Legal
Privacy Policy
1. Who We Are
TNF360 is a virtual touring platform operated by The Noughty Fox SRL ("TNF", "we", "us"), a company registered in the Republic of Moldova.
- Registration number (IDNO): 1022600002164
- Registered address: Str. Gh. Asachi 4, ap. 64, Chișinău, Republic of Moldova
- Contact for data protection inquiries: support@thenoughtyfox.com
This Privacy Policy explains how we collect, use, store, and protect personal data when you use the TNF360 platform, including the mobile data capture application, the web-based tour editor, and the web-based tour viewer (together, the "Platform").
2. Roles and Responsibilities
When a real estate agency or other organization ("Client") uses TNF360 to create virtual tours:
- TNF as Data Controller: We are the data controller for account data — the information we collect from agents and administrators who register to use the Platform (email addresses, passwords, organization details).
- TNF as Data Processor: We act as a data processor on behalf of the Client for all property-related data captured through the Platform (3D models, panoramic imagery, floor plans, property descriptions). The Client determines the purposes and means of processing this data. Our obligations as a processor are governed by our Data Processing Agreement.
If you are a Client organization, you remain responsible for ensuring you have a lawful basis to capture and publish virtual tours of properties you manage.
3. What Data We Collect
3.1 Account Data (agents and administrators)
| Data | Purpose | Legal Basis |
|---|---|---|
| Email address | Account creation, login, service communications | Contract performance (Art. 6(1)(b) GDPR) |
| Password (hashed) | Authentication | Contract performance |
| Organization name and logo | Branding tours with the agency's identity | Contract performance |
3.2 Property Capture Data (collected via the mobile app)
| Data | Purpose | Legal Basis |
|---|---|---|
| 360° video recordings and device sensor data | Stitching panoramic images for the virtual tour | Contract performance / Legitimate interest |
| 3D spatial model of the property | Generating 2D floor plans for the tour viewer and editor | Contract performance |
| Room type classification | Automatic labelling of rooms in the tour | Contract performance |
| Device GPS location (if permitted by the agent) | Internal validation that the capture corresponds to the listed property address | Legitimate interest (Art. 6(1)(f) GDPR) |
| Sensor data processed by Google (camera and location) | Spatial relocalization via ARCore Cloud Anchors (Android only) | Contract performance |
On Android devices, the Platform uses Google ARCore Cloud Anchors for spatial relocalization. When this feature is active, Google processes sensor data (including camera and location data) on its servers. This processing is governed by the Google Privacy Policy. The app will display a notice before activating this feature. For more information, see how Google Play Services for AR handles your data.
3.3 Tour Viewer Data
We do not collect personal data from individuals who view published tours. We may collect anonymous, aggregated usage metrics (such as view counts) that cannot be used to identify individual viewers.
3.4 Payment Data
Payments are processed through a third-party payment processor. We do not store credit card numbers, bank account details, or other payment instrument data on our servers. The payment processor handles payment data under its own privacy policy and compliance obligations.
4. Capture of Third-Party Personal Data
TNF360 is designed to capture property interiors. Before each capture session, the mobile app recommends that no individuals are present in the frame. If individuals are intentionally included, the agent is responsible for obtaining their explicit consent.
If individuals are captured in panoramic imagery without consent:
- The agent and their Client organization bear primary responsibility for ensuring appropriate consent was obtained or that the property was clear of individuals before capture.
- We do not apply automated face detection or blurring to captured imagery.
- Any individual who believes they appear in a published tour may request review and removal by contacting us at support@thenoughtyfox.com. We will act on such requests within 30 days.
5. Use of Data to Improve Our Technology
We use anonymized and aggregated capture data to research, develop, and improve our technology — including the quality, accuracy, and availability of the Platform across devices and use cases. Raw capture data is retained securely and anonymized at the point of use for these purposes.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR). We have conducted a balancing test and determined that this processing is proportionate because the data primarily depicts property interiors (not people), contributes to meaningful product improvement, and does not create risks to individuals' rights disproportionate to the benefit.
Your right to object: Data subjects (agents and Client organizations) have the right to object to this processing under Art. 21 GDPR. To exercise this right, contact support@thenoughtyfox.com. Upon a valid objection, we will cease using the relevant data for these purposes and remove it within 30 days, unless we can demonstrate compelling legitimate grounds.
