Legal
Privacy policy
1. Who we are
Propool is a rental management workspace for property managers in Thailand. It brings bookings from Airbnb, Booking.com, Agoda, and direct enquiries into one calendar, and handles nightly rates, availability, and owner statements.
Propool is operated by TEKNIKOZ SOFTWARE PRIVATE LIMITED. For anything in this policy, contact us at privacy@propool.ai.
Property managers who use Propool decide what guest and owner information they put into it. For that information the manager is the data controller and Propool is the processor, acting on their instructions. For account and billing information about the management business itself, Propool is the controller.
2. Information we collect
Account information
When someone creates or is invited to a Propool account we collect their name, work email address, phone number where provided, business, and role. Sign-in is handled by Firebase Authentication (Google LLC), which processes the credentials and issues the session token.
Guest, owner, and property information you enter
Propool stores the records your business creates: properties and their rates and availability, bookings imported from connected channels, guest names and stay details, owner details and the statements you issue them, and any documents or photographs you upload. This is your data. We do not sell it and we do not use it to build advertising profiles.
Booking channels you connect
When you connect Airbnb, Booking.com, Agoda, or another channel, we exchange the information needed to keep availability, rates, and reservations in step, typically listing identifiers, calendar blocks, rates, and the reservation details that channel releases to you, including guest name and stay dates. Each channel's own privacy policy governs what it does with data on its side. Disconnecting a channel stops the exchange.
Google mailboxes you connect
Connecting Gmail is optional and separate from signing in to Propool with Google. If you authorise a mailbox, our email service provider Nylas connects it to Propool. We process the connected account's name and email address, message senders and recipients, subjects, message content, dates, thread identifiers and read status, and attachments used in the inbox. The Gmail permission we request allows reading, composing and sending mail and updating read status; it does not allow immediate, permanent deletion of messages that bypasses Gmail's trash.
We use this information to display correspondence in your workspace inbox, send messages and replies you compose, keep read status in sync, associate correspondence with contacts and leads, and provide the workspace's email enquiry, task and follow-up features. Connected correspondence is available only to authorised users under your workspace's mailbox permissions.
Device permissions on the mobile app
The mobile app asks for these permissions only when you use the feature that needs them, and you can decline or revoke any of them in your device settings:
- Camera: to photograph a property for a listing, or capture an inspection or damage report. Images go to your workspace.
- Microphone: to record a spoken note against a booking or property. Recording starts only when you start it.
- Contacts: to let you add an existing phone contact as a guest or owner, and to save a Propool contact back to your phone. We read a contact only when you pick one.
- Notifications: to alert you about new bookings, cancellations, guest messages, and same-day check-ins. You choose which alerts to receive.
Technical and usage information
Our servers record standard log data: IP address, device and browser type, pages or screens opened, and timestamps. We use it to keep the service running, investigate faults, and detect abuse such as automated sign-in attempts.
The marketing website
When you request an invite on propool.ai we collect the email address you submit and store it in our own database on Google Cloud, which we use to manage the early-access list. We record the request's IP address briefly to rate-limit the form. The site loads Google Analytics only when analytics is explicitly enabled for the deployment; it is off by default.
3. How we use information
- To provide the workspace and the features your agency has enabled.
- To authenticate users and keep accounts secure.
- To send service messages: invites, notifications you have turned on, and notices about outages, security, or changes to terms.
- To support you when you contact us, which may mean looking at the records involved in the problem.
- To diagnose faults, monitor performance, and improve the product.
- To meet legal, tax, and accounting obligations.
We do not sell personal information, and we do not share it with third parties for their own advertising.
Google API data and Limited Use
Propool's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide or improve the user-facing features described above. We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalised artificial intelligence or machine-learning models.
Email text may be processed by Google Gemini to identify property enquiries, suggest or create tasks under your configured automations, and assess outstanding replies and follow-ups. These are features of your workspace, rather than model training. Our AI diagnostics service, LangSmith, may process related inputs, outputs and execution traces to operate and troubleshoot these features. Transfers to service providers are limited to providing or improving these user-facing features and the other purposes permitted by Google's Limited Use requirements.
