Listing Thread1. Who we are
Listing Thread is a property-work management service for Singapore property agents. This policy covers our public website at listingthread.com and the hosted app at app.listingthread.com.
The current pilot is provided as Listing Thread, based in Singapore (“Listing Thread”, “we”, “us”). For privacy questions or requests, email support@listingthread.com.
An agent or agency decides what client information to put in its workspace and why. Where we process that information on its behalf, we act on its instructions. We are separately responsible for information we use to administer accounts, respond to support requests and protect the service. A client can contact their agent about a record; we will help route a request when appropriate.
2. Information we handle
- Account and support details: sign-in email, account and workspace identifiers, connection status, and information you send when asking for help. Account authentication is handled through our authentication provider.
- Property work: contact details, property and listing information, enquiries, notes, tasks, appointments, tenancy and renewal details, saved history, and files you or your agent add.
- Connected WhatsApp information: account, conversation and participant identifiers, names and phone numbers where available, message text, timestamps, delivery state, and media you access or save. Connecting an account can make available messages beyond a single listing, including personal conversations. Use only an account you are authorised to connect and avoid bringing unrelated personal or sensitive information into your workspace.
- Google Calendar information: the limited categories described in the next section.
- Technical information: IP address, browser/device information, request and error logs, and limited feature-use events needed for security, support and reliability. The public pages do not add analytics scripts, advertising pixels or marketing cookies.
3. Google Calendar: access, use and storage
Calendar is an optional connection. We request Google authorisation when you choose to connect it inside the app. You sign in and approve access on Google’s own consent screen; Listing Thread does not receive your Google password.
What the permission allows
The app requests permission to work with events on calendars you own, and read-only access to your calendar list. The current integration uses your primary calendar. The Google permission is broader than “only events created by this app”; we do not describe it as a technical restriction to app-created events.
View the exact Google permissions
https://www.googleapis.com/auth/calendar.events.owned
Allows reading and managing events on Google calendars you own. Used for availability checks and creating, changing or cancelling linked appointments.
https://www.googleapis.com/auth/calendar.calendarlist.readonly
Allows reading your calendar list. Used to identify and confirm the primary calendar that you own.
How we use it
We identify your primary calendar, check relevant time windows for conflicts, and create, display, reschedule, cancel or reconcile appointments you manage through Listing Thread. Availability checks use event identifiers, time ranges and busy/free status, rather than importing a general calendar archive. Google may also return descriptions, locations or attendee details on a linked event, where present; these are not needed for ordinary availability checks. Appointment titles you enter may contain a contact or property name; those titles and appointment times are sent to Google when you save the booking.
What we keep
We retain the connected calendar identifier and label, granted permissions and connection status, an encrypted server-side refresh credential, and linked appointment information such as event identifiers, titles, times, status and operation history. An access token is used to make authenticated requests. Linked appointment and operation records let us show history and check whether a change succeeded.
This Calendar connection does not request permission to read Gmail, Google Drive or Google Contacts. It is a scheduling connection, not Google sign-in for your Listing Thread account.
4. How information is used and shared
We use information to provide your workspace, organise property work, perform actions you request, support users, maintain the service, investigate security problems and meet applicable legal obligations.
The service uses Railway for application hosting, Supabase for database, authentication and private file storage, Google for connected Calendar actions, and Hostinger for the public website and email services. These providers process the information needed for their respective functions. WhatsApp data is exchanged with WhatsApp through the connected messaging service when you use that integration.
Recipients receive information when you send a message or deliberately share a client shortlist or report. Treat a share link like a private invitation: someone who receives a forwarded link may be able to open the content it authorises. Creating a private record is not an instruction to publish it to a public property directory.
Where AI-assisted property research is enabled for your workspace, the research information you submit for that feature—such as requirements, listing details, notes, documents or images—may be sent to the configured AI processing service, such as OpenAI. Availability and processing arrangements depend on the feature enabled for you. Review outputs before relying on them, and do not submit unnecessary personal information.
