Privacy Policy – From Isan to Isan
Working translation of the German original. In case of doubt the German version prevails.
1. Who is responsible (controller, Verantwortlicher)
From Isan to Isan
Owner: Andreas Horn
Konitzkyweg 8
61231 Bad Nauheim
Germany
Email: datenschutz@fromisantoisan.com
From Isan to Isan is an app through which farmers in Thailand rent and rent out agricultural machinery.
2. Which data we process (verarbeiten)
When you create an account
- Email address – when you sign in with email, or if you voluntarily add it after signing in with LINE
- Your password – when you sign in with email. The app does not store it itself but only passes it on to the sign-in of our provider Supabase. There it is not stored in plain text but as a bcrypt hash with a random salt; the password itself cannot be recovered from it.
- LINE user ID, LINE display name and LINE profile picture address – when you sign in with LINE. We do not receive an email address from LINE.
- A user ID assigned by our system
- Your display name, which you choose yourself
When you create a renter profile or a listing
- Location as an administrative unit – province, district and sub-district, chosen from a list (approximate location)
- Precise location (GPS) – only if you voluntarily provide it by tapping “ระบุตำแหน่ง” (“record location”; German: „Standort erfassen"). The app asks for your permission (Erlaubnis) to do so.
- Photos – of your profile or your machines
- Listing details – category, title, description, price, technical details, operating hours, notes on travel to the field
When you book or rent out
- Booking details – machine, period, handover time, area in rai, price
- Meeting point – location, GPS coordinates if you wish, and a note
- Reviews – stars and a text, after a booking
- Notifications we send you about this – occasion, delivery route (today email only), whether it was delivered
When you report something or block someone
- The report – what was reported, the reason, your comment and an excerpt of the reported content
- The block – who blocked whom
When you use the app without an account
If you search for machines near you, the app sends your current location to our server for the search. It is used for this purpose and not stored.
What stays only on your device
The app stores on your phone your sign-in, whether you rent or rent out, which bookings you have already seen and whether you know the hint about swiping. This information does not leave the device.
What we do NOT collect
No crash reports, no diagnostic data, no advertising or analytics services.
What you are required to provide
There is no statutory obligation (gesetzliche Pflicht) to provide us with data. You can browse machines without an account.
For an account we need an email address with a password, or your sign-in with LINE – without it we cannot sign you in. After your first sign-in you create a profile: your name, province, district and sub-district and at least one photo. Without this profile you can neither book nor rent out.
For a listing we need the category, a title, the price, province, district and sub-district, whether a driver comes along, the operating hours and at least four photos, and depending on the machine also technical details such as cutting width, tank capacity or area output. For a booking we need the province, district and sub-district of the meeting point.
Voluntary are the precise location via GPS – everywhere –, the description of the listing, the notes on travel to the field, the note on the meeting point and, after signing in with LINE, an email address. If you leave them out, this has the following consequences: without a precise location your listing does not appear in the search for machines nearby. Without an email address you receive no notifications by email; you then see notices about your bookings only in the app. You can still use the app.
Data about you that does not come from you
If another user reports you or content of yours – a listing or a review –, we receive from them which content is concerned, the reason for the report, their comment, an excerpt of the reported content and whether they blocked you at the same time. If another user reviews you after a booking, we receive from them stars and, if they write one, a text – relating to that booking and to whether you were the renter or the owner. If someone blocks you, we receive who blocked whom. In all three cases we store the time. The source (Quelle) of this information is in each case the other user.
3. For what purposes and on what legal basis (Rechtsgrundlage)
We process your data
- to provide you with an account and sign you in
- to display, find and book machines
- to bring renters and owners together and to agree on the meeting point
- to notify you about bookings, changes of date and cancellations
- to enable reviews, so that others can judge whom they are dealing with
- to handle reports and prevent abuse
For providing the account, profiles and listings, bookings, agreeing on the meeting point and booking-related notifications, we process your data insofar as this is necessary to provide you with the functions of the app and to perform our contract with you. This includes the photos and details required for a profile or listing. The legal basis is Art. 6(1)(b) GDPR and, under Thai law, Section 24(3) PDPA.
We process your precise location (GPS) only if you voluntarily use the corresponding function and allow access to your location. This also applies if you search for machines near you without an account; the location is then transmitted only once for the search and is not stored. The legal basis is your consent (Einwilligung) under Art. 6(1)(a) GDPR or Section 19 PDPA. You can withdraw your consent at any time with effect for the future, in particular by turning off location access in your device's settings.
