Borigandee — Privacy Policy

1. Who this applies to

• Customers who book home services.
• Pros (tradespeople) who offer services.
• Website visitors.
• References — people a pro nominates so we can verify them (third-party personal data; see §3).

2. The data we collect

You give us:

• Account & identity: name, phone number, email, and the LINE or Google account you sign in with (we receive your name and email from those providers).
• Customer data: service addresses and the map location/coordinates you set, booking details, messages, ratings/reviews, marketing preferences.
• Pro data: national ID document and a selfie for identity verification, trades/skills, bio, service area, working hours, portfolio photos, bank/payout details, and — at higher trust tiers — references and (for the top tiers) information needed for a background/criminal-record check.
• References' data: the name, relationship, and phone/LINE of people a pro nominates, so we can contact them to verify the pro. (Pros confirm they have permission to share these; references can ask us to delete their data.)
• Payments: processed by our payment provider. We receive limited transaction data and a masked reference; we do not store full card numbers.
• Support & comms: messages to support, dispute details and evidence you upload.

We collect automatically:

• Device & usage: device type/OS, app version, IP address, identifiers, crash/diagnostic logs, and how you use the Services.
• Location: with your permission, your device location (to set your service area / find nearby pros).
• Cookies & similar tech on the website (see §7).

3. How we use your data

• Provide the Services: create your account, match customers and pros, take bookings, hold payment safely and release it, run recurring jobs.
• Verify and build trust: verify pro identity (national ID), perform reference checks and, for higher tiers, background checks; show verification badges and reputation tiers.
• Process payments, payouts, refunds, and our commission and service fees.
• Safety, fraud prevention, dispute resolution, and enforcing our terms.
• Customer support and service messages (booking, payment, dispute notifications).
• Marketing — only with your consent (see §8).
• Analytics to improve the Services; website advertising/measurement only if deployed and with your consent (see §7).
• AI-assisted features: we use a third-party AI processor to screen review text and portfolio images for prohibited content, and to suggest follow-up questions from your job description so you can write a clearer request (see §5).
• Comply with legal, tax, and accounting obligations.

4. Legal bases (PDPA)

We rely on: performance of a contract (to deliver bookings/payments), consent (marketing, location, cookies/ads, sensitive data), legitimate interest (safety, fraud prevention, service improvement), and legal obligation (tax/accounting/law-enforcement requests). Where we process sensitive data (e.g. national ID, criminal-record/background checks), we rely on your explicit consent and applicable PDPA exemptions.

5. How we share data

• Between customers and pros: to make a booking work, a customer and the matched pro see what's needed (e.g. name, job location/address, contact for the job, profile/verification badges, ratings).
• Payment provider — our payment provider processes payments and payouts; we do not store full card numbers.
• Service providers / processors who work on our behalf (database & file storage (Supabase), application hosting & compute ( Fly.io), push notifications ( Firebase Cloud Messaging and Apple APNs), admin dashboard hosting ( Vercel), domain/DNS (GoDaddy), Microsoft 365 (email and service communications), Mailchimp (newsletter and marketing email)) under data-processing terms — see §9.
• Verification: we contact a pro's nominated references; background checks may involve an authorised provider.
• Legal/safety: to comply with the law, respond to lawful requests, or protect rights and safety.
• Business transfers: in a merger/acquisition, subject to this policy.

Third-party AI processor (Anthropic)

We use Anthropic — provider of the Claude AI service — as a data processor to help operate and safeguard Borigandee:

• Content moderation: when you submit reviews, replies, or portfolio images, their text and images may be processed by Anthropic to screen for prohibited or unsafe content.
• Request assistance: when you describe a job, your job description may be processed by Anthropic to suggest follow-up questions that help you write a clearer request.

This may involve transferring data outside Thailand (cross-border transfer). Under our signed Data Processing Agreement with Anthropic, your data is not used to train Anthropic's models and is not retained by Anthropic after the request is processed (zero data retention). We send only what the task needs — never your stored name, address, or contact details with the job description.

Translation provider (Google Cloud Translation)

When you use in-app chat translation, your message text may be processed by Google Cloud Translation to translate between languages. This may involve a cross-border transfer outside Thailand, under data-processing terms. This is a separate provider from Anthropic and is used only for translation.

