Security and session data — such as sign-in activity, your active sessions, the identifiers we use to keep one session per device, and signals used to detect and prevent abuse.
• Usage data — such as the listings and profiles you view, the searches and filters you apply, the actions you take on the Service, and whether you reach us through the web or Telegram.
• Listing performance — aggregated view and enquiry figures, shown to Advertisers for their own Listings.
• Data stored on your device — such as your settings, your session, and caches that let the application work offline. See section 12.

3.3 Data we receive from others

• Telegram — when you sign in with Telegram we receive your Telegram identifier and, if you have made them available, your display name and profile photo. We do not receive your phone number or your Telegram messages.
• Didit — the verification result and the data described in section 5.
• Payment provider — the status of a payment and limited transaction data.

3.4 Data about other people

If you put another person's personal data into a Listing, a photograph, a message or a review, you must have a lawful basis for doing so. That content is your responsibility; see our Terms of Use.

4. Why we use your data, and on what basis

• Providing the Service — creating and running your account, signing you in, publishing your Listings and profile, enabling chat between Users, and sending one-time codes and service messages. Basis: performance of a contract.
• Keeping the Service safe — security and session management, rate limiting, fraud and abuse prevention, moderation and handling reports. Basis: our legitimate interest in protecting Users and the Service, and legal obligation where one applies.
• Measuring and improving the Service — analytics on how the Service is used, and statistics shown to Advertisers about their own Listings. Basis: our legitimate interest in operating and improving the Service.
• Verifying identity — confirming who you are and granting verified status. Basis: your explicit consent for biometric data; contract and legitimate interest for the rest.
• Marketing and listing alerts — messages about our services and alerts about new listings matching your saved searches. Basis: your consent, which you may withdraw at any time.
• Billing and accounting — plans, invoices, tax and accounting records. Basis: performance of a contract, and legal obligation.
• Complying with law and defending claims — responding to lawful requests from authorities, and establishing, exercising or defending legal claims. Basis: legal obligation, and our legitimate interest.

We do not sell personal data. We do not make automated decisions that produce legal effects concerning you; search ranking and listing promotion are automated but do not produce such effects.

5. Identity verification and biometric data

5.1 Who does it. Identity verification is carried out by Didit (didit.me), acting as our data processor under a data processing agreement. We remain the controller and decide why verification takes place. Didit acts as a controller in its own right for limited purposes such as security and audit logging.

5.2 What is processed. An image of your identity document, a selfie or short video, liveness and anti-spoofing signals, and facial-geometry data derived from them. Facial-geometry data is sensitive personal data under section 26 of the PDPA and a special category of data under the GDPR.

5.3 Consent. We ask for your explicit consent before biometric capture begins. Consent is voluntary and you may withdraw it at any time by writing to privacy@arenta.app. Withdrawal does not affect processing carried out before you withdrew. If you refuse or withdraw consent, we may be unable to give you verified status or access to features that depend on verification.

5.4 How long it is kept. Verification session data — the document image, the selfie or liveness video, and the face embedding used to detect duplicate accounts — is kept for 12 months and then deleted. Where a biometric template is kept in order to detect duplicate accounts, it is held for a limited period and is purged when your account is deleted, when you ask us to erase your data, or when the period expires.

5.5 No training, no sale. Biometric data is not used to train models across customers, and is not sold, leased or traded.

6. Who we share data with

6.1 Other Users and the public. Your display name, profile photo, public profile or showroom, and your Listings — including the property address, photographs and the contact routes you enable — are visible to other Users and to the public internet. They may be indexed by search engines and shown as link previews in messengers and social networks. Do not publish anything you are not willing to make public. Your email address and mobile number are not shown to other Users unless you choose to publish them.

6.2 Service providers. We use the providers below, each bound by contract to process data only on our instructions.

• Telegram — sign-in, sharing property cards, notifications.
• Resend — delivering email, including one-time codes.
• Vonage — delivering SMS, including one-time codes.
• Google Maps — maps, address search and geocoding.
• Didit — identity verification.
• Payment provider — processing payments.
• Hosting provider — running our servers, database and file storage.

Photographs and files you upload are stored on our own infrastructure, not with a third-party media service.