We process reviews so that users can assess the reliability of other users and the review system remains meaningful. We process reports and blocks in order to handle complaints, protect users and prevent misuse of the app. The legal basis for this is our legitimate interest (berechtigtes Interesse) and the legitimate interest of our users in a safe and reliable platform, Art. 6(1)(f) GDPR or Section 24(5) PDPA.
After an account has been deleted, past bookings and reviews given may continue to be stored to the extent described in section 8, insofar as this is necessary for the traceability of past transactions or for the meaningfulness of the review system. The legal basis is Art. 6(1)(f) GDPR or Section 24(5) PDPA.
We are guided by the European General Data Protection Regulation (GDPR, Datenschutz-Grundverordnung, DSGVO). As this app is aimed at users in Thailand, we also take into account the principles of the Thai Personal Data Protection Act (PDPA). We answer enquiries about your data in Thai, German or English.
4. Who sees your data
| What | Who sees it |
|---|---|
| Listings: title, description, photos, price, location, location of the machine rounded to about 1 km, name of the owner | everyone, even without an account |
| Precise location of a machine | only the owner |
| Your display name | everyone, even without an account |
| Stars of a review | everyone, even without an account |
| Text of a review | only signed-in users |
| Renter profile: name, location, photos, GPS location | you, and owners with whom you have booked |
| Meeting point of a booking | only the renter and the owner of that booking |
| Email address | no one except us – it is not shown to other users |
| Reports | only us |
5. Which services are involved
| Service | what for | Location |
|---|---|---|
| Supabase | database, sign-in, photo storage, server functions | data in the EU (Ireland); provider Supabase Pte. Ltd., Singapore |
| Resend | sending all emails: registration, password, change of address, bookings, reports | provider Plus Five Five, Inc. (Resend), USA; sent via data centres in Japan (Tokyo) |
| LINE (LY Corporation) | sign-in with LINE, if you choose it | Japan |
| Google Maps | only if you tap a meeting point: the app passes the coordinates to the maps app or the browser on your phone. The connection to Google is then made by your phone, not by us. | USA |
| Cloudflare | delivery of the website www.fromisantoisan.com – see section 10 | USA |
Beyond this, we only disclose data if we are required to do so by law or are obliged to do so by an authority or a court.
6. Transfers to third countries (Drittländer)
The database is located in the EU. Data reaches countries outside the EU in the following ways:
- Singapore: We use Supabase Pte. Ltd., based in Singapore. There is no adequacy decision (Angemessenheitsbeschluss) of the European Commission for Singapore. Personal data is therefore transferred on the basis of the Standard Contractual Clauses of the European Commission (SCC) under Art. 46(2)(c) GDPR. The transfer is thereby at the same time based on appropriate safeguards under Section 29 PDPA. A copy of the Standard Contractual Clauses can be requested from us.
- USA: We use Resend, a service of Plus Five Five, Inc., based in the USA. Resend is certified under the EU-U.S. Data Privacy Framework. Personal data is therefore transferred to the USA on the basis of the adequacy decision of the European Commission under Art. 45 GDPR. Where this does not apply, the transfer is based on the Standard Contractual Clauses of the European Commission under Art. 46(2)(c) GDPR or Section 29 PDPA.
- USA, when visiting the website: via Cloudflare, see section 10.
- Japan: via LINE, if you sign in with LINE, and via Resend, which sends our emails from Japan (Tokyo). For Japan, an adequacy decision of the European Commission applies.
- Server functions: run in the EU (Ireland), like the database.
- Thailand: The users themselves are in Thailand; what they post in the app is seen by other users there.
On request to datenschutz@fromisantoisan.com we will send you a copy of the Standard Contractual Clauses (Standardvertragsklauseln) on which we rely.
7. How long we keep data
- As long as your account exists: everything listed above.
- After you delete your account – see section 8 and the page https://www.fromisantoisan.com/en/delete-account.
- Photos that you remove from a listing or your profile are deleted from storage; the same applies to the photos of deleted listings and profiles. Photos that you upload but do not save are deleted after one hour at the earliest, the next time you open the app or save something. A booking keeps the first photo of the machine as of the time of booking. If the owner removes exactly this photo or deletes the listing, a placeholder then appears in the booking instead of the image.
- Notifications: until your account is deleted.
- Reports: until their handling is completed. Insofar as this is necessary to document the handling, to prevent misuse or for legal defence, we then keep them for up to three years. Reports whose handling is never completed are deleted three years after they were received.
