Privacy Policy

1. What we collect

Account: name, email, organization name, password (hashed), language, and the record of your acceptance of the terms (time, version, IP address). Content: the scan files and photos you upload, the tours built from them, property details and branding you enter, and the record of the content declaration given with every upload. Usage: access logs, IP address, browser type, aggregate tour view statistics (viewers are not identified). Enquiries: messages sent through tour forms (leads) — delivered to the tour owner.

2. Tour content and the people in it

A scan or 360° capture of a property may contain personal data of third parties: people, faces, licence plates, documents, family photos, screens. The customer who uploads the content is the data controller for that data under privacy law: they are responsible for obtaining the consent of people captured, for hiding sensitive details before publishing and for handling requests from people captured. We process that data on their behalf, on their instructions and under the Terms of Service.

We make reasonable efforts to hide faces and sensitive details automatically and through the blur tool in the service, but we do not guarantee complete masking. If you appear in a tour and do not wish to, write to office@plans360.app with the tour link and where in the image you appear; we handle the request (blurring or removal) within 7 working days and inform the tour owner.

3. Why we use it

To provide the service (processing, building and hosting tours), manage your account and subscription, send operational messages (verification, archive reminders, tour ready), secure the system, meet legal obligations and keep evidence of consents. We do not sell personal data and do not use your content for advertising or model training.

4. Legal bases (GDPR)

Performance of a contract (providing the service), legitimate interests (security, abuse prevention, improvement), legal obligations (billing, tax, consent records), and consent — e.g. for non-operational emails.

5. Processors and data location

Vercel (application and tour output hosting, US/EU), Amazon Web Services in the Israel region (il-central-1) for upload storage and tour builds, Neon (database, Frankfurt), Paddle (payments and invoicing — an independent controller for payment data) and Resend (email delivery). All are contractually bound to data protection and process on our instructions only.

6. Retention

Account data — while the account is active and up to 30 days after deletion. Raw source files — 30 days after a successful build, and immediately when an upload is rejected or deleted. Tour outputs — as long as the tour exists (including in the archive). Consent records and billing records — 7 years as required by law.

7. Your rights

Access, rectification, erasure, portability, restriction and objection — write to office@plans360.app and we respond within 30 days. People who appear in a tour may request blurring or removal as described in section 2. EU users may also contact their supervisory authority; in Israel, the Privacy Protection Authority.

8. Security

Encryption in transit (HTTPS) and at rest, hashed passwords, full isolation between organizations, unguessable tour links, direct-to-storage uploads with short-lived credentials, backups and access control. In case of a security incident we notify affected users and authorities as required by law.

9. Cookies

Strictly necessary cookies (sign-in session, preferences, security) always run. No advertising cookies.

Google Analytics 4 (Google Ireland Ltd.) runs only after you accept the consent banner, under Consent Mode v2: until then no analytics cookies are set and no identifiers are sent. IP addresses are truncated, data is not used for advertising, and we use it only to understand which pages and sources bring visitors. You can change your choice at any time by clearing the site data in your browser; the banner will appear again.

Separately from Analytics, at signup we store the first source that brought you to the site (for example 'google / organic' or a campaign name) with the account. This is first-party data kept only by us, without a cookie and without sharing, to measure our marketing channels.

10. Tour viewers

Opening a tour requires no registration. Aggregate view data is collected for the tour owner. The "schedule a visit" form passes the entered details directly to the tour owner, who is responsible for handling them.

11. Contact

PLANS YAZAMOT AND INTERNET (2010), a sole proprietorship of Sharon Cohen registered in Israel, trading as Plans 360 · office@plans360.app · plans360.app. We update this policy as needed and show the date at the top of the page.