6. Data Sharing and Sub-Processors
We share personal data only with the following categories of recipients:
| Sub-Processor | Data Shared | Purpose | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | All platform data | Cloud hosting and storage | EU |
| Google (ARCore Cloud Anchors) | Camera and location sensor data (Android only) | Spatial relocalization for property capture | Global (Google Cloud) |
| PostHog | Anonymous analytics events | Product analytics for the web editor | EU / PostHog Cloud |
| Third-party payment processor | Payment transaction data | Payment processing | Disclosed at point of payment |
We do not sell personal data. We do not share personal data with advertisers.
7. International Data Transfers
All platform data is hosted within the European Union.
For users based in the Republic of Moldova, data is transferred to the EU for processing. Moldova's data protection legislation (Law No. 195/2024, effective August 23, 2026) is aligned with GDPR standards. We apply appropriate safeguards to all cross-border transfers.
During the panorama stitching process, capture data may be temporarily transferred to processing infrastructure located in Chișinău, Moldova. This data is transmitted in compressed form and deleted from local infrastructure after processing is complete.
On Android devices, sensor data is transmitted to Google servers via ARCore Cloud Anchors for spatial relocalization. Google may process this data outside the EU/EEA under its own data processing terms and the Google Privacy Policy.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Published tours (panoramas, floor plans, property metadata) | 1 year from date of capture, unless the Client requests earlier deletion or renewal |
| Raw capture data (video, sensor data, 3D models) | Retained for as long as necessary for platform improvement purposes (see Section 5), subject to periodic review of continued necessity. Deleted upon valid objection or deletion request. |
| Account data (email, password, organization) | Retained for the duration of the account. Deleted within 30 days of account deletion request. |
| Aggregated tour usage metrics (e.g., view counts) | Retained indefinitely in fully aggregated form; no personal data involved |
| Anonymous analytics data | Retained per PostHog's data retention policy (default: 1 year) |
| Payment records | Retained as required by Moldovan tax and accounting law (currently 5 years) |
9. Cookies and Analytics
The TNF360 web editor uses PostHog for product analytics to help us improve the Platform. PostHog may set cookies or use similar technologies to distinguish sessions.
The tour viewer does not use tracking cookies or collect personal data from visitors.
We do not use advertising cookies or tracking pixels. We do not share analytics data with third parties.
10. Your Rights
If you are located in the European Union, the European Economic Area, or a jurisdiction with equivalent data protection rights (including the Republic of Moldova under Law No. 195/2024), you have the following rights:
- Access — Request a copy of the personal data we hold about you.
- Rectification — Request correction of inaccurate data.
- Erasure — Request deletion of your personal data, subject to legal retention obligations.
- Restriction — Request that we limit processing of your data in certain circumstances.
- Portability — Receive your data in a structured, machine-readable format.
- Objection — Object to processing based on legitimate interest, including technology improvement.
- Withdraw consent — Where processing is based on consent (e.g., GPS location), withdraw at any time.
To exercise any of these rights, contact: support@thenoughtyfox.com
We will respond to all requests within 30 days. If a request is complex, we may extend this by a further 60 days with notice.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with:
- Republic of Moldova: Centrul Național pentru Protecția Datelor cu Caracter Personal (CNPDCP), datepersonale.md
- European Union: The supervisory authority in your Member State of residence.
11. Data Security
We implement the following technical and organizational measures to protect personal data:
- All data at rest is stored with server-side encryption within the EU.
- All communications between the mobile app, web interfaces, and our backend use TLS encryption.
- Passwords are hashed using industry-standard algorithms.
- Access to production systems is restricted to authorized personnel.
- We conduct periodic reviews of access controls and security practices.
12. Children's Data
TNF360 is a professional tool for real estate and property management. We do not knowingly collect personal data from anyone under 18 years of age. If we discover that we have inadvertently collected data from a minor, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, technology, or legal obligations. For material changes affecting how we process your personal data, we will notify registered users by email or by an in-app notice before the changes take effect, giving you an opportunity to review and object if applicable. Non-material changes (such as clarifications or typo corrections) may take effect immediately upon posting. The "Last updated" date at the top of this document indicates the most recent revision.
14. Contact
For any questions, concerns, or requests related to this Privacy Policy or your personal data:
The Noughty Fox SRL
Email:
support@thenoughtyfox.com