- Sign-in data after an account has been deleted: at most three years – see section 8.
- Logs of our provider (for example accesses to the server): one day; sign-in logs one hour.
8. Deleting your account
In the app: gear icon → “ลบบัญชี” (“delete account”; German: „Konto löschen"). Without the app: an email to datenschutz@fromisantoisan.com.
Deleted (gelöscht) are your name, your renter profile, your listings, your photos, your meeting points as a renter and your notifications. Open bookings are cancelled.
Retained (aufbewahrt) – without your name – are past bookings, insofar as they are still needed for the traceability of past transactions. Technically they remain assigned to your former account, because otherwise the other party could no longer trace its own booking; your name no longer appears there. Reviews you have given or received are also kept, so that the review history of the other party in each case remains complete and meaningful. Any further storage of personal data only takes place insofar as statutory retention obligations apply or the data is needed to establish, exercise or defend legal claims.
Your sign-in data also remains stored – the email address with which you signed in, or your LINE user ID. Anyone who signs in with it again sees the message “บัญชีนี้ถูกลบแล้ว” (“This account has been deleted”) and is signed out again. During this time, no new account can be created with the same sign-in data. At the latest three years after your account was deleted we also remove this information; the address is then free again. On your request to datenschutz@fromisantoisan.com we remove it earlier.
9. Your rights
You have the right of access (Auskunft), rectification (Berichtigung), erasure (Löschung), restriction of processing (Einschränkung der Verarbeitung), data portability (Datenübertragbarkeit) and objection (Widerspruch). You can withdraw your consent (Einwilligung) at any time – for example for the location – in your phone's settings. The lawfulness of processing based on your consent before its withdrawal remains unaffected. Write to us: datenschutz@fromisantoisan.com.
You can also lodge a complaint with a data protection supervisory authority (Datenschutzaufsichtsbehörde). The authority competent for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany. In Thailand, complaints can be lodged with the Office of the Personal Data Protection Committee (PDPC).
The app sets two limits automatically: you can cancel a booking yourself at most twice within 60 days and only up to three days before it starts – after that you cancel via the owner – and submit at most twenty reports in one day. We make no further automated decisions about you (automatisierte Entscheidungen): there is no automatic blocking of your account and no sorting by your ratings. We calculate the stars next to your name automatically, but they are nothing more than the average of what other users have given you; we add no assessment of our own of your person.
Your right to object (Widerspruch)
Insofar as we base the processing of your data on a legitimate interest – this concerns reviews, reports and blocks, the retention of past bookings and reviews after an account has been deleted, and the operation of our website –, you can object to this processing at any time. Grounds relating to your particular situation are sufficient. We will then no longer process this data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Write to us at datenschutz@fromisantoisan.com.
10. The website www.fromisantoisan.com
The website www.fromisantoisan.com contains information about the app and these legal texts. The website sets no cookies, runs no JavaScript, loads nothing from third-party servers and uses no tools that count or analyse visits. There is no contact form; you can reach us by email.
Who delivers the website: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes the data on our behalf as a processor (Auftragsverarbeiter; Auftragsverarbeitung).
What is collected when a page is requested: When our website is accessed, technically necessary connection and request data is transmitted to Cloudflare. This includes in particular your IP address, the time and the address requested and, where applicable, browser and referrer information. Cloudflare processes this data in order to provide our website and to protect it against attacks and abusive access. We do not analyse it any further for analytics or marketing purposes.
How long: Only as long as necessary for delivery and for protection against attacks.
Legal basis (Rechtsgrundlage): Cloudflare is used on the basis of Art. 6(1)(f) GDPR or Section 24(5) PDPA. Our legitimate interest lies in the secure, stable and efficient provision of our website and in protection against abusive access and attacks. Insofar as technically necessary information is stored on or read from your device for this purpose, this is done under German law in accordance with Section 25(2) No. 2 TDDDG.
Transfer to the USA: Cloudflare is certified under the EU-U.S. Data Privacy Framework. Personal data is therefore transferred to the USA on the basis of the adequacy decision of the European Commission under Art. 45 GDPR. Where this does not apply, the transfer is based on the Standard Contractual Clauses of the European Commission under Art. 46(2)(c) GDPR or Section 29 PDPA.
11. Changes
The version in force is published with its date on our website. In the event of material changes we will notify you by email, provided you have given us an email address.
Last updated: 1 October 2026