We may collect the following categories of information:

• Account information: phone number, display name, profile photo, role (normal user or agent), and optional social login identifiers when you sign in with Facebook, Google, Apple, or Telegram.
• Listing and profile content: property details, photos, descriptions, contact preferences, agency affiliation, and verification (KYC) submissions where applicable.
• Credit and payment data: records of credit purchases, redemptions, and transaction history processed through our payment partners. We do not store full payment card numbers on our own servers.
• Usage data: pages viewed, searches, saved listings, filters applied, device type, browser, IP address, and approximate location derived from IP or explicit device location permission.
• Map interaction data: interactions with our proprietary map (pan, zoom, pin drops, area views), used solely to deliver and improve the Service.
• Communications: messages you send through the Service, in‑app notifications, and support requests.
• AI interaction data: inputs you provide to our proprietary AI features (e.g., search refinements, content suggestions) used to generate results and improve model performance.

Our map interface is built on MapLibre GL and renders base‑map tiles from third‑party providers (OpenStreetMap, OpenMapTiles, and OpenFreeMap) or from our own tile servers when configured. When you use the map, your device may request tiles from these providers, which can see your IP address and approximate location. The Service does not use Google Maps. Our AI‑powered search and recommendation features are developed in‑house; listing text is processed by an embedding service we operate to generate searchable vectors.

We use information to:

• Provide, maintain, and improve the Service, including the map interface, search, AI‑driven recommendations, and listing features.
• Verify your phone number and identity where required for trust, safety, and compliance with our listing policies.
• Show relevant property listings, including location‑based results when you grant location permissions.
• Operate the credit system: manage credit balances, process purchases, and apply credits for premium features (featured listings, boosts, etc.).
• Send service notifications, security alerts, and, with consent where required, promotional communications.
• Train and refine our proprietary AI models using aggregated or anonymised interaction data to improve listing relevance, search accuracy, and user experience.
• Detect, investigate, and prevent fraud, abuse, money laundering, and policy violations.
• Comply with applicable law, lawful requests, and regulatory obligations in Myanmar or other jurisdictions where we operate.

We do not use personal data to make solely automated decisions that produce legal effects or similarly significant impacts without human involvement.

We may share information in these situations:

• With other users: listing contact details and public profile information you choose to display.
• With service providers: hosting, SMS/OTP delivery, identity verification, cloud storage, and payment processors. These providers act on our instructions and are bound by contractual confidentiality and security obligations.
• With social login providers: when you choose to authenticate through them, subject to their privacy policies.
• For legal reasons: when required by law, court order, or to protect the rights, property, or safety of AeinMap, our users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with prior notice where required by law.

No sale of personal data: We do not sell, rent, or trade personal information as defined under applicable privacy laws, including the California Consumer Privacy Act (CCPA) and other similar regulations. Our business model is based on listings, credits, and premium features – not on monetising your personal data.

Third‑party recipients: To operate the Service we work with the following categories of providers: cloud storage (Alibaba Cloud Object Storage Service, used for uploaded images, KYC documents, and listing media); push notification delivery (Firebase Cloud Messaging); social sign‑in (Apple, Google, Facebook, Telegram) when you choose to authenticate; base‑map tile providers (OpenStreetMap, OpenMapTiles, OpenFreeMap) to render the map; and payment processors or app‑store billing services for credit and subscription purchases. Each provider receives only the information needed to perform its function, is bound by contractual confidentiality and security obligations, and is required to protect personal data to a standard comparable to our own.

AeinMap offers map‑based property browsing. Some features (for example, nearby listings, radius search, or the “map as an ad board” view) may request access to your device’s precise location.

• Location data used to render the map: base‑map tiles are fetched from third‑party tile providers (OpenStreetMap, OpenMapTiles, OpenFreeMap) or from our own tile servers; tile requests may include your IP address and approximate location. The Service does not use Google Maps, and precise location is not shared with advertising partners.
• Location information is used solely to improve search relevance, display nearby listings, and personalise your map experience.
• We do not store your real‑time location longer than necessary for the requested feature, unless you save a location‑based preference (e.g., favourite areas).
• You can disable location access at any time through your device or browser settings. Disabling location may limit certain map features.

AeinMap integrates artificial intelligence features developed entirely in‑house. These models help with:

• Property listing recommendations and ranking.
• Search intent understanding and auto‑suggestions.
• Image analysis and content moderation (e.g., detecting inappropriate listings).
• Credit‑based promotional optimisation.

Embedding processing: To enable semantic search, listing text (title, description, hashtags, and key attributes) is converted into numerical vectors by an embedding service that we operate. These vectors are stored with the listing and are removed or regenerated when the listing is deleted or its content changes.