We do not sell your personal data.

6. Mobile-app specifics

• Permissions we may request: location (service area / nearby jobs), camera & photos (ID verification, job/portfolio/dispute photos), notifications (booking/payment/chat alerts), calendar (optional, to add your jobs). You can manage these in your device settings.
• Push notifications are sent via Expo's push service; you can control categories in-app and at the OS level.
• App stores (Apple App Store, Google Play) process your download/purchase under their own privacy policies.

7. Website cookies, analytics & advertising

We do not currently set advertising or analytics cookies. If and when we introduce them, we will do so through a cookie-consent tool and update this notice.

As features roll out and only with your consent, we may use:

Analytics

• Google Analytics 4 — usage measurement.

Advertising & conversion measurement (incl. remarketing)

• Google Ads
• Meta / Facebook Pixel
• Microsoft Advertising / Bing UET
• LINE Tag (LINE Ads measurement)
• TikTok Pixel

Tag management

• Google Tag Manager — to deploy and manage the tags above.

Functionality & security

• Google Maps — to show maps and location features (loads content from Google).
• Google reCAPTCHA — to protect forms from spam/abuse (subject to Google's Privacy Policy and Terms).

When these tools are deployed, you will be able to accept or reject non-essential cookies via our cookie-consent tool, and change your choice anytime. You can also opt out via the Google, Meta, Microsoft, LINE, and TikTok ad settings and your browser controls. Google Maps and reCAPTCHA are governed additionally by Google's Privacy Policy.

8. Marketing & communications

• Service messages (booking, payment, dispute, account) are part of the Service and are not marketing.
• Marketing (newsletters, promotions, LINE Official Account messages) is sent only with your consent, which you give at sign-up/terms acceptance and can withdraw at any time (unsubscribe link, in-app setting, or by contacting us).

9. International data transfers

Your data is stored and processed in Singapore (ap-southeast-1) and may be processed by service providers outside Thailand. Where we transfer data abroad, we use safeguards required by the PDPA.

10. How long we keep data

We keep personal data only as long as we need it, then delete or anonymise it. Our retention periods:

• Account profile (name, contact details, addresses): while your account is active; deleted or anonymised 12 months after the account becomes inactive.
• Pro identity documents (national ID image, selfie — sensitive data): while you are an active pro; kept for up to 365 days after account closure (so we can address any later customer claim or dispute), then deleted.
• Background-check data (higher trust tiers — sensitive data): we keep only the result and date, not the underlying report; the report is deleted within 30 days of the verification decision.
• Bookings, payments, payouts, fees and commission: retained for 5 years to meet Thai tax and accounting obligations.
• Dispute records and evidence: 2 years after the dispute is resolved.
• Messages and support tickets: messages are kept while your account is active and purged on closure (subject to any dispute hold); support tickets up to 2 years.
• Marketing-consent records: until you withdraw consent, plus a short period to evidence the consent.
• Device, usage and crash logs: up to 24 months.

We may keep limited data longer where the law requires, or as needed to resolve disputes and prevent fraud.

11. Your rights (PDPA)

Subject to the law, you may: access your data, request a copy/portability, correct it, delete it, restrict or object to processing, and withdraw consent. To exercise these, contact dpo@borigandee.com (in-app data-rights tools are also provided). You may lodge a complaint with Thailand's Personal Data Protection Committee (PDPC).

12. Security

We protect your data with encryption in transit, access controls, and secure storage. Payments are handled by our PSP (we don't store full card numbers); your money is held safely and only released when you approve the work. No method is 100% secure, but we work to protect your information.

13. Children

The Services are not intended for anyone under 20 (the PDPA age of majority for independent consent); we do not knowingly collect their data.

14. Changes

We may update this policy; we'll post the new version with a new "Last updated" date and notify you of material changes.

15. Contact

Borigandee Home Co., Ltd. (registered in Thailand, company no. 0105562008598), 42/115 Hua Hin Soi 102, Nong Khae, Hua Hin, Prachuap Khiri Khan 77110 · Privacy/DPO: dpo@borigandee.com