PAMMO — PRIVACY NOTICE

Version 1 — Publication-Ready Pending Final Review Last Updated: 2026-11-02 Effective Date: 15 June 2026

This Privacy Notice describes how Pammo — operated jointly by AEDOWON CO., LTD and AEDOWON SINGAPORE PTE. LTD. (UEN 202612161D) (together, "Pammo", "we", "us", "our") — collects, uses, discloses, retains, and protects your personal data when you access or use the Pammo AI property-workflow service (the "Service").

It also covers you if you bought the Pammo Pro 1-year course bundle at Ontheway Academy, whether or not you have a Pammo account: from the moment Ontheway Academy reports the purchase to us (§2.3), and when you ask for a refund on a refund link we email you (§2.1).

This Notice is provided in compliance with:

• The Personal Data Protection Act B.E. 2562 (2019) of the Kingdom of Thailand ("Thailand PDPA")
• The Personal Data Protection Act 2012 of the Republic of Singapore ("Singapore PDPA")
• The EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") and UK GDPR / DPA 2018
• The California Consumer Privacy Act / California Privacy Rights Act ("CCPA / CPRA") and analogous U.S. state privacy laws (VCDPA, CPA, CTDPA, UCPA, etc.)
• Other applicable data-protection laws

PLAIN-LANGUAGE SUMMARY

• We are a dual-entity operation: a Thai company (AEDOWON CO., LTD) serves Thai residents; a Singapore company (AEDOWON SINGAPORE PTE. LTD., UEN 202612161D) serves everyone else. Together we act as joint data controllers for your account data.
• We collect what we need to provide the Service: account info, payment info, listings you create, audit logs, support correspondence, KYC for the Creator Program, and W-9 / W-8BEN for international Affiliate / Creator payouts.
• We share data only with Sub-Processors (AI providers, Omise, Polar.sh, Supabase, Resend, etc.) listed in our Sub-Processor List and only where necessary.
• You have rights to access, correct, delete, port, object, and withdraw consent — via Account → Privacy or dpo@pammo.co.
• We retain your data only as long as necessary, then delete or anonymize.
• We do not sell or share your personal data for cross-context behavioral advertising except where you have affirmatively opted in (per-network).
• Our optional browser extension sends us a session for your own account, its version number, and a short report of what it did — for each post, the outcome (sent, held, blocked), how many photos or videos it was to carry and how many it handed to Facebook, whether it could see the post afterwards and, when Facebook's reply gave no link to the post, counts describing that reply; for a post that did not go up, also that group's name and link, the reason the extension showed and the technical error behind it, and, for a listing in a group's own sell form that stopped at a step or a group that showed no post box, the layout of the screen with no text from it; for a listing it puts on Facebook Marketplace, that it was one, and its outcome. It never names a group a post went up in, never sends a Marketplace listing's link, and never sends us anything about your Facebook account, the list of groups you belong to, or what it posted. When you ask on a chat card, it fetches the photos of a Facebook post you pasted into the chat, and when Pammo cannot open a Facebook post you pasted, it reads that one post's text and author for the chat; when you ask on a chat card, it also fetches the photos of a Kaidee listing you pasted into the chat — see §2.6.

1. WHO WE ARE — JOINT CONTROLLERS

Pammo is operated under a dual-entity geo-routed structure (see Pammo-Terms-Conditions-Main-V1 §0):

Joint-Controller Allocation. Both entities are joint controllers for:

• Account identity and authentication data
• Billing and payment-method metadata (tokenized references)
• Audit and security-event logs
• Compliance and fraud-prevention signals
• Communications with you (support, marketing under §13A/§13B, newsletter)

The entity that contracts with you under §0 of the Main T&C is the primary local-controller for tax-invoice, withholding-tax, refund, and consumer-protection purposes; the other entity is co-responsible under the joint-controller arrangement and bound by the same standard of care.