6.3 Legal and protective disclosure. We may disclose personal data where the law, a court or a competent authority requires it, or where disclosure is necessary to investigate suspected fraud or abuse, to enforce our Terms of Use, or to protect the rights, property or safety of any person.

6.4 Corporate transactions. If we are involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred as part of that transaction, under this Policy or one no less protective.

7. International transfers

Some of our providers process personal data outside Thailand. Where we transfer personal data abroad we do so in accordance with sections 28 and 29 of the PDPA — to a destination recognised as providing adequate protection, or under appropriate safeguards such as standard contractual clauses, binding corporate rules or an equivalent instrument that preserves enforceable rights and effective remedies. Where neither applies, we rely on your informed consent or another exception the PDPA permits. Write to privacy@arenta.app for details of the safeguards we use.

8. How long we keep data

• Account data — while your account exists, and 12 months after deletion for fraud prevention and defence of claims.
• Listings — while published, and 12 months afterwards in archived form.
• Messages — until your account is deleted.
• Verification data — 12 months; see section 5.4.
• Consent records — 5 years after the consent ends, as evidence that it was given.
• Security and session records — 12 months.
• Usage analytics — 24 months in identifiable form, then aggregated or anonymised and kept without a time limit for statistics.
• Payment, invoicing and tax records — 5 years, as required by Thai tax and accounting law.
• Support correspondence — 24 months.

Backups are rotated on a 30-day cycle; data deleted from live systems disappears from backups by the end of that cycle.

9. How we protect data

• Email addresses and mobile numbers are stored encrypted. The Service searches on a one-way hash rather than on the value itself, and Telegram identifiers are stored hashed.
• Passwords, where you set one, are stored only as a salted hash. Sign-in is passwordless by default.
• Traffic between your device and our servers is encrypted in transit.
• Access to production data is limited to authorised personnel, granted on a need-to-know basis and logged; administrative actions are recorded in an audit log.
• Sessions are tied to a device identifier so that one device holds one session, and you can review and end active sessions at any time in Account → Security.
• We apply rate limiting and abuse detection to sign-in and messaging.

No system is completely secure, so we cannot guarantee absolute security, and you share information through the Service at your own risk.

If something goes wrong. Where a personal data breach is likely to create a risk to your rights and freedoms, we notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and we notify you where the breach creates a high risk to you.

10. Your rights

Subject to the conditions and exceptions in the PDPA, and in the GDPR where it applies, you have the right to:

1. be informed about how we process your data — this Policy;
2. access your data and obtain a copy of it;
3. receive it in a portable form and have it sent to another controller where that is technically feasible;
4. correct data that is inaccurate or incomplete;
5. have your data erased, including by deleting your account;
6. restrict processing in defined circumstances;
7. object to processing based on legitimate interest, and to direct marketing at any time;
8. withdraw consent at any time where processing is based on consent, including consent to biometric verification, without affecting processing carried out before you withdrew; and
9. complain to the Office of the Personal Data Protection Committee of Thailand or, where the GDPR applies, to your local supervisory authority.

To exercise any of these rights, write to privacy@arenta.app. We answer within the period the law requires, currently 30 days under the PDPA. We may ask you to confirm your identity first, and we may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive.

Deleting your account. Write to privacy@arenta.app and we will delete your account. Some data is kept after deletion as set out in section 8, and content you published that others have shared onward may remain outside our control.

11. Children

The Service is not intended for children, and you must be at least 20 years old to use it. We do not knowingly collect personal data from anyone below that age. If you believe a child has given us personal data, write to privacy@arenta.app and we will delete it.

12. Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in, to remember your theme, language and interface preferences, to hold the device identifier described in section 3.2, and to cache content so that the application works offline. We also record the usage events described in section 3.2 for our own analytics.

We do not use third-party advertising or cross-site tracking cookies. Maps are served by Google, which may set cookies of its own under Google's policies.

13. Changes to this Policy

We may update this Policy. When we do, we publish it as a new version with a new effective date and, where the change is material, we tell you through the Service or at your registered contact details before it takes effect. Every version we publish is kept available.

14. Contact

Arenta Privacy: privacy@arenta.app