Privacy Policy

Last updated: 19 August 2026

This notice explains how Rentrar, the trading name of RENTRAR DATAWAREHOUSE ENTERPRISE, registration no. 202603190496 (003871935-W) ("we", "us"), collects, uses, discloses, and protects personal data in connection with the Rentrar service, in accordance with Malaysia's Personal Data Protection Act 2010 ("PDPA"), as amended by the Personal Data Protection (Amendment) Act 2024. It also serves as our personal data protection notice under section 7 of the PDPA. A Bahasa Malaysia summary appears at the end of this notice.

1. Personal data we collect

• Account data: your email address, name, and Google account identifier, received from Google when you sign in. We use Google sign-in only and never see or store a password.
• Subscription data: your plan, subscription status, and billing events (e.g. renewal, cancellation) received from Stripe, our payment processor. Payment details — card numbers and billing address — are collected and stored by Stripe; we never see them.
• Usage data: aggregated, cookieless page analytics (Vercel Analytics) and server logs containing your IP address, browser user-agent, and requested URLs, kept for security, abuse prevention, rate limiting, and debugging.
• Product analytics data: how the Service is used — pages viewed, searches, map areas and layers opened, paywall and checkout events, clicks on page elements and the visible labels of the controls you use, page performance timings, and error diagnostics (including error messages and stack traces) — collected through PostHog, together with your IP address, the approximate location derived from it, your device and browser type, and the referring or campaign URL that brought you here. Once you sign in we also send PostHog your account identifier and email address, so that this activity can be joined to your account. The search terms you type are recorded as part of these events.
• Session replay and heatmaps: PostHog also records your visit so that it can be replayed like a video — the pages you open, and your mouse movements, clicks, taps, scrolling, and screen size — and aggregates clicks and scroll depth into heatmaps showing where visitors interact with a page. Text you type into form fields is masked in your browser before the recording is sent, so we do not see the characters you enter. We never receive your password (sign-in is handled entirely by Google) or your card details (handled entirely by Stripe). We use replays and heatmaps only to find bugs and to see where the Service confuses people. If you would rather not be recorded, email us and we will exclude your account.
• Measurement and advertising data: pages you view and a small number of conversion events (starting checkout, completing a subscription, and its value) sent to Google Analytics 4 and the Meta pixel, together with the device and browser identifiers those tools set. We use them to understand how the Service is found and used, and to measure and target our own advertising. We do not send your name, email address, or account identifier to either.
• Correspondence: emails you send us (e.g. support or data requests) and our replies.

Providing account data is necessary to use the Service; without it we cannot provide you an account.

2. Purposes and legal basis

We process personal data to:

• provide, operate, and secure the Service (performance of our contract with you);
• manage subscriptions, billing status, and entitlements (contract);
• prevent abuse, fraud, and unauthorised access, and enforce rate limits (contract / legal compliance);
• respond to your enquiries and legal requests (contract / legal compliance);
• measure, debug, and improve the Service, including through product analytics, session replay, and heatmaps, and measure our own advertising (consent, which you may withdraw at any time without affecting your account);
• compile and verify rental market data, including by contacting agents, landlords, and other listing contacts (see section 10);
• send service and billing notices. We do not send marketing email without your consent, and you may opt out of any direct marketing at any time.

Under the PDPA we process personal data with your consent, which you give by providing your data and continuing to use the Service after receiving this notice, and we process without consent only where an exception in section 6(2) of the PDPA applies — in particular where processing is necessary to perform our contract with you, to take steps at your request before entering into one, or to comply with a legal obligation. You may withdraw consent at any time as described in section 8. Withdrawing consent for processing that is necessary to run your account means we can no longer provide you an account; withdrawing it for analytics, session replay, heatmaps, or advertising does not affect your account.

3. Cookies

Strictly necessary: authentication cookies set by our auth provider (Supabase) to keep you signed in, and cookies set by Google as part of Google sign-in / One Tap. Vercel Analytics is cookieless.

Analytics and advertising: PostHog sets a first-party cookie and a browser storage entry holding a random identifier, used to recognise your browser across visits and to group events, session replays, and heatmap interactions into a single session. Those requests are served from our own domain (rentrar.com) and forwarded to PostHog, so blocking third-party requests may not stop them; blocking or clearing cookies for rentrar.com will, and you may also email us to have product analytics switched off for your account. Google Analytics 4 and the Meta pixel set cookies and read device identifiers to measure visits and conversions and to target our advertising. These are not necessary to use the Service. You can refuse or delete them in your browser settings (including by blocking third-party cookies), and browser tracking protection or an ad blocker will stop them loading — the Service works normally either way. You can also opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout) and manage Meta's use of off-platform activity in your Meta account settings. We do not sell personal data.