Primary DPO contact (single channel for both entities): dpo@pammo.co

Singapore registered office: AEDOWON SINGAPORE PTE. LTD. (UEN 202612161D), 8 TEMASEK BOULEVARD, #17-02A, SUNTEC TOWER THREE, SINGAPORE 038988

Thailand registered office: AEDOWON CO., LTD, 250/207 SOI BUDDHAMONDON SAI 2 SOI 32, SALATHAMMASOP, TAWEWATTANA, BANGKOK 10170, THAILAND

Pammo engages personnel located in various jurisdictions (Thailand, Singapore, and others) as authorized agents bound by confidentiality and the technical and organizational measures set out in our Data Processing Addendum.

2. WHAT PERSONAL DATA WE COLLECT

We collect the following categories of personal data:

2.1 Data You Provide Directly

2.2 Data Collected Automatically

2.3 Data Collected from Third Parties

2.4 Sensitive Personal Data

We do not require sensitive personal data for ordinary Service use. Where the Service processes sensitive data, we obtain your explicit consent:

(a) Creator NID / passport image (Thailand PDPA §26 sensitive category; Singapore PDPA Schedule 2 — physical-identification document) — collected with verbatim consent at Creator application; used only for identity verification, anti-fraud, and tax-residency confirmation per Pammo-Creator-Program-Terms-V1 §11.

(b) Sensitive data in Your Input or in Property Data you upload. Where User Input or uploaded Property Data contains sensitive data of third parties (e.g., health information of an occupant, religion-related preferences, biometric, criminal-record, political-opinion, sexual-orientation data), you represent that you have obtained the required explicit consent from those data subjects under Thailand PDPA §26, Singapore PDPA Schedule 2, and / or GDPR Art 9. You indemnify Pammo per Main T&C §16 against any claim arising from your failure to do so.

2.5 Children

Pammo is not directed to children under 13 and does not knowingly collect data from children under 13. The minimum age for the Service is 18 (or the higher local age of majority). Where mandatory parental consent permits use by minors (13–17) in specific jurisdictions, separate parental-consent collection applies.

2.6 Browser Extension (Pammo — ผู้ช่วยลงทรัพย์)

We publish an optional Chrome browser extension that posts listings from your Pammo account into the Facebook groups you belong to — and, when you switch it on for a campaign, lists the property on Facebook Marketplace — and that, when you ask on a Pammo chat card, fetches the photos of a Facebook post you pasted into the chat, and that reads a Facebook post you pasted when Pammo itself cannot open it, all from the browser you are already signed in to; and that, when you ask on a Pammo chat card, fetches the photos of a Kaidee listing you pasted into the chat, from your own browser. Each of these needs the extension connected to your Pammo account. It is free, it is optional, and the Service works fully without it.

(a) What the extension sends to us. Six things:

