Privacy policy

Updated 21 October 2026

Korat360 is operated by KORAT HOME SERVICES COMPANY LIMITED (บริษัท โคราชโฮมเซอร์วิสจำกัด) · Registration no. 0305569005746
Registered address: 333/962 หมู่ 3 ตำบลตลาด อำเภอเมือง จังหวัดนครราชสีมา 30310

The company named above is Korat360’s data controller under Thailand’s Personal Data Protection Act. For data requests, contact hello@korat360.com or write to the registered address above.

Information we collect

When you sign in with Google or Facebook, we use the provider’s account identifier and display name. Google may provide your verified email address. Facebook sign-in currently requests public_profile only, not email. You may supply an email or business contact separately when claiming a listing.

We store business claims, evidence you submit, photographs, posts and drafts, review decisions, and your contact preferences. Essential cookies keep you signed in. Drafts and saved places may also be stored locally in your browser.

How we use it

We use this information to authenticate you, verify authority to manage a business, review submissions, display approved content, prevent spam and answer your requests. Business statistics are aggregate views and link clicks; owners do not receive visitors’ identities. We do not sell personal data.

Business verification by SMS

If you choose SMS verification, we send the staff-confirmed business mobile and code message to ThaiBulkSMS for delivery. Destinations are checked on the business’s own channels; they are not entered by claimants or imported from Google. The verification screen shows masked numbers. Codes expire after 10 minutes, allow up to five attempts and are stored only as hashes. Send records enforce anti-spam limits. Account deletion clears codes and account links while retaining de-identified send reservations to prevent limit evasion. You can use the shop-photo option instead.

Connecting a Facebook Page

Sign-in and Page connection are separate. When you explicitly connect a Page you manage, we encrypt its token and use it only for the selected Page. Reading posts can create suggestions or drafts, which require approval before publication. Connecting a business Page does not authorize us to publish to that Page. Publishing to the Korat360 Page uses a separate authorization flow.

Who can see it

Visitors see published business information and approved content. Authorized reviewers can access contact information, claims and private evidence as needed for review. Hosting, sign-in, anti-spam and translation providers process data for those functions. Text submitted for translation may be sent to OpenAI; passwords and Facebook tokens are not included.

Retention and your choices

We retain account information while the account is active and submission information as needed for review. You can disconnect Facebook or request account deletion. Private business-verification documents are deleted after a decision. Email deletion requests are handled within 30 days. Lawfully published business information, image-license evidence and records necessary for legal obligations may remain, disconnected from your account where possible. Provider backups expire through their normal lifecycle and are not used to reactivate a deleted account.

How to delete your account and data · hello@korat360.com

Contact Korat360 to request access, correction or deletion of your data. Do not send passwords or verification codes.