Privacy Policy

1.1 Account and profile data

• Full name
• Residential unit number, building, and property details
• Contact information: telephone number (optional) and email address
• Device identifiers and IP addresses (for security and platform integrity)
• Profile photographs (where provided)
• Identity details, where your property records them: ID card, passport or driving licence number, and copies of those documents

1.2 Communications

• Chat messages between residents and the property management team
• Social posts, and the moderation record created when another resident reports a post

1.3 Property records

• Notice photographs — images attached to a property notice
• Parcel records — arrival photograph, tracking number, recipient (including a free-text name for someone not registered on the Platform), staff note, and timestamps
• Parcel handover logs — who collected the parcel, and the name of the staff member who released it
• Visitor records — visitor name, access code, pass link, and gate scan events, including reusable passes issued for a helper, nanny, or driver. This category includes personal data about people who have never installed the app, supplied to us by a resident.
• Visitor ID photographs — where the property requires it, a photograph of a visitor's identity document (for example, a national ID card or passport), taken by the property management team at the gate to check who is entering. We keep the photograph itself; we do not read or extract the details on it into separate records. The photograph is deleted automatically at the end of the retention period the property sets (see Section 5).
• Maintenance requests — title, description, and up to five photographs per request
• Suggestions — topic, description, and an optional photograph
• Amenity bookings and shuttle use — which facility, when, by whom; shuttle timetable and live-status use
• Payment slip images — a photograph or scan of a bank transfer slip, uploaded to settle an invoice
• Billing and payment records — issued invoices, amounts, payment method, and status
• Household invites — the name and phone number or email of someone a resident invites to their unit, supplied by that resident.

1.4 Camera and photo library access

The Platform uses the device camera and photo library for seven purposes: scanning invite, pickup, and visitor QR codes, and photo capture for notices, parcels, visitor ID cards, maintenance requests, suggestions, and payment slips. Any of these photo uploads may come from the camera or from an existing image in your photo library.

1.5 Website enquiries (qasaliving.com)

When you submit a support or sales form on our website, we collect the details that form asks for, your message, and any file attachments. We also process the network (IP) address of the request to block automated submissions and to limit how many can be sent in a day, not as part of your enquiry, and on the basis of our legitimate interest in protecting the site from abuse.

1.6 Cookies and similar technologies

Our website uses cookies and similar technologies for analytics and security. For details on what we use and how to manage your preferences, see our Cookie Policy.

1.7 Abuse-prevention data

To prevent spam and automated abuse of our forms, we apply short-lived daily submission limits keyed on the contact details provided and the requester's network address, and we use a hidden field designed to capture automated ("bot") submissions.

1.8 Agreements

When you accept an invitation in the app, we record which version of the Terms of Use you agreed to and which version of this Policy you were shown, with the language and the time.

1.9 App usage and crash reports

In the Resident App, which features are used and when the app crashes are reported without your name or contact details. Crash reports carry an internal account number so we can fix the problem, and the Resident App doesn’t collect your phone’s advertising identifier. In the QasaStaff App, usage and crash reports identify the staff member so we can support them.

We process your personal data on the following lawful bases under the PDPA:

• Contractual Necessity: To fulfil obligations under your property management or tenancy agreement.
• Legitimate Interests: To operate, maintain, and continuously improve the Platform, to respond to and process enquiries submitted through the website, and to protect our forms against abuse.
• Legal Obligation: To comply with applicable Thai laws and regulatory requirements.
• Explicit Consent: Where required, particularly for sensitive personal data as defined under Section 26 of the PDPA.

The Platform needs the data in this Policy to work, so there is no opt-out for it. If you don’t want it used, you can delete your account (Section 8); we then keep only what the law requires.

We use your personal data to:

• Provide and support core Platform features for residents and the property management team, including notices, parcels, maintenance requests, suggestions, visitor management, amenity bookings, and billing
• Deliver notices, announcements, and operational updates from your property management team
• Respond to support and sales enquiries submitted through the website
• Understand how the Platform is used, from usage and crash reports (anonymous in the Resident App), to fix problems and improve it
• Prevent abuse of our forms and services
• Translate notices, chat messages, and social posts into your chosen language, and read parcel label photographs to identify who a parcel is for, using AI (see "Artificial intelligence" below)
• Comply with legal and regulatory obligations under Thai law

Artificial intelligence. We use AI service providers for the following, and send them only the content each feature needs:

• Translation: the text of notices, and of any chat message, social post, or comment you ask to have translated, together with the target language. We also send residents' names so they can be written in other scripts (for example, Thai and English), which helps staff match parcel labels to the right resident.
• Parcel label reading: the photograph of a parcel label, which can show the recipient's name, unit, address, phone number, carrier, and tracking number.

The providers return the translation or the label details to us, and these are stored in the Platform with the record they belong to. We do not use your data to train AI models.