4. Disclosure of personal data

We do not sell personal data. Apart from the measurement and advertising data described in sections 1 and 3, we disclose personal data only to service providers processing it on our behalf, and where required by law:

• Supabase — database and authentication hosting (account and subscription records).
• Vercel — website hosting, server logs, and aggregated analytics.
• PostHog (PostHog, Inc., United States) — product analytics and error monitoring. PostHog processes usage data, and the account identifier and email address of signed-in users, on our behalf and only on our instructions, under its data processing agreement and on its US cloud infrastructure.
• Stripe (Stripe, Inc. and its affiliates) — payment processor; acts as an independent controller of checkout and payment data under its own privacy policy.
• Google — sign-in, and Google Analytics 4 for measurement and advertising; Google processes this data under its own privacy policy.
• Meta (Meta Platforms, Inc. and Meta Platforms Ireland) — the Meta pixel, for measuring and targeting our advertising. Meta acts as an independent controller for its own purposes under its own privacy policy.
• OpenFreeMap — map tiles are loaded directly from tiles.openfreemap.org, so your IP address and tile requests are visible to that provider.
• Authorities, where disclosure is required by law; and a successor entity in a merger, acquisition, or asset sale, subject to this notice.

Service providers that process personal data on our behalf do so under data processing agreements that require them to protect it and use it only on our instructions. This list is current at the date of this notice; if we add or change a provider we will update it here.

5. International transfers

Our providers store and process data outside Malaysia (including in the United States and the European Union). We transfer personal data outside Malaysia only where the place of transfer has a law substantially similar to the PDPA, or where the recipient is bound by contractual commitments that ensure a standard of protection comparable to that required by the PDPA, as permitted by section 129 of the PDPA.

6. Retention

• Account and subscription data: kept while your account exists, then deleted or anonymised within 90 days of account deletion, except records we must keep for legal, tax, or accounting purposes.
• Server logs: kept up to 90 days, then deleted or anonymised.
• Product analytics events and error diagnostics: kept up to 12 months, then deleted or aggregated.
• Session replays: kept up to 30 days, then deleted. Heatmaps are aggregated and hold no identifier of any individual visitor.
• Correspondence: kept up to 24 months after the matter is resolved, except records we must keep longer by law.

Aggregate map data contains no personal information and is retained indefinitely.

7. Security and breach notification

We take practical steps to protect personal data against loss, misuse, and unauthorised access, including encryption in transit, access controls, and row-level security on our database. No system is perfectly secure. If a personal data breach causes or is likely to cause significant harm, we will notify the Personal Data Protection Commissioner as soon as practicable and in any case within 72 hours of becoming aware of the breach, and affected users without unreasonable delay and in any case within 7 days of notifying the Commissioner, as required by the PDPA.

8. Your rights

Under the PDPA you may:

• request access to your personal data (we may charge the prescribed fee);
• request correction of inaccurate, incomplete, or outdated data;
• withdraw consent to processing (which may require closing your account);
• object to processing for direct marketing;
• ask us to limit how we process your personal data, including asking us to stop analytics, session replay, or contacting you;
• request a copy of your data in a portable format, where the data portability right applies;
• request deletion of your account and data.

Email us at the address below; we respond within 21 days as required by the PDPA. Deleting your account removes your profile and subscription record. If you are unsatisfied with our response, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, www.pdp.gov.my).

9. Children

The Service is not directed at persons under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us personal data, contact us and we will delete it.

10. Where our rental data comes from

The market data shown on the Service is compiled from a range of sources, including but not limited to: publicly available rental listings and property websites; information provided directly by real estate agents, agencies, landlords, and property managers; interviews and conversations with market participants; field visits and on-site surveys carried out by us or on our behalf; licensed or partner data feeds; publicly available government, planning, and transport data; and corrections submitted by users of the Service.

