UNDER ROOF PRIVACY POLICY

Effective date: 17 August 2026
Private Beta Version

1. About Under Roof

Under Roof is a Phuket property platform currently operated by Plaifa Malasri in Thailand (“Under Roof”, “we”, “us” or “our”).

For purposes of applicable personal data protection law, including Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), Plaifa Malasri is currently responsible for determining how personal data processed through Under Roof is used.

Privacy and support contact:

Email:
[email protected]

Phone / WhatsApp:
+66 94 298 2498

Correspondence address:
The Base Uptown Phuket
155 Chalermprakiat Ratchakan Thi 9 Road
Ratsada, Mueang Phuket District
Phuket 83000
Thailand

Under Roof is currently operating as a private-beta platform and is not yet operated through a registered company. This Policy will be updated when the formal operating entity is established.

2. Scope of this Privacy Policy

This Privacy Policy applies when you:

• visit underroofphuket.com;
• create or use an Under Roof account;
• save properties to Favorites;
• submit property enquiries or viewing requests;
• request Owner or Independent Agent access;
• submit or manage property listings;
• communicate with Under Roof;
• participate in the private beta;
• use Client, Owner, Independent Agent or Administrator functionality where authorized.

3. Personal data we may collect

Depending on how you use Under Roof, we may process:

Account and identity information, such as your name, email address, profile information, account status, verification status and connected authentication provider.

Contact information, such as email address, telephone number and information you provide when communicating with Under Roof.

Property-search information, such as preferred locations, budget, property type, requirements, saved properties and other preferences you voluntarily provide.

Enquiry and viewing information, including the property concerned, enquiry type, message, submitted date, status and related communications.

Owner information, such as Owner-access requests, property information, listing submissions and information reasonably required to establish that a person is authorized to list or manage a property.

Independent Agent information, such as Agent-access requests, business/experience information, listing submissions, Leads and Deal-related information available to the Agent through their authorized account.

Property and media information, including descriptions, prices, locations, features, photographs and other content submitted for review or publication.

Deal and commission information, where applicable, including Deal status, applicable commission arrangement, participant entitlement, invoice/reference information and external payment status.

Under Roof does not operate a payment wallet or escrow service and does not hold rent, deposits or property-purchase funds on behalf of users.

Technical and security information may include IP address, browser/device information, authentication/session information, timestamps, security events and technical logs necessary to operate and protect the service.

Authentication information may include information received from Google, Facebook or another supported authentication provider when you choose to sign in through that provider. Under Roof does not receive your Google or Facebook password.

4. How we obtain personal data

We primarily receive information:

• directly from you;
• through your use of Under Roof;
• from authentication providers you choose to connect;
• from property Owners, Agents or other parties involved in a property enquiry or Deal where necessary to provide the service;
• from service providers operating infrastructure on our behalf;
• from Under Roof’s own operational records relating to your interactions with the platform.

5. Why we use personal data

We may process personal data to:

• create, authenticate and manage accounts;
• provide Favorites, enquiries and dashboard functionality;
• respond to property enquiries and arrange viewings;
• help Clients identify suitable properties;
• review and moderate property submissions;
• manage Owner and Independent Agent verification;
• manage role requests and account permissions;
• provide authorized Leads and Deal workflow functionality;
• administer applicable commission and external-payment records;
• communicate account, property, enquiry or verification updates;
• provide customer support;
• detect abuse, fraud or security incidents;
• maintain system integrity, backups and audit records;
• comply with applicable laws and legal obligations;
• establish, exercise or defend legal claims.

Depending on the activity, processing may rely on steps requested before entering into an agreement, performance of an agreement, compliance with legal obligations, legitimate interests, or consent where consent is required.

Where consent is the appropriate legal basis, you may withdraw that consent subject to applicable law and without affecting processing lawfully carried out before withdrawal.

6. Owner and Agent verification

Approval to access an Owner or Independent Agent role does not itself establish legal ownership of a property or authority to act for every property.

Under Roof may require additional verification before enabling certain Owner, Agent, property-management or financial functionality.

If additional identity or ownership documentation is required, we will limit its use to legitimate verification, security and legal purposes and may provide additional privacy information where appropriate.

7. Property publication

Information intentionally approved for a public property listing may be visible publicly on underroofphuket.com.

This can include information such as:

• property type;
• area/general location;
• Rent or Sale classification;
• price;
• bedrooms/bathrooms;
• living or land size;
• property features;
• photographs;
• availability;
• approved description.

Under Roof is designed not to publish private Owner or Agent contact details, internal notes, private addresses/coordinates, verification evidence or internal CRM information as part of normal public listing data.