Data used for training: We may use aggregated, de‑identified, or anonymised interaction data to train and improve these models. We do not use identifiable personal messages or private account details for training without explicit consent, and AI inputs and generated outputs are retained only as long as needed to provide the Service.

Human oversight: Our AI does not make decisions that have legal or similarly significant effects on you (e.g., denying access to housing) without human review. If you believe an automated process has impacted you unfairly, please contact us.

AeinMap uses a point system (“credits” or “points”) to access features such as posting a listing, featured listings, listing boosts, or other promotional tools. When posting a listing, you choose a listing duration and the point cost for that duration is shown before you confirm. Points are then deducted from your balance.

• Mobile apps are display-and-spend only: they show your credit balance and usage history, and let you spend existing credits by choosing a listing duration at post time. Mobile apps do not sell credits, do not process payments, and do not collect credit/debit card numbers, bank credentials, or store-billing payment data.
• Credit top-ups, where available, are handled outside the mobile apps via customer support (for example, a support contact link on the website). We do not see or store your full credit/debit card number or banking credentials.
• We retain only transaction records necessary for accounting, balance management, and dispute resolution: date, amount, credits granted or spent, expiry, listing duration selected, and an admin or support reference. No financial account numbers are shared with other users.
• No subscriptions are sold inside the mobile apps in the current version. If Apple In-App Purchase or Google Play Billing is offered in the future, this policy and our store listings will be updated before launch.

Unused credits are subject to the terms outlined in our Terms of Service.

We use cookies, local storage, and similar technologies for authentication, session management, preferences, analytics, and security. You can control cookies through your browser settings; however, disabling certain cookies may limit functionality.

See our Cookie Policy for detailed information on specific cookies, their purposes, and retention periods.

We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations (including Myanmar company law and DICA requirements), resolve disputes, and enforce our agreements. When you delete your account, seeker and agent accounts are hard-deleted immediately (the database row is removed and related rows follow by cascade); admin accounts are soft-deleted (marked with a deletion timestamp and kept for audit integrity because admin broadcast records cannot be removed). See the Account deletion section.

Specific retention periods:

• Account data: retained for the life of the account. Seeker/agent deletion permanently removes the account row; admin deletion marks the row as deleted but keeps it for audit purposes.
• Session and authentication data: refresh-token session records live for the configured refresh-token lifetime — 48 hours by default, up to 7 days in our current deployment — or until you sign out, the session expires, or the account is deleted (which removes remaining session rows). Access tokens are short-lived JSON Web Tokens (about 24 hours) and remain valid until they expire even after the account row is removed.
• Transaction and credit records: for seeker/agent accounts these are deleted together with the account (payments, subscriptions, point balances and point transactions follow the account cascade). Admin audit log entries are kept but anonymised (admin/target references are cleared). If a legal hold requires retention, we will tell you what is kept and why.
• KYC documents: KYC database records are deleted together with the account. For active accounts, verified/rejected KYC images are cleared by a daily purge after the configured retention window (90 days by default). Object-storage copies of avatars and KYC images from deleted accounts are not queued automatically and are removed on a best-effort/manual purge — contact us if you need confirmation.
• Search embeddings: generated from listing content and stored with the listing; removed when the listing is deleted (listings are deleted with the account) or regenerated when listing content changes.
• Search history and listing views: anonymised on account deletion (the user reference is cleared but the aggregate row may remain).
• Location data used ephemerally for a feature: typically deleted or anonymised shortly after the session, unless you save a preference.
• Listing photos in object storage: database rows are removed immediately; the underlying files are queued for an hourly background cleanup job (retried up to 3 times). Files therefore disappear shortly after deletion in the normal case, but may persist longer if cleanup fails — contact us if you need confirmation.
• Backup archives: if database/object-storage backups are enabled, deleted data may persist in backups until the backup rotation expires. We do not restore backed-up personal data except for disaster recovery.

When data is no longer needed, we securely delete or anonymise it.

You may request deletion of your AeinMap account through the account deletion feature in the Service (in the mobile app or on this website at https://www.aeinmap.com/delete-account) or by emailing us at privacy@aeinmap.com. Online deletion requires you to be signed in (this is how we verify your identity); email requests must be sent from the address associated with your account so we can verify you. Self-service deletion runs immediately. Email requests are handled manually — we will process verified deletion requests without undue delay and, in any event, within 30 days of receiving all information needed to verify the request.