People at Propool or its service providers may read Google user data only with your affirmative agreement for specific messages, where necessary for security or abuse investigations, to comply with applicable law, or for internal operations using aggregated and anonymised data, as permitted by Google's Limited Use requirements.
4. Legal bases
Our primary framework is Thailand's Personal Data Protection Act (PDPA). Where the PDPA, the GDPR, or comparable law applies, we rely on: performance of our contract with your business to provide the service; our legitimate interests in securing, supporting, and improving it; your consent for optional device permissions and analytics, which you can withdraw at any time; and compliance with legal obligations.
Because guests book from all over the world, records in Propool often include people outside Thailand. Where a guest is covered by the GDPR or another regime, we and the property manager handle their information under that regime as well.
6. How long we keep information
We keep workspace records while the workspace remains in use. For verified account-deletion requests, we aim to erase the covered live data within 30 days. Provider failures remain pending until resolved; accepting a request does not mean erasure has completed. Records required for legal, tax or accounting obligations, or a dispute, may be retained.
Deleted files can remain recoverable under storage soft-delete retention for seven days. Database backups rotate by retaining seven successful backups, and point-in-time recovery logs are retained for seven days. Backup rotation is count-based, so it is not a promise that every backup disappears exactly seven days after a request. Restores must reapply completed deletion records before restored data becomes accessible.
Server logs follow the configured retention schedule. Early-access email addresses are kept until launch outreach is complete, or until you ask us to remove yours.
You can disconnect a mailbox in Settings → Integrations → Email accounts, or revoke Propool's access in your Google Account connections. Disconnecting stops new mailbox synchronisation and requests revocation of the Nylas connection. It does not by itself erase correspondence already stored in your workspace. To request deletion of that stored information, contact privacy@propool.ai or use the account-deletion process below. The retention and backup rules in this section also apply to stored Google mailbox information.
7. Your rights
Depending on where you live, you can ask us to give you a copy of your personal information, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You can also withdraw consent where we relied on it.
Email privacy@propool.ai and we will respond within 30 days. If your information was entered by a property manager using Propool, we will pass your request to them and support them in answering it. If you are unhappy with our response you may complain to a supervisory authority. In Thailand that is the Personal Data Protection Committee (PDPC); in the EEA or UK, your local authority.
8. Deleting your account and data
You can request deletion of your Propool account and associated personal data:
- In the app. Open your profile or owner account page and select Delete my account. The same option is available on the expired-trial, billing-blocked and closed-account screens.
- On the web, including after uninstalling. Open Delete your Propool account, sign in again, review the scope and confirm deletion.
- For assistance or a personal-data request. Contact privacy@propool.ai from your account address. We verify your identity before processing the request.
Account deletion removes your sign-in identity, profile, personal files, private connected communications, preferences and access. Shared workspace business records remain for other members, with anonymous historical attribution where needed. Shared file ownership passes to an active administrator. If necessary, assign another active administrator before leaving.
When the last member of a staff workspace deletes their account, the confirmation also includes permanent erasure of that workspace and cancellation of its subscription. Deletion of an owner-portal account does not delete the agency's workspace.
Access is disabled when a request is accepted. A private status receipt stays in your browser so you can check progress after sign-out; keep it until completion. Erasure waits at least one hour for outstanding upload permissions to expire. Pending and completed states are shown separately. The retention exceptions above still apply after completion.
The separate Close account action only disables workspace access and does not erase personal data.
9. Security
Traffic is encrypted with TLS and data is encrypted at rest. Access to production systems is restricted to staff who need it and is logged. No system is perfectly secure, but if a breach affects your information we will notify you and the relevant regulator as the law requires.
10. International transfers
Propool runs on Google Cloud Platform, with primary hosting in the asia-south1 region. Some providers listed in section 5 process data in other countries. Where information leaves its origin country we rely on recognised transfer mechanisms, such as the European Commission's standard contractual clauses.
11. Children
Propool is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.
12. Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we handle your information, we will tell you in the app or by email before it takes effect.
13. Contact us
TEKNIKOZ SOFTWARE PRIVATE LIMITED
privacy@propool.ai