8. Service providers and data sharing

Under Roof does not sell personal data to advertisers.

We may disclose information to service providers where reasonably necessary to operate the platform. Current infrastructure may involve providers for:

• cloud hosting and content delivery;
• database, authentication and storage;
• transactional email;
• OAuth/social authentication;
• cloud file storage;
• security, backup and technical operations.

These providers currently include services such as Supabase, Cloudflare, Google and Resend, depending on the functionality used.

We may also disclose information where required by law, court order, competent authority, or where reasonably necessary to protect users, Under Roof or others from fraud, security threats or unlawful activity.

Property information may also be shared with an Owner, Agent or prospective Client when reasonably necessary to respond to a legitimate property enquiry or progress an authorized transaction.

9. International data transfers

Some of Under Roof’s technology providers operate infrastructure outside Thailand. Personal data may therefore be stored or processed in other countries.

Where an international transfer is subject to the PDPA, Under Roof will seek to use legally appropriate transfer conditions and safeguards, taking into account the destination and service provider involved.

10. Data retention

Under Roof keeps personal data only for as long as reasonably necessary for the purpose for which it was collected.

Retention is determined by factors including:

• whether your account remains active;
• whether an enquiry, listing or Deal remains active;
• Owner or Agent verification requirements;
• security and fraud-prevention needs;
• dispute or claim periods;
• audit requirements;
• applicable accounting, tax or legal retention requirements;
• backup and disaster-recovery requirements.

When personal data is no longer required, we will delete, anonymize or otherwise securely dispose of it where reasonably practicable and subject to legal requirements.

Temporary backup copies may remain for a limited period as part of protected disaster-recovery systems before being overwritten or removed according to backup retention procedures.

11. Security

Under Roof uses reasonable technical and organizational measures intended to protect personal data against unauthorized access, loss, alteration or disclosure.

Measures used within the current architecture include, as appropriate:

• authentication and role-based access;
• row-level access controls;
• separation of public and private information;
• encrypted backups;
• access-controlled cloud storage;
• private property-submission media;
• security and audit logging;
• controlled administrative permissions;
• restricted financial functionality;
• recovery and integrity testing.

No online system can guarantee absolute security.

12. Authentication and cookies

Under Roof uses technologies necessary to operate authentication, security, account sessions and core website functionality.

These may include cookies or similar browser technologies required to keep you signed in, protect your account and remember essential application state.

Under Roof does not currently rely on advertising cookies as part of the private-beta service.

If non-essential analytics, advertising or tracking technologies are introduced in the future, this Policy and any required cookie controls will be updated accordingly.

13. Your privacy rights

Subject to the conditions and exceptions under applicable law, you may have rights relating to your personal data, including rights to:

• request access to your personal data;
• request correction of inaccurate information;
• request deletion or anonymization where applicable;
• request restriction of processing;
• object to certain processing;
• request portability of eligible data;
• withdraw consent where processing is based on consent;
• lodge a complaint with the competent Thai data protection authority.

To exercise a privacy right, contact:

[email protected]

We may need to verify your identity before processing a request in order to protect your account and personal data.

14. Account deletion and data requests

You may contact Under Roof to request account deletion, access to personal data, correction or another applicable privacy request.

Some information may need to be retained after account closure where necessary for legal obligations, disputes, fraud/security prevention, legitimate audit requirements or other lawful purposes.

Deleting an Under Roof account does not necessarily require the deletion of property or transaction records that must lawfully be retained independently of the account.

15. Children

Under Roof is intended for people who can lawfully engage with property services and account functionality.

We do not knowingly seek to collect personal data from children for independent use of the platform. If a child’s information must be processed in connection with a legitimate family property enquiry, appropriate involvement of a parent, guardian or other authorized person should be used where required.

16. Third-party websites and services

Under Roof may contain links to third-party websites, maps, authentication providers or other services.

Their handling of personal data is governed by their own terms and privacy notices. Under Roof is not responsible for the independent privacy practices of third parties.

17. Changes to this Policy

We may update this Privacy Policy as Under Roof develops, new functionality is introduced, service providers change, legal requirements evolve, or the formal Under Roof operating company is established.

Material updates will be reflected by changing the effective date and, where appropriate, notifying registered users.

18. Contact

For privacy questions, data requests or concerns:

Under Roof
Current operator: Plaifa Malasri

Email:
[email protected]

Phone / WhatsApp:
+66 94 298 2498

Correspondence address:
The Base Uptown Phuket
155 Chalermprakiat Ratchakan Thi 9 Road
Ratsada, Mueang Phuket District
Phuket 83000
Thailand