• An authentication session for your Pammo account, created when you connect the extension. It is used to read your own listings and their photos, and to confirm once a day that your account is still active. It is the extension's own session — your browser's Pammo session is never handed over.
• The extension's version number, on each request, so that we can refuse versions we no longer support.
• A short report of what the extension did, so that we can support it and see that it works. For each post it makes: the outcome (sent, held for the group's approval, could not post, failed, blocked, or stopped by a Facebook identity check), whether the extension could see the post in the group afterwards and how it found the post's link, how many photos or videos the campaign picked for the post and how many the extension handed to Facebook's post box (the numbers only), the time, and the extension's version. When the post's link did not come from Facebook's own reply to the post, the report also counts what that reply held — how many requests the Facebook page made while the post was sent, how many links to posts they contained and whether one was into that group, and the names Facebook gives those requests — so that we can see why the link was missing; it carries none of their content, no link, and nothing that identifies the group. The posts of one campaign are grouped under a random key, and a campaign made from the onboarding sample listing is marked as such. Once a day it also reports the extension's version and build, how many Facebook groups your account belongs to (the number only), and how many campaigns it holds. When a post does not go up, or the extension cannot tell whether it did, the report also includes that group's name and link, the one-line reason the extension showed, and the first line of the technical error behind that reason — with any web address in it cut to the site's name, and any email address or long number removed — so that we can see why and help you. When a listing made through a group's own sell form stops at a step, or a group page shows no post box, the report also describes what was on screen at that moment, as layout only: the windows that were open (the newest four); for each, whether it held the form's place box or photo field, how many fields it had, and which of Facebook's own window titles and button names it showed, as fixed codes, with any other button only counted; which of the form's fields were left empty, by Facebook's field name as a fixed code or else only counted; whether Facebook was showing a block, identity-check or approval notice; the kind of page, with every name and number in its address removed; and, on a group page, which of Facebook's own tab names and the button names above the group's posts it showed, as fixed codes, with any other only counted. It carries no other text from the page, so no name, group or post. When a campaign lists the property on Facebook Marketplace, the report says that it was a Marketplace listing and gives its outcome the same way, with the one-line reason when it did not go up; a Marketplace listing names no group. The report never includes the name, address or identity of a group a post went up in, the link of a Marketplace listing, the text or photos of any post, which listing a campaign was made from, or anything about your Facebook account.
• The text of a Facebook post Pammo could not open. When you paste a link to a Facebook post into the chat and Pammo cannot open it — usually because the post is in a private group — and the extension is installed and connected, the extension opens that post, and nothing else, in a background tab, using the Facebook session your browser already holds. It reads the post's text, the name shown as its author, and how many photos the post says it has, then closes the tab and hands them to the Pammo page you pasted the link on. That page sends them to Pammo with the same link, and Pammo uses them as if you had pasted the post's text yourself: it makes a listing card from them and keeps the text with that chat message, so that later replies in the chat can refer to it. This happens on its own, without a press, only for a link you pasted, and only after Pammo's reply has said it could not open that post. If the post is in a group you belong to, this includes text that only the group's members can see.
• The photos of a Facebook post you ask for. When a Facebook link you paste into the chat brings only some of the post's photos and you press the button on that chat card to fetch the rest, the extension opens that post — and nothing else — in a background tab (or, for a post with more than 24 photos, in a small Facebook window that comes to the front for a few seconds and then closes itself), using the Facebook session your browser already holds, reads the addresses of the post's photos, and hands them to the Pammo page you pressed the button on. That page adds them to that card, or to the listing saved from it, and Pammo then copies the photos into its own storage like any photo you add to a listing. When the card was made from a post the extension read for you (above), the extension fetches the first 24 photos this way on its own, without a press; photos past the first 24 are fetched only when you press the button. If the post is in a group you belong to, this includes photos that only the group's members can see. This fetch takes nothing of the post but its photos.
• The photos of a Kaidee listing you ask for. When you paste a link to a Kaidee listing into the chat, Pammo's own read of that link brings only the listing's cover photo. When you press the button on that chat card to fetch the rest, the extension opens that listing — and nothing else — in a background tab of your own browser, reads the addresses of the listing's photos from the data the Kaidee page itself loads, closes the tab and hands the addresses to the Pammo page you pressed the button on. That page adds them to that card, or to the listing saved from it, and keeps the number of photos the listing has with that chat message; Pammo then copies the photos into its own storage like any photo you add to a listing. The extension sends Kaidee no request of its own, and this fetch takes nothing of the listing but its photos.

(b) What the extension keeps on your device and never sends to us. Your saved group selections, your campaign history with the group and link of each post, which of your listings it has put on Facebook Marketplace with each one's link (so that the same property is not listed twice), and listing photos while a campaign is running. These are held in your browser's own storage on your computer. They are not transmitted to Pammo and we cannot read them; only the report in (a) reaches us — which, for a post that did not go up, names that group.

(c) What the extension never does.