Collecting this data can involve limited personal data about people acting in a business capacity — typically an agent's or landlord's name, agency, professional registration number, business contact details, and the listing information they have themselves published or given to us. We use it only to verify listings and asking rents, to keep a record of where a figure came from, and to contact that person about the data. Where the PDPA requires consent for this processing we rely on the consent of the person concerned; where we collect the data from a source other than that person — for example a listing they have published — this section is the notice required by section 7 of the PDPA, given as soon as practicable. Anyone concerned may object at any time, and we will then stop processing their data, other than keeping the minimum record needed to make sure we do not contact them again.

What the Service publishes is aggregated market data — price bands, medians, and area statistics. We do not publish agent or landlord contact details, and we do not sell them. If you are an agent, landlord, or other listing contact, you have the same rights as any other individual under section 8 above: you may ask what we hold, ask us to correct it, ask us to stop contacting you, or ask us to delete it. Email us at the address below.

11. Automated and AI-assisted contact

Some of that outreach is carried out by automated systems, including AI agents that can call, message, or email real estate agents, landlords, and other listing contacts on our behalf to confirm a listing, an asking rent, or the status of a property.

• The system identifies itself as an automated assistant acting for Rentrar at the start of the interaction, and you may ask at any point to deal with a person instead.
• Calls and messages may be recorded or transcribed for accuracy and record-keeping. Where a call is recorded, you will be told at the start of the call and may decline.
• What we take from these interactions is limited to property and rental information and the business contact details of the person we spoke to. We do not use these conversations to make any decision that produces legal or similarly significant effects for the person contacted.
• You may opt out at any time — tell the assistant, reply to stop, or email us — and we will add your details to our do-not-contact record and stop contacting you.

12. Changes to this notice

We may update this notice from time to time. For material changes we will give notice by email or in-product before they take effect. The "Last updated" date above reflects the current version.

Notis Perlindungan Data Peribadi (Ringkasan)

Selaras dengan seksyen 7 Akta Perlindungan Data Peribadi 2010: Rentrar memproses data peribadi anda (alamat e-mel, nama, pengecam akaun Google, status langganan, alamat IP dan log pelayan) untuk menyediakan dan melindungi perkhidmatan, mengurus langganan, dan mematuhi undang-undang. Data peribadi diperoleh terus daripada anda, dan daripada Google serta Stripe apabila anda mendaftar atau melanggan. Pemberian data akaun adalah wajib untuk menggunakan perkhidmatan; tanpanya kami tidak dapat menyediakan akaun kepada anda. Data mungkin dizahirkan kepada pembekal perkhidmatan kami (Supabase, Vercel, PostHog, Stripe, Google, Meta, OpenFreeMap) termasuk di luar Malaysia. Kami menggunakan PostHog untuk analitik produk dan pemantauan ralat (termasuk pengecam akaun dan alamat e-mel anda selepas anda log masuk), termasuk rakaman sesi (session replay) dan peta haba yang merakam halaman yang anda buka serta klik, tatal, dan gerakan tetikus anda; teks yang anda taip ke dalam medan borang dilindungi (masked) dan tidak dihantar kepada kami. Kami juga menggunakan Google Analytics 4 dan piksel Meta untuk mengukur penggunaan dan pengiklanan kami; anda boleh menolak kuki tersebut melalui tetapan pelayar anda. Data pasaran kami dikumpul daripada pelbagai sumber, termasuk tetapi tidak terhad kepada sumber awam, hubungan terus dengan ejen hartanah dan tuan rumah, temu bual, dan lawatan lapangan. Sebahagian daripada hubungan tersebut dibuat oleh ejen AI (sistem automatik) yang memperkenalkan dirinya sebagai pembantu automatik bagi pihak Rentrar; anda boleh meminta untuk berurusan dengan manusia atau menarik diri pada bila-bila masa. Kami tidak menjual data peribadi anda. Anda berhak memohon akses kepada dan pembetulan data peribadi anda, menarik balik persetujuan, mengehadkan pemprosesan, membantah pemasaran langsung, dan memohon pemadaman akaun anda, dengan menghubungi kami di alamat di bawah. Sekiranya terdapat percanggahan antara versi Bahasa Inggeris dan ringkasan ini, versi Bahasa Inggeris akan diguna pakai setakat yang dibenarkan oleh undang-undang.

Contact

Privacy matters are handled by our designated privacy contact at the email address below.

RENTRAR DATAWAREHOUSE ENTERPRISE
202603190496 (003871935-W)
[email protected]