We do not sell personal information. We do not use information obtained through the Google Calendar connection for advertising, credit scoring or general-purpose AI model training. The Calendar connection does not automatically send your calendar contents to the research AI service.
5. Our commitment on Google data
For information obtained through Google APIs, we follow the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace user data and developer policy.
Google data is used for the scheduling features explained here. Transfers are limited to delivering those features with your permission, necessary security work or legal obligations. A transfer associated with a change of ownership would require your explicit prior consent. It is not transferred to advertisers or data brokers.
Human access to Google data is limited to specific support that you explicitly authorise, necessary security investigations, legal requirements, or appropriately aggregated and anonymised internal operations where permitted. These limits apply to anyone acting for us. Any materially different use requires an updated notice and any further consent required before it starts.
6. Storage, security and overseas processing
We use access controls, workspace-scoped access and private storage arrangements to protect application data. Stored Google refresh credentials are encrypted on the server. Credentials are not placed in this public website. These safeguards reduce risk; no internet service can promise absolute security.
We operate from Singapore and use external hosting, database and storage providers. Other providers, support functions, communications and backups may involve processing outside Singapore. We are responsible for putting appropriate contractual or other safeguards in place for transfers where required, including protection comparable to Singapore’s Personal Data Protection Act.
Do not use the pilot as your only copy of essential records. Avoid uploading identity documents, financial records or other highly sensitive material unless needed for an authorised workflow and its safeguards have been agreed.
7. Retention and deletion
We keep information while it is needed for the service, your requested work, security, resolving disputes, or a legitimate business or legal purpose. Retention differs by category; removing an item from a view is not necessarily permanent deletion.
- Work records and messages: generally remain in the workspace until removal or offboarding is requested and carried out. Archiving a campaign and cancelling an appointment retain their associated history.
- Ordinary WhatsApp media: uses a rolling 60-day availability period measured from the message time. Files deliberately saved into Records, evidence or reusable replies follow their separate retention rules.
- Records files: superseded or deleted versions normally have a 30-day recovery period. A version linked as property-history evidence may be retained longer while that evidence link remains needed.
- Workspace offboarding: is operator-assisted during the pilot. Access and connections are disabled, with a normal 30-day recovery window before eligible data is purged. Necessary audit, security or legal records may be retained separately.
- Google connection credentials: are cleared from the active application connection when you disconnect; the app also attempts to revoke the Google grant. Linked booking history is not automatically erased by disconnecting.
Deletion is processed through the relevant application and provider cleanup procedures. Backup copies may remain until the applicable backup rotation expires; active-file deletion is not a promise of immediate removal from every backup. We will explain relevant retention limits when responding to an offboarding or deletion request. Provider records held independently by Google or WhatsApp are governed by those providers’ policies.
8. Your choices and privacy requests
Disconnect Google Calendar
Open Listing Thread’s Settings → Connected accounts and disconnect Google Calendar. You can also remove Listing Thread’s access from your Google Account connections. Removing access stops future authorised Calendar requests; it does not itself delete information already stored in Listing Thread.
Disconnecting does not cancel appointments already in Google Calendar. To remove those events, cancel them while connected, or manage them directly in Google Calendar.
Request access, correction, export or deletion
Email support@listingthread.com from the email associated with your workspace where possible. State the request and whether it concerns your account, a particular record or retained Google Calendar information. Do not send passwords, authentication tokens or identity-document scans in the first message.
We may need to verify your identity and authority or involve the agent responsible for a record before acting. We will respond as required by applicable law and explain any lawful limitation. Withdrawal of consent or removal of a connection may make the related feature unavailable. Requests for export or account deletion are handled with the operator during this pilot, rather than through a self-service deletion button.
10. Changes and contact
We will update this policy when our practices or service materially change and change the date at the top. Where an additional notice or consent is required, we will provide it before the new use. This pilot policy is not permission to introduce undisclosed public sharing or new uses of connected-account information.
Privacy and support contact
Listing Thread · Singapore
support@listingthread.com