Privacy Policy

J&J Enterprises, LLC operates 360Plan. This policy describes the personal information handled through the 360Plan website, installed web app, accounts, tours, support channels, and related services.

We decide how account, billing, security, support, and product usage information is used. A customer or organization usually decides why project content about other people is uploaded and shared. For that content, we process information to provide the service according to the customer's settings and instructions.

The categories below describe information we may collect and the business purposes for collection. We do not collect every item from every person.

Identifiers and account information

Name, email address, optional phone number, account identifiers, authentication settings, internet protocol address, and security records. We use this information for accounts, authentication, support, security, and legal compliance.

Customer content and visual information

Floor plans, photographs, tours, pins, annotations, comments, logos, project contact details, file names, and metadata embedded in uploaded files. We use this information to store, organize, display, export, and protect projects as directed by the customer.

Commercial and subscription information

Selected plan, trial status, subscription status, billing period, customer and invoice identifiers, payment status, storage use, and media use. We also retain the policy versions and text you accepted, the acceptance time, your order details, and related payment identifiers to resolve billing questions and disputes. We use this information to provide plans, process billing, enforce allowances, and keep financial records. Stripe processes complete payment card details. 360Plan does not receive or store a complete payment card number.

Network, device, and activity information

Browser and device type, operating system, approximate location, access time, feature activity, normalized page route, referring source, tour navigation, security events, and performance results. We use this information for security, reliability, capacity, product improvement, and first party analytics.

Communications

Support conversations, feature requests, billing questions, privacy requests, content removal requests, error reports, and related email delivery records. We use this information to reply, resolve requests, prevent abuse, and maintain an accurate history.

Limited product insights

Broad signals such as setup progress, activation, feature use, return use, trial conversion, and account status. We use these insights to understand and improve 360Plan. We do not use them to make decisions that produce legal or similarly significant effects.

• Information you provide when creating an account, building a project, paying, or contacting us
• Information provided by an organization that manages a project or account
• Automatic information from your browser, device, network, and use of the service
• Information from tour viewers when they open or navigate a published tour
• Information from service providers such as Stripe, Hetzner, Cloudflare, and Resend, and from retained records of former hosting providers

• Provide, personalize, secure, maintain, and improve 360Plan
• Create accounts and authenticate users
• Process subscriptions, trials, plan limits, storage allowances, and media allowances
• Store and deliver public or private tours according to customer settings
• Send account, billing, security, support, and service messages
• Respond to privacy, safety, copyright, and content removal requests
• Detect abuse, investigate errors, enforce our terms, and protect people and the service
• Measure product use, reliability, and capacity
• Meet legal, tax, accounting, and regulatory obligations

Customers control what project content they upload and whether a tour is published. Content in a published tour can be viewed by anyone who can open the link and may be recorded or shared by a viewer. Password protection and link expiry reduce access but cannot prevent a viewer from copying content they can see.

Original photographs and files can contain embedded metadata such as capture time, device details, and location information. 360Plan keeps original files so customers can download them without quality loss. Review files, floor plans, and photographs for confidential details and unwanted metadata before uploading or publishing them.

360Plan uses first party analytics to understand tour visits, product activation, feature use, subscriptions, and retention. Public tour analytics can include a pseudonymous session key, project and viewpoint identifiers, navigation source, approximate country and city, device category, browser category, and whether a tour is embedded. Tour analytics do not store an analytics internet protocol address.

Performance monitoring records loading and processing times, general device categories, normalized page routes, release identifiers, and outcomes. Browser performance reports do not include account identifiers, email addresses, full tour links, query strings, or message contents.

We disclose information only as needed to provide 360Plan, follow your instructions, protect the service, complete a business transaction, or comply with law.

Cloudflare

Private media and encrypted backup storage, secure website and media delivery, and network protection

Hetzner

Servers operated by us for website hosting, account authentication, database services, secured application functions, and operational logging

Former hosting providers

Supabase and Vercel may temporarily retain protected migration recovery copies and historical operational records while we complete our hosting transition. They no longer host the active application database or website.

Stripe

Checkout, payment processing, subscriptions, invoices, and billing support

Resend

Account, security, billing, and support email delivery

Google Ads

Optional advertising measurement on our home, pricing, and product guide pages when you allow it. Google may receive cookie identifiers, advertising click identifiers, the public page visited, IP address, and browser information. We disable personalized advertising and enhanced conversions and request restricted data processing.

These hosting details were updated on September 13, 2026.

We may also disclose information with your direction, to professional advisers under confidentiality duties, as part of a merger or similar transaction, or when reasonably necessary to respond to lawful requests and protect rights or safety.

360Plan does not sell personal information. We do not share personal information for cross context behavioral advertising, use it for targeted advertising, or exchange it for money or other valuable consideration. We do not offer a financial incentive in exchange for personal information.

Account credentials, private communications, and some customer content can qualify as sensitive information. We use sensitive information only for the service, security, support, legal compliance, and other purposes permitted by law. We do not use sensitive information to infer personal characteristics.

360Plan does not perform facial recognition or create biometric identifier templates. A passkey can use a fingerprint or face check on your device, but 360Plan does not receive that biometric data.

360Plan is not a health, financial, or education record service. Do not upload medical records, consumer health data, payment card data, government identification numbers, biometric templates, or student education records. If we learn that prohibited regulated information was submitted, we may restrict or remove it and will handle it only as needed for security, support, legal duties, and the requested service.