Upon receiving a verified deletion request, we will:

• Delete your account so that it can no longer be used to sign in or access the Service. Seeker and agent accounts are hard-deleted (permanently removed); admin accounts are soft-deleted (marked as deleted but kept for audit integrity).
• Remove remaining refresh-token sessions and push notification tokens associated with the account (via database cascade; admins via explicit revocation), signing you out of the Service on all devices the next time a short-lived access token (about 24 hours) expires or refresh is attempted.
• Delete authentication credentials (phone/social identifiers, password hash, stored Apple refresh token) together with the account row.
• Revoke third-party sign-in authorisations (for example, Sign in with Apple) where technically supported, as a best-effort measure. Revocation never blocks deletion.
• Delete database rows linked to the account by cascade — including listings and their details, listing media records, messages, reviews, notifications, saved items, subscriptions, payments, point balances/transactions, and KYC records. Search history, listing views, and admin audit entries are anonymised (user references cleared) rather than removed. Anonymised audit and aggregate rows may remain for security and integrity purposes.
• Queue listing photos in object storage for hourly background deletion (retried up to 3 times). Database removal is immediate; file removal normally follows within hours but may take longer or require manual follow-up if cleanup fails.

What we may still hold after deletion: anonymised history/views/audit rows described above, pending object-storage cleanup jobs, and data in backups until rotation expires. We do not currently return a per-category retention breakdown automatically — the online flow signs you out and redirects home on success. If you need a list of what was removed versus what was anonymised or queued for background cleanup, contact us at privacy@aeinmap.com and we will respond.

Online deletion confirms in the app/website immediately on success. For email requests we will confirm by reply when your request has been completed, or notify you if additional processing time is required.

Depending on your jurisdiction and applicable law, you may have the right to:

• Access, correct, or delete certain personal information we hold about you.
• Delete your account using the account deletion feature in the Service, as described in the Account deletion section.
• Withdraw consent where processing is based on consent.
• Object to or restrict certain types of processing.
• Request a copy of your data in a structured, machine‑readable format (data portability).
• Opt out of marketing communications at any time.
• Lodge a complaint with a relevant supervisory authority if you believe our processing violates applicable data protection law.

To exercise these rights, please contact us at privacy@aeinmap.com. We may need to verify your identity before responding. We will honour such requests in accordance with applicable law.

Myanmar. AeinMap is operated by SOLARATEK COMPANY LIMITED, a company registered under DICA in Myanmar. Myanmar does not currently have a comprehensive general data protection law equivalent to the GDPR; however, we voluntarily adhere to internationally recognised privacy principles of transparency, purpose limitation, data minimisation, and security. We will comply with any future Myanmar data protection legislation as it comes into effect.

European Economic Area (EEA) / United Kingdom. While our Service is primarily intended for users in Myanmar, if you access the Service from the EEA or UK, certain additional protections under the General Data Protection Regulation (GDPR) / UK GDPR may apply. In those circumstances:

• Legal bases for processing: We rely on consent (e.g., for marketing), contractual necessity (e.g., to provide your account), legitimate interests (e.g., fraud prevention, service improvement), and legal obligation.
• International transfers: Your data may be processed in Myanmar and in other countries where our service providers operate. Where we transfer personal data from the EEA/UK to a country not deemed to provide an adequate level of protection, we implement appropriate safeguards such as Standard Contractual Clauses.
• You have the right to contact our EU/UK representative (to be appointed and notified on this page) and to lodge a complaint with your local supervisory authority.

United States (including California). If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to delete, and the right to non‑discrimination for exercising your rights. We do not sell or share personal information as defined under CCPA. To make a verifiable request, contact us at privacy@aeinmap.com.

For residents of other US states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut), we will honour applicable rights as required.

Other jurisdictions. We are committed to respecting data protection rights wherever our users are located. If a particular jurisdiction’s law applies to your data, please contact us and we will work to address your rights in accordance with that law.

We implement administrative, technical, and physical safeguards designed to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS), encryption at rest of sensitive credentials (such as Sign in with Apple refresh tokens, encrypted with AES‑256‑GCM), access controls, and regular security assessments.

Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and any applicable regulator as required by law.

The Service is not directed to individuals under the age of 16, or the minimum age required by your local jurisdiction if higher. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page indicates when the latest changes were made. If the changes are material, we will provide a more prominent notice (e.g., in‑app notification or email). Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, you can reach us at:

• Email: privacy@aeinmap.com
• Postal address: SOLARATEK COMPANY LIMITED, O-89, 2nd Kaindari Orchid St, FMI City, Hlaingtharyar Township, Yangon, Myanmar.

We will respond to all legitimate inquiries within a reasonable timeframe and in accordance with applicable law.