• It never sends us your Facebook account details, the list of groups you belong to, or what it posted. The only group it ever names is the group of a post that did not go up, and the only content it ever reads from Facebook for us is the photos of a post you asked for and the text of a post you pasted that Pammo could not open, as described in (a). From Kaidee it reads only the photos of a listing you asked for.
• It never sees or stores your Facebook password. You sign in to Facebook in a Facebook window, exactly as you normally would, and the extension operates only within the session your browser already holds.
• Pammo is not connected to Facebook or Meta Platforms, Inc., has no agreement with them, and receives no data from them.

(d) Deleting it. Removing the extension from your browser deletes everything it stored on your device. Pressing disconnect inside the extension ends its session with us. Reports already sent under (a) stay with your Pammo account and are deleted with it. Photos added to a card or a listing stay on it until you remove them or delete the listing; the number of photos a Kaidee listing has stays with its chat message until you delete that chat. The text of a post read under (a) stays with the chat message it came with until you delete that chat, and what was taken from it into a listing you save stays on that listing until you change or delete it. Neither action affects the other data in your Pammo account, which is governed by the rest of this Notice.

(e) Your responsibility for posting. Posting into Facebook groups, and listing on Facebook Marketplace, are subject to Facebook's own terms — for Marketplace, its Commerce Policies — and are the account holder's responsibility, as stated on the extension's download page and in our Acceptable Use Policy. Reading a post's text or fetching its photos happens in your own Facebook session and is likewise subject to Facebook's terms and the account holder's responsibility.

3. WHY WE PROCESS YOUR DATA (PURPOSES AND LAWFUL BASES)

4. WHO WE SHARE YOUR DATA WITH

4.1 Sub-Processors

We engage third-party Sub-Processors to operate the Service. A current list is published in our Sub-Processor List; broad categories include:

• AI model providers — Anthropic, OpenAI, Google (Gemini), Stability AI, Replicate, and successor providers
• Payment / payout processors — Omise (TH Route), Polar.sh (International Route MoR), Currenxie (international banking + Affiliate / Creator payouts), Wise (reserved future activation), PayPal (Affiliate / Creator payouts)
• Hosting / infrastructure — Supabase, Vercel, Cloudflare
• Email transport — Resend (transactional + transport for in-house marketing emails)
• LINE OA — broadcast (with consent for marketing)
• Customer support — Dabby (an AI chatbot operated by Pammo itself — internal tool, not a third-party Sub-Processor)
• Web-aggregation infrastructure for Property Discovery — bounded to Pammo's own infrastructure stack on Supabase + Vercel, no third-party scraping-as-a-service vendor at launch

We provide at least 30 days' prior notice before engaging any new material Sub-Processor, with a right of objection on reasonable grounds (per Main T&C §12.2A(d) + Pammo-Data-Processing-Addendum-V1 §7).

4.2 Advertising Networks (Opt-In Only)

Where you have affirmatively opted in via §13B of the Main T&C, we share behavioral / inferred-preference data with selected advertising networks on a per-network basis:

• Meta (Facebook / Instagram)
• Google (Google Ads / YouTube)
• TikTok
• LINE Ads
• Others listed in the Sub-Processor List

You may withdraw any of these per-network consents at any time via Account → Privacy → Ad-Network Sharing.

4.3 Legal / Regulatory Disclosures

We may disclose personal data:

• To comply with applicable law, court order, subpoena, or regulator request
• To the Thailand Personal Data Protection Committee (PDPC), the Singapore PDPC, EU supervisory authorities, the UK ICO, or US state AGs in response to lawful requests
• To protect rights, property, or safety of Pammo, our Users, or others
• To Thai Revenue Department, Singapore IRAS, Thai AMLO, US OFAC, EU FCA, UK OFSI, or other competent regulator for tax / AML / sanctions purposes
• In connection with merger, acquisition, sale of assets, or insolvency, subject to notice and successor-assumption-of-obligations per Main T&C
• To enforce or defend legal claims

4.4 What We Do NOT Do

• We do NOT sell personal data for monetary consideration.
• We do NOT share personal data for cross-context behavioral advertising as defined under CCPA / CPRA, VCDPA, CPA, CTDPA, or UCPA, except where you have affirmatively opted in (§4.2 above).
• We do NOT disclose your User Input or AI Output as identifiable to you without your consent, except as required by law.
• We do NOT train AI models on your User Input or AI Output, and we do not keep your corrections to what the AI extracts. §4.5 describes the opt-in that used to keep them, and its end.
• We do NOT share Property Data you upload with competitors of Pammo.