We disclose personal data only as follows:

• Your property management team, for the property you reside in or manage, as needed to operate the Platform (e.g., notices, parcels, maintenance, visitor passes, billing).
• Service providers who process data on our behalf, under contractual confidentiality and data protection obligations:
  • Resend — email delivery, including message attachments
  • Cloudflare — anti-automation / bot-challenge protection, which receives the requester's IP address
  • Google — usage analytics (Firebase, anonymous in the Resident App), and AI translation (Gemini)
  • OpenAI — AI translation when Google's service is unavailable, and text-to-speech
  • Amazon Web Services — AI reading of parcel label photographs (Amazon Bedrock), and text messages for one-time codes and invitations
  • Twilio — checking phone numbers
  • Apple and Google — delivering push notifications
  • Sentry — app crash reports
  • AppsFlyer — counting app installs, without advertising identifiers
• Legal and regulatory authorities, where required by law or to protect the rights, property, or safety of the Company, our users, or the public.

We do not sell personal data.

Our standard retention period is 3 years from the date of last activity for account data, unless a longer period is required by Thai law or regulatory obligation.

Visitor ID photographs. Visitor ID photographs contain personal data, so we handle them more strictly than other records:

• Storage: they are kept in private storage on Amazon Web Services (Amazon S3) and encrypted at rest with AES-256. They are never published on a public or permanent link, or through a content delivery network.
• Access: only people the Platform allows to see the visit (the property's staff and the resident being visited) can view a photograph. Each time they open it, the Platform creates a new temporary link that expires.
• Retention: visitor ID photographs are deleted automatically at the end of the retention period the property sets: 30, 60 or 90 days from the visitor's entry.

Other files that contain sensitive personal data are stored and accessed in the same way, and are kept for the periods described above. The retention period in this list applies to visitor ID photographs only; the rest of a visitor record is kept as described above. We plan to give properties more control over this period, including a shorter one.

You may request deletion of your account and associated data at any time, subject to the exceptions described in Section 7.

Agreement records are kept as long as the law requires, including after an account is deleted.

Platform data is hosted within US-based data centres in encrypted form, or in jurisdictions that provide an adequate level of data protection as recognised under the PDPA's cross-border transfer provisions.

Website enquiry data is additionally processed outside Thailand by Resend (email delivery), Cloudflare (bot protection), and Google (analytics). Each provider processes data under its own data protection terms.

Content sent to our AI service providers is processed outside Thailand: parcel label photographs by Amazon Web Services in the United States, and text for translation by Google and, as a fallback, OpenAI, in the United States or other countries where they operate. Each provider processes this data under its own data protection terms.

Under the PDPA and, where applicable, the GDPR, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Correct any inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your account and personal data. We will erase what we are able to. Some records must be kept for a period set by Thai law or by the property's own contract — issued invoices, parcel handover logs, and visitor records are the usual examples — and we will tell you which of these apply to your data and when they expire.
• Right to Object: Object to certain processing of your data, subject to applicable legal requirements.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal. We rely on consent only for sensitive data. The rest of the data in this Policy is needed for the Platform to work; to stop its use, delete your account.
• Right to Lodge a Complaint: Lodge a complaint with the Personal Data Protection Committee (PDPC) of Thailand if you believe your data protection rights have been violated.

Verified requests are processed promptly, subject to applicable legal requirements. To exercise any of these rights, submit a written request to support@qasaliving.com. All requests will be acknowledged within 72 hours and resolved within 30 business days.

If you have a Resident App, QasaStaff App, or Admin Dashboard account, you may request deletion of your account and associated personal data at any time, using either method below:

• In-app: Resident App: More › Profile › Delete Account. QasaStaff App: Profile › Delete account. In the Admin Dashboard, use the equivalent path.
• By request: Email support@qasaliving.com from your registered address.

We will delete or de-identify your personal data within 30 business days of a verified request, except for records we are required to retain under Section 7 (issued invoices, parcel handover logs, visitor records, and the record of the Terms you agreed to), which will be retained only for the legally required period and then deleted. QasaLiving keeps only what the law requires, such as records needed for legal or billing reasons.

We implement reasonable technical and organisational measures — including encryption in transit and at rest, access controls, and regular review of our practices — to protect your personal data against unauthorised access, disclosure, alteration, or destruction. No system is completely secure, and we cannot guarantee absolute security.

The Platform is for adults, and for minors who have a parent’s or guardian’s permission, such as household members. The age of majority follows the property’s country: 20 in Thailand and 18 elsewhere. If you believe a child is using the Platform without that permission, contact us at support@qasaliving.com.

When this Privacy Policy changes, the new version is published here with its effective date.

For all privacy-related inquiries, please reach out to us directly:

• Email: support@qasaliving.com
• Company: MessageSpring Co., Ltd.
• Location: Bangkok, Thailand