Privacy Policy

The short version

We hold what we need to run One360 and nothing else. Your drawings, footage, photographs and notes are yours; we do not sell them, share them, or use them to train anything. We do not run advertising and there are no advertising trackers on this site.

Who is responsible

SINAN YILMAZ INFORMATION TECHNOLOGY L.L.C S.O.C, of Office 102, Al Murar, Deira, Dubai, P.O. Box 12232, United Arab Emirates, is the controller of the personal data described here. Write to support@one360.org about anything on this page.

What we collect

When you open an account

Your name, email address, and the company or team you belong to. A password, which we store only as a one-way hash and cannot read. Optionally a profile picture, a phone number and a time zone if you fill them in.

What you put into the service

Floor plans and drawings you upload, 360° footage recorded on site, the walkthroughs produced from it, photographs, notes and replies, project and building names, and the details of the cameras registered to your account (including a camera's Wi-Fi name and passphrase, so your team does not have to retype it — these are the credentials of a device, not of a person).

Where a walk was recorded

When you press Start on a walk, the mobile application reads the phone's location once — its latitude, longitude, how accurate that reading was, and whether another app was simulating it — and sends it with the walk. We use it to check that the walk was recorded on the site of the project it is filed under, and the first walk on a project fixes where that site is. It is kept with the walk as the record of where it was made. The location is not read at any other time, never in the background, and is not used for anything else. You can refuse the permission; walks on projects that check their site then cannot be recorded.

When you pay

Your card details are entered on Stripe's own payment page and never reach our servers. We keep what Stripe tells us: which plan you are on, when it renews, the last four digits and brand of the card, and your invoices.

Automatically

Server logs with the request, the time, the response, and the IP address it came from — kept for 30 days so we can investigate faults and abuse. The two-letter country of your visit, supplied by our network provider, to show prices in a currency you recognise. A session cookie so you stay signed in, and a cookie remembering whether you chose the light or dark theme.

The mobile application keeps a diagnostic log on your own phone so a problem on site can be explained afterwards. It is sent to us only when you choose to send it.

Why we hold it

• To provide the service you subscribed to — this is the performance of our contract with you.
• To take payment and issue invoices, and to keep the accounting records the law requires.
• To keep the service secure and to investigate faults and abuse — our legitimate interest in a service that works and is not attacked.
• To email you about your account, your renewals and material changes to these policies.

We do not send marketing email to your team without asking, and there is an unsubscribe link on anything that is not about your account.

Who else touches it

Only the companies we need to run the service, each handling one part of it:

• OVHcloud — object storage in Europe, for drawings, footage, panoramas and photographs.
• Stripe — payments, cards and invoices.
• Cloudflare — the network in front of the site, and the country lookup used for pricing.
• Amazon SES — sending email.
• Our own processing workstations — computers we operate that turn uploaded footage into a walkthrough. Footage is held on them only while a job is running and is deleted afterwards.

Each of these acts on our instructions, under a contract, and may not use your material for their own purposes. We do not sell or rent personal data to anybody, and we do not share it with advertisers.

We would disclose data if the law required us to. If that happens we will tell you unless we are forbidden from doing so.

Where it is kept

Data is stored in the European Union and in the United Arab Emirates, and moves between our providers under standard contractual clauses where a transfer leaves the EEA.

How long we keep it

• Your content — for as long as your account is open. After an account closes, 30 days, so it can be restored if you change your mind, then deleted.
• Server logs — 30 days.
• Uploaded footage — deleted from our processing machines once the walkthrough is built; the finished walkthrough is kept with your account.
• Invoices and accounting records — as long as UAE tax law requires, currently five years, even after an account closes.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, or send you a copy in a portable form. You can object to processing we do on the basis of legitimate interest, and withdraw consent where we asked for it.

Write to support@one360.org. We reply within 30 days and we do not charge for it. If you are unhappy with our answer you may complain to your local data protection authority.

Security

Everything travels over HTTPS. Passwords are stored as one-way hashes. Two-factor authentication is available on every account and we recommend it. Access to production systems is limited to the people who operate them. Sharing a project outside your account is done with a link you create, which names the person it was made for and can be revoked at any time.

If a breach affects your data we will tell you promptly and say what happened, what we know, and what we are doing about it.

Children

One360 is a tool for construction businesses and is not intended for anybody under 18.

Changes

If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always shows when it last changed.