360Plan uses essential cookies and browser storage for sessions, security, preferences, media authorization, and installed app behavior. An installed 360Plan web app follows this policy and may retain limited application files for reliability and offline screens.

For a signed in customer, recently opened images owned by that account can remain in bounded browser storage. They are eligible for offline reuse for no more than twenty four hours and are removed when 360Plan next runs after that period. This helps an installed app recover from a brief connection interruption. The media cache is separated by account and cleared when the customer signs out. When a connection is available, live access checks and usage limits still apply before media is returned.

Optional Google Ads measurement is off until you choose Allow measurement. Declining does not affect your access to 360Plan. We do not load this tag on account, sign in, administration, support, editor, or shared Site Capture pages. We do not send private project content, form entries, names, or email addresses through this integration.

You can change your choice at any time using Cookie choices in the footer. Withdrawal stops future measurement and removes the advertising cookies this integration can access. It does not erase information already received by Google. Advertising cookies are configured for up to ninety days and your preference is remembered for up to six months. Global Privacy Control and Do Not Track signals keep optional measurement disabled even if an earlier choice allowed it.

Learn more about how Google uses information from sites that use its services.

We keep personal information only for the period reasonably necessary for the purposes described here. Retention depends on the type of information, account status, customer instructions, security needs, legal duties, and whether information is needed for a dispute.

Account and project content

Kept while the account or project remains active. When paid or complimentary access ends, tours become unpublished and retained media remains available for download for up to fourteen days. Media outside an active plan is then permanently removed from active storage.

Migration recovery copies

Source copies retained during a verified storage migration can remain for up to thirty days. A customer deletion remains authoritative during that period and prevents restoration.

Performance information

Detailed performance history is kept from 365 through 3650 days under the configured operational policy. Short lived throttling records used for performance intake expire after two days.

Product and tour analytics

Kept while reasonably needed to measure product and tour use. Identifiable project analytics are removed with the related project or account, subject to legal and operational exceptions. Aggregated information that no longer identifies a person or project can be kept longer.

Security and abuse prevention

Authentication and security history is generally kept for up to 180 days. Rate limit records are kept for shorter operational periods unless an active investigation or legal duty requires more.

Billing, support, privacy, and audit records

Kept as reasonably needed for tax, accounting, fraud prevention, service history, legal compliance, request tracking, and disputes. Provider backups can remain until their normal replacement cycle.

Aggregated information that no longer identifies a person may be kept longer. To request account deletion, use the signed in message center, the public contact form, or email support@360plan.app.

We make the following request options available to people in the United States whose personal information we process, even when a state law does not require every option. Applicable law can provide additional rights or exceptions.

• Confirm whether we process your personal information
• Access the personal information we hold about you
• Correct inaccurate personal information
• Delete personal information, subject to lawful exceptions
• Receive a portable copy of information you provided
• Request a list of third parties that received your information when required by law
• Opt out of sale, targeted advertising, and significant profiling
• Limit certain uses of sensitive personal information when applicable
• Withdraw consent for processing that depends on consent
• Appeal a denied privacy request

We do not discriminate against a person for exercising a privacy right. To submit a request, use the signed in message center, the public contact form, or email support@360plan.app. Use the subject Privacy request. For an appeal, use the subject Privacy appeal and include the earlier request reference.

We verify requests in a way that is appropriate to the information involved. An authorized agent may act for you when permitted by law and when signed authority can be verified. We generally respond within forty five days where state law requires that period. We may use a lawful extension and will explain any denial, appeal method, or applicable regulator contact in our response.

During the preceding twelve months, 360Plan may have collected the categories described in the Notice at collection section. These can include identifiers, customer records, commercial information, internet or electronic activity, approximate geolocation, visual information, professional information a customer provides, limited inferences, and sensitive personal information used for permitted account, security, and service purposes.

We collect these categories from the sources and for the purposes described in this policy. We disclose them to the specific providers and other recipient categories described above. We have not sold or shared these categories for cross context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

California residents can exercise rights to know, access, correct, delete, and receive information about our practices. They can also use an authorized agent and receive equal service after making a request. The request methods in the preceding section are available without creating a new account.

We use administrative, technical, and organizational safeguards designed to protect information. These include private media storage, signed media access, ownership checks, access controls, encrypted provider secrets, rate limits, audit records, and limited administrator sessions. No online service can guarantee complete security.

Authorized administrators can access limited account information for support, security, billing, legal requests, and abuse review. Review of a private tour requires a separate administrator session, a recorded reason, and a time limited audited review. We provide legally required notice if a qualifying security incident affects personal information.

360Plan is a business service for adults and is not directed to anyone under 18. We do not knowingly collect personal information directly from a child under 13. If you believe a child created an account or directly provided personal information, contact us so we can review and remove it as required.

The application, accounts, media, and public tours are currently available only in the United States and its territories. Marketing, legal information, and support can remain available elsewhere. Network location is approximate and can be affected by a proxy or location masking service.

This service restriction is not a promise of United States only data residency. Our application servers are in Germany. Information may also be processed in the United States and other locations where our providers operate, subject to appropriate protections required by applicable law.

We may update this policy as the product, our practices, or the law changes. We will post the new effective date and provide additional notice when a change materially affects privacy rights or when law requires notice or consent.

Contact J&J Enterprises, LLC at support@360plan.app, through the public contact form, or through the signed in message center. These methods can be used for questions, privacy requests, appeals, and complaints.

To report an intimate image or video shared without consent, use the content removal request so the report receives the information and tracking reference required for urgent review.