Privacy Policy

1. Who we are

TenancyDesk is a tenancy management platform operated from Malaysia. Our registered email is hello@tenancydesk.my. We are subject to Malaysia's Personal Data Protection Act 2010 (PDPA).

2. What data we collect

• Account data — name, email, Google profile (if you use Google sign-in)
• Tenant data you enter — names, IC numbers, passport numbers, contact details, tenancy history
• Property data — addresses, rental amounts, unit details
• Payment records — rent amounts, dates, receipt history
• Usage data — pages visited, features used, timestamps

3. How we protect your data

Tenant IC and passport numbers are encrypted at rest using AES-256 encryption. All data is stored on servers located in Malaysia/Singapore. We use HTTPS for all data in transit. Access to personal data is restricted by role — only Owners and Admins can view sensitive tenant identifiers.

4. How we use your data

• To provide tenancy management features
• To generate PDF documents and receipts
• To send rent reminders and notices on your behalf
• To improve the platform (aggregated, anonymised analytics only)
• To comply with legal obligations

We do not sell your data to third parties.

5. Third-party services

We use the following sub-processors:

• HitPay — payment processing
• OpenAI — AI notice drafting (prompts only, no tenant PII sent)
• Google — OAuth sign-in
• Sentry — error monitoring (anonymised)

6. Your rights (PDPA)

You have the right to access, correct, and request deletion of your personal data. You can export all your data from Settings → Account → Export Data. To