Privacy Policy

This Privacy Policy explains how Zoo Holdings Ltd (company number 15868646), trading as Koala 360 ("Koala 360", "we", "us", "our"), collects and uses personal information when you use our website at koala360.com, our tour editor, and related services (the "Service").

Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
Contact: [email protected]

1. Who is responsible for your data?

For account, billing, and platform data described below, Zoo Holdings Ltd is the data controller.

When you upload tour content (360° images, floor plans, text, audio, and similar materials), you are usually the data controller for that content and any personal data it contains (for example, images of people or property). We act as a data processor on your instructions to host and deliver that content. See our Data Processing Agreement if you need a formal processor contract.

2. What we collect

Account information — email address, name (if you provide it), authentication identifiers, and membership plan status, collected when you register or manage your account.

Billing information — subscription and payment status. Card details are collected and processed by Stripe; we do not store full payment card numbers on our servers.

Tour content — 360° images, logos, floor plans, hotspots, passwords you set for tours, and related metadata you upload or create in the editor.

Usage and product analytics — aggregated, cookie-light analytics via Plausible (for example, page views and custom product events). We do not use Plausible to build advertising profiles.

Marketing and conversion measurement — we use third-party tags (including Google Ads, Meta, and LinkedIn) on parts of our marketing site. These may set cookies or similar technologies and collect device and interaction data subject to those providers' policies.

Email communications — if you join our mailing list or trigger lifecycle emails, we process your email address and related preferences through EmailOctopus.

Support and correspondence — information you send when you contact us.

AI features (Unlimited plan) — if you use optional AI image tools, image data is sent to our AI subprocessors (including Replicate) for processing and returned to your tour.

3. How we use your information

• Provide, operate, and secure the Service
• Authenticate you and manage your account and subscriptions
• Host, publish, and deliver your virtual tours
• Send service-related emails (for example, account or billing notices)
• Send marketing or lifecycle emails where permitted or with your consent
• Measure site and product performance and improve the Service
• Measure advertising effectiveness on our marketing pages
• Comply with law and respond to lawful requests

We do not sell your personal information.

4. Legal bases (UK / EEA users)

Where UK GDPR or EU GDPR applies, we rely on:

• Contract — to provide the Service you signed up for
• Legitimate interests — to secure, improve, and measure the Service, and to market Koala 360 to business users in a proportionate way
• Consent — where required for non-essential cookies, certain marketing, or optional features
• Legal obligation — where we must retain or disclose data by law

5. Where data is stored and processed

We use reputable subprocessors. Customer tour content and account metadata are primarily stored via our backend provider Xano in the United States.

International transfers: Data may be transferred outside the UK and EEA (notably to the United States). Where required, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, and/or subprocessors' equivalent commitments.

We do not guarantee that all customer data remains exclusively in the UK or EU on standard plans.

6. Security

We use administrative, technical, and organisational measures designed to protect personal data, including:

• HTTPS (TLS) encryption for data in transit between your browser and our services
• Encryption at rest provided by our cloud subprocessors (industry-standard AES-256 or equivalent)
• Access controls on production systems and authenticated API access for tour editing

No method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential and for passwords you set on published tours.

7. Retention

We retain personal data for as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. Tour content remains stored while your account is active and tours are published, unless you delete content or close your account. Backup copies may persist for a limited period according to our subprocessors' backup schedules.

8. Your rights

If UK GDPR or EU GDPR applies, you may have the right to access, rectify, erase, restrict, or object to certain processing, and to data portability where applicable. You may also withdraw consent where processing is consent-based, and lodge a complaint with the UK ICO or your local supervisory authority.

To exercise your rights, email [email protected]. We may need to verify your identity.

9. Your tour content

You retain ownership of content you upload. We host it solely to operate the Service. We will not showcase your tours in marketing without your consent. We may remove content that violates our terms, poses a security risk, or is unlawful.

You are responsible for having a lawful basis to upload content, including imagery of people or private property.

10. Cookies and similar technologies

Our marketing site and app may use cookies and similar technologies for authentication, preferences, analytics, and advertising measurement. You can control many non-essential cookies through your browser settings and, where offered, our cookie preferences.

11. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from children.

12. Changes

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this policy or our data practices:
Zoo Holdings Ltd (Koala 360)
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: [email protected]

This policy is published in English and is the authoritative version. Translated pages, if available, are provided for convenience only.