Privacy Policy

Last updated: 29 July 2026

This notice explains how Rentrar, the trading name of RENTRAR DATAWAREHOUSE ENTERPRISE, registration no. 202603190496 (003871935-W) ("we", "us"), collects, uses, discloses, and protects personal data in connection with the Rentrar service, in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA"), as amended by the Personal Data Protection (Amendment) Act 2024. It also serves as our personal data protection notice under section 7 of the PDPA. A Bahasa Malaysia summary appears at the end of this notice.

1. Personal data we collect

• Account data: your email address, name, and Google account identifier, received from Google when you sign in. We use Google sign-in only and never see or store a password.
• Subscription data: your plan, subscription status, and billing events (e.g. renewal, cancellation) received from Stripe, our payment processor. Payment details — card numbers and billing address — are collected and stored by Stripe; we never see them.
• Usage data: aggregated, cookieless page analytics (Vercel Analytics) and server logs containing your IP address, browser user-agent, and requested URLs, kept for security, abuse prevention, rate limiting, and debugging.
• Measurement and advertising data: pages you view and a small number of conversion events (starting checkout, completing a subscription, and its value) sent to Google Analytics 4 and the Meta pixel, together with the device and browser identifiers those tools set. We use them to understand how the Service is found and used, and to measure and target our own advertising. We do not send your name, email address, or account identifier to either.
• Correspondence: emails you send us (e.g. support or data requests) and our replies.

Providing account data is necessary to use the Service; without it we cannot provide you an account.

2. Purposes and legal basis

We process personal data to:

• provide, operate, and secure the Service (performance of our contract with you);
• manage subscriptions, billing status, and entitlements (contract);
• prevent abuse, fraud, and unauthorised access, and enforce rate limits (legitimate interests / legal compliance);
• respond to your enquiries and legal requests (contract / legal compliance);
• send service and billing notices. We do not send marketing email without your consent, and you may opt out of any direct marketing at any time.

3. Cookies

Strictly necessary: authentication cookies set by our auth provider (Supabase) to keep you signed in, and cookies set by Google as part of Google sign-in / One Tap. Vercel Analytics is cookieless.

Analytics and advertising:Google Analytics 4 and the Meta pixel set cookies and read device identifiers to measure visits and conversions and to target our advertising. These are not necessary to use the Service. You can refuse or delete them in your browser settings (including by blocking third-party cookies), and browser tracking protection or an ad blocker will stop them loading — the Service works normally either way. You can also opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout) and manage Meta's use of off-platform activity in your Meta account settings. We do not sell personal data.

4. Disclosure of personal data

We do not sell personal data. Apart from the measurement and advertising data described in sections 1 and 3, we disclose personal data only to service providers processing it on our behalf, and where required by law:

• Supabase — database and authentication hosting (account and subscription records).
• Vercel — website hosting, server logs, and aggregated analytics.
• Stripe (Stripe, Inc. and its affiliates) — payment processor; acts as an independent controller of checkout and payment data under its own privacy policy.
• Google — sign-in, and Google Analytics 4 for measurement and advertising; Google processes this data under its own privacy policy.
• Meta (Meta Platforms, Inc. and Meta Platforms Ireland) — the Meta pixel, for measuring and targeting our advertising. Meta acts as an independent controller for its own purposes under its own privacy policy.
• OpenFreeMap — map tiles are loaded directly from tiles.openfreemap.org, so your IP address and tile requests are visible to that provider.
• Authorities, where disclosure is required by law; and a successor entity in a merger, acquisition, or asset sale, subject to this notice.

Service providers that process personal data on our behalf do so under data processing agreements that require them to protect it and use it only on our instructions.

5. International transfers

Our providers store and process data outside Malaysia (including in the United States and the European Union). Where we transfer personal data outside Malaysia we do so in accordance with the PDPA, using providers that commit to appropriate safeguards for personal data.

6. Retention

• Account and subscription data: kept while your account exists, then deleted or anonymised within 90 days of account deletion, except records we must keep for legal, tax, or accounting purposes.
• Server logs: kept up to 90 days, then deleted or anonymised.
• Correspondence: kept up to 24 months after the matter is resolved, except records we must keep longer by law.

Aggregate map data contains no personal information and is retained indefinitely.

7. Security and breach notification

We take practical steps to protect personal data against loss, misuse, and unauthorised access, including encryption in transit, access controls, and row-level security on our database. No system is perfectly secure. If a personal data breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner as soon as practicable and in any case within 72 hours of becoming aware of the breach, and affected users without unreasonable delay and in any case within 7 days of notifying the Commissioner, as required by the PDPA.

8. Your rights

Under the PDPA you may:

• request access to your personal data (we may charge the prescribed fee);
• request correction of inaccurate, incomplete, or outdated data;
• withdraw consent to processing (which may require closing your account);
• object to processing for direct marketing;
• request a copy of your data in a portable format, where the data portability right applies;
• request deletion of your account and data.

Email us at the address below; we respond within 21 days as required by the PDPA. Deleting your account removes your profile and subscription record. If you are unsatisfied with our response, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, www.pdp.gov.my).

9. Children

The Service is not directed at persons under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us personal data, contact us and we will delete it.

10. Changes to this notice

We may update this notice from time to time. For material changes we will give notice by email or in-product before they take effect. The "Last updated" date above reflects the current version.

Notis Perlindungan Data Peribadi (Ringkasan)

Selaras dengan seksyen 7 Akta Perlindungan Data Peribadi 2010: Rentrar memproses data peribadi anda (alamat e-mel, nama, pengecam akaun Google, status langganan, alamat IP dan log pelayan) untuk menyediakan dan melindungi perkhidmatan, mengurus langganan, dan mematuhi undang-undang. Data peribadi diperoleh terus daripada anda, dan daripada Google serta Stripe apabila anda mendaftar atau melanggan. Pemberian data akaun adalah wajib untuk menggunakan perkhidmatan; tanpanya kami tidak dapat menyediakan akaun kepada anda. Data mungkin dizahirkan kepada pembekal perkhidmatan kami (Supabase, Vercel, Stripe, Google, Meta, OpenFreeMap) termasuk di luar Malaysia. Kami menggunakan Google Analytics 4 dan piksel Meta untuk mengukur penggunaan dan pengiklanan kami; anda boleh menolak kuki tersebut melalui tetapan pelayar anda. Kami tidak menjual data peribadi anda. Anda berhak memohon akses kepada dan pembetulan data peribadi anda, menarik balik persetujuan, mengehadkan pemprosesan, membantah pemasaran langsung, dan memohon pemadaman akaun anda, dengan menghubungi kami di alamat di bawah. Sekiranya terdapat percanggahan antara versi Bahasa Inggeris dan ringkasan ini, versi Bahasa Inggeris akan diguna pakai setakat yang dibenarkan oleh undang-undang.

Contact

Privacy matters are handled by our designated privacy contact at the email address below.

RENTRAR DATAWAREHOUSE ENTERPRISE
202603190496 (003871935-W)
[email protected]