Privacy Policy

360SPACE.APP is a marketplace where business owners list and manage their spaces, such as cafés, hotels, campuses and event halls. It is operated by Xoom Enterprises (“360SPACE.APP”, “we”, “us”). We are the controller of the personal information described in this policy.

This policy covers the 360SPACE.APP website, the Control Center, our emails and our support. Guests do not book on 360SPACE.APP: bookings happen in partner apps such as NYC360 and Régisseur, and those apps’ own privacy policies apply to what you share with them.

Information you give us

• Account details: your name, email address, phone number, password (stored only as a secure hash), business name and the account authority you choose at sign-up (Entity Principal, Primary Authorized Representative or Invited Delegated Representative).
• Google sign-in: if you sign in with Google, we receive your name, email address and profile picture from Google. We never see your Google password.
• Listings and workspaces: the details of your spaces, including addresses, opening hours, photos, sections, units, sets, floor plans, amenities and policies, and the team members, roles and permissions you set up.
• Business claims: when you claim a business, your role at the business, your phone number and the proof pictures you upload so our staff can verify the claim.
• Billing details: your plan, subscription status and payment history. Card details are entered directly with our payment processor, Stripe; we never receive or store your full card number.
• Messages: what you send us when you contact support or reply to our emails.

Information collected automatically

• Usage and device data: your IP address, browser and device type, pages visited, and the date and time of requests, recorded in our server logs.
• Cookies and local storage: used to keep you signed in and to remember preferences. See Cookies and similar technologies.

Information from other sources

• Public business listings: to invite businesses to join, our staff may import publicly available business information from Google Maps, such as the business name, address, phone number, website, category, opening hours and rating. Imported businesses are not shown on Explore until the owner claims and launches the listing.
• Team invitations: when an owner invites you to a workspace, they give us your name and email address.

We use personal information to:

• create and secure your account, verify your email address and let you sign in;
• set up your listings and workspaces and publish launched listings on Explore;
• let you invite team members and apply the roles and permissions you choose;
• process subscriptions, renewals, upgrades and failed payments, and keep billing records;
• send service emails, such as verification codes, team and business invitations, claim decisions, payment receipts and payment problems;
• send announcements about 360SPACE.APP, such as new features, planned maintenance and policy changes, which you can turn off at any time;
• review business claims and keep the marketplace accurate and trustworthy;
• answer your support requests;
• detect and prevent fraud, abuse and security incidents, and enforce our Terms of Service;
• understand how the service is used so we can fix problems and improve it;
• comply with legal obligations, such as tax and accounting rules.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it to train third-party AI models.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the service you signed up for, including your account, listings and subscription.
• Legitimate interests: to keep the service secure, prevent abuse, invite businesses whose public listings we imported, provide support and improve the service. We balance these interests against your rights.
• Legal obligation: to keep billing records and respond to lawful requests.
• Consent: where we ask for it. You can withdraw consent at any time.

• Publicly, on Explore: when you launch a listing, its details and photos become visible to anyone visiting 360SPACE.APP. Your account email and phone number are not shown unless you add them to the listing.
• With your team: members of a workspace can see the information their role allows, such as other members’ names and emails.
• With service providers who process data for us under contract: Stripe (payments), Resend (email delivery), Google (sign-in and maps), MongoDB Atlas (database hosting), Vercel (website hosting) and Hostinger (server hosting).
• With booking partners: when your listing is offered through a partner app such as NYC360 or Régisseur, we share the listing details needed for guests to book.
• For legal reasons: when required by law, or to protect the rights, property or safety of our users, the public or 360SPACE.APP.
• In a business transfer: if 360SPACE.APP is merged, acquired or sold, your information may be transferred as part of that transaction, subject to this policy.

To solve a problem you report, an authorized 360SPACE.APP staff member may open your account in a time-limited support session. Every support session is recorded in an audit log, ends automatically after two hours, and cannot change your password or delete your account.

We only use technologies that are needed to run the service:

• Sign-in cookies: a secure, HTTP-only cookie that keeps you signed in, and a small companion cookie that tells the site a session exists.
• Local storage: remembers preferences on your device, such as your language, whether the Control Center sidebar is collapsed, and the spaces and places you saved.

We do not use advertising or third-party tracking cookies. If you block cookies in your browser, you will not be able to sign in.

• We keep your account information for as long as your account is open.
• When you delete your account, it is deactivated straight away and kept for 30 days so support can restore it if you change your mind. After that, it is permanently deleted.
• Billing records are kept for as long as tax and accounting laws require, usually up to seven years.
• Backups are kept for 14 days and then overwritten.
• Server logs and security records are kept only as long as needed for security and troubleshooting.

We use encryption in transit (HTTPS), hashed passwords, short-lived sign-in tokens, role-based access controls and audit logs for staff access. No system is perfectly secure, so please use a strong, unique password and tell us right away at support@360space.app if you think your account has been compromised.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy of it;
• correct information that is inaccurate or incomplete;
• delete your information;
• object to or restrict certain processing;
• receive your information in a portable format;
• withdraw consent where we rely on it.

You can update most account details yourself in Account Settings, and delete your account there under Delete account. For anything else, email support@360space.app. We will verify your identity and respond within the time the law requires (generally within 30 days). We will not treat you differently for exercising your rights.

California residents have the rights above under the CCPA, including the right to know, delete and correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA.

EEA and UK residents may also complain to their local data protection authority.

Service emails about your account and billing are part of the service and cannot be turned off while your account is open. Announcements can be turned off with the unsubscribe link in each one, or under Account settings → Email notifications.

360SPACE.APP is run from the United States, and our servers and service providers are mainly located there. If you use the service from another country, your information will be transferred to and processed in the United States. Where the law requires, we use safeguards such as the European Commission’s Standard Contractual Clauses.

360SPACE.APP is a business service for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us personal information, contact support@360space.app and we will delete it.

We may update this policy as the service changes. We will post the new version on this page and change the “Last updated” date. If a change is significant, we will also tell you by email or in the app before it takes effect.

For privacy questions or requests, email support@360space.app with the subject “Privacy request”. Please include the email address on your account so we can find it.