4.5 AI Training — ended

Pammo used to offer an opt-in setting (Account → Privacy → AI Training) that was off unless you turned it on. When it was on and you corrected a field the AI had extracted before saving, we kept that correction as a pair: what the AI proposed, and what you saved instead. Contact details, fields you did not change and your conversations were never kept.

The program has ended. The setting has been removed from the app, nothing of this kind is collected from anyone, and every correction it had kept has been deleted, ahead of the 24-month retention period it was published with. There is nothing to turn off and nothing left to ask us to delete.

Your User Input and AI Output are still not used to train AI models, ours or our providers' (§4.4; Sub-Processor List §1).

5. WHERE YOUR DATA GOES (CROSS-BORDER TRANSFERS)

Your data may be transferred to and processed in jurisdictions outside your country of residence, including Singapore, Thailand, the United States, the European Union, the United Kingdom, Hong Kong, Japan, and other locations where our Sub-Processors operate.

Lawful transfer mechanisms (in order of preference):

(a) Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) or by the Thailand PDPC — primary basis for routine recurring transfers;

(b) Adequacy decisions recognized by the Thailand PDPC or the European Commission;

(c) Binding Corporate Rules approved by the competent supervisory authority;

(d) Contract necessity for performance of your contract with us (Thailand PDPA §28 ¶2(3); GDPR Art 49(1)(b)) — used where SCC / adequacy is unavailable;

(e) Your explicit consent after being informed of the absence of adequate safeguards — last-resort basis only (Thailand PDPA §28 ¶2(2); GDPR Art 49(1)(a));

(f) Compliance with legal obligation, public interest, vital interests, or legal claims.

A current mapping of each Sub-Processor's jurisdiction and applicable safeguard is published in the Sub-Processor List.

6. HOW LONG WE KEEP YOUR DATA (RETENTION)

After the applicable retention period, personal data is securely deleted or irreversibly anonymized, with an audit trail.

7. YOUR RIGHTS

You have the following rights regarding your personal data:

7.1 Right Catalog

7.2 How to Exercise Your Rights

Easiest method: Account → Privacy → "Manage My Data" — one-click controls for most rights.

Alternative: Email dpo@pammo.co with:

• Your full name and email associated with the account
• The right you wish to exercise
• Any relevant context (e.g., specific data to delete)

We may ask for additional verification to confirm your identity.

7.3 Response Timeline

We respond to verified requests within 30 calendar days of receipt, extendable by a further 60 days for complex or high-volume requests (with prior notice and reasons given within the original 30-day period). This is in accordance with Thailand PDPA §32, Singapore PDPA §21(2), and GDPR Art 12(3).

7.4 No Charge

We respond to data-subject requests free of charge, except where requests are manifestly unfounded, excessive, or repetitive — in which case we may charge a reasonable administrative fee or refuse.

7.5 U.S. State Privacy Rights

If you are a U.S.-resident User, you additionally have rights under CCPA / CPRA / VCDPA / CPA / CTDPA / UCPA:

• Right to know the categories and specific pieces of personal information we collect, sell, or share
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of any future "sale" or "sharing" for cross-context behavioral advertising
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising privacy rights

To exercise these rights, contact privacy@pammo.co or use the in-app "Do Not Sell or Share My Personal Information" control. We do not currently "sell" or "share" your personal information for cross-context behavioral advertising except where you have opted in via §13B of the Main T&C.

7.6 Withdrawal of Consent — One-Click

You may withdraw any consent at any time using one-click in-app controls (Account → Privacy → "Withdraw consent") or by emailing dpo@pammo.co. Withdrawal mechanisms are at least as easy as the original consent action. We process valid withdrawal requests within 7 calendar days. Withdrawal does not affect the lawfulness of prior processing.

8. SECURITY

We implement administrative, technical, and physical safeguards consistent with industry standards and PDPA / GDPR / SG PDPA security requirements:

• Encryption of personal data at rest (AES-256 or equivalent) and in transit (TLS 1.2+, TLS 1.3 preferred)
• Role-based access control with least-privilege grants and quarterly access review
• Multi-factor authentication for all administrative, production, payment, and DPO tooling
• Logging of security-relevant events for at least 12 months
• Backup with tested restore (quarterly minimum)
• Vendor risk management for Sub-Processors (annual review + 30-day prior-notice on additions)
• Documented incident-response procedure
• Periodic security audits and penetration testing

Full Technical and Organizational Measures (TOMs) are documented in Data Processing Addendum Annex II.

9. BREACH NOTIFICATION

In the event of a personal-data breach, we notify regulators and affected individuals in accordance with the following statutory clocks:

Affected individuals are notified where the breach is likely to result in significant harm or high risk to rights and freedoms.

10. COOKIES AND TRACKING

The Service uses cookies, local storage, and similar technologies as described in our Cookie Notice. Non-essential cookies — including analytics, retargeting, and the 60-day Affiliate / Creator / FGF attribution cookie — are set only with your affirmative consent via our cookie banner. We honor Global Privacy Control (GPC) and "Do Not Track" signals where legally required.

11. THIRD-PARTY LINKS

The Service may contain links to third-party websites or services (e.g., DDproperty, condominium-portal listings, embedded map services). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy notices.

12. AUTOMATED DECISION-MAKING

We use automated processes for:

• Fraud detection (cohort fraud monitoring, IP / device matching, anomalous-pattern flagging — AB1–AB7)
• Affiliate tier promotion (automated lifetime-referral-count threshold check per Pammo-Program-Rules-V1 §4.4)
• Credit allocation (monthly reset on the 1st at 00:00 ICT; signup-anchored drip for Yearly plans)
• Property Matching (vector-search ranking)
• Cohort fraud monitor (5% threshold over 20-active-cohort floor)

These do not produce legal effects on you without human review where required by GDPR Art 22. Affiliate / Creator commission decisions involving forfeiture, escrow hold, or termination are reviewed by Pammo staff before being finalized (per the 14-day challenge + 30-day mediation window in Pammo-Program-Rules-V1 §8.4).

13. CHILDREN

The Service is not directed to and may not be used by children under 13 in any circumstance. The minimum age is 18 or the local age of majority. See Main T&C §1.5 + §3.1 for full age-eligibility rules.

14. CHANGES TO THIS NOTICE

We may update this Privacy Notice from time to time. Material changes will be notified by email and in-app banner at least 30 days before they take effect; non-material clarifications take effect immediately upon posting. The "Last Updated" date at the top of this Notice reflects the most recent change. Prior versions are available on request to dpo@pammo.co.

15. CONTACT US

Data Protection Officer (DPO — joint controllers): dpo@pammo.co General Privacy Inquiries: privacy@pammo.co U.S. State Privacy Rights: privacy@pammo.co

Supervisory Authorities:

• Thailand: Personal Data Protection Committee (PDPC), Ministry of Digital Economy and Society — pdpc.or.th
• Singapore: Personal Data Protection Commission of Singapore — pdpc.gov.sg
• EU / EEA: your local Data Protection Authority
• UK: Information Commissioner's Office (ICO) — ico.org.uk

You may also lodge a complaint with the supervisory authority of your habitual residence or place of alleged infringement.

END OF PAMMO PRIVACY NOTICE — V1 (PUBLICATION-READY PENDING FINAL REVIEW) Last Updated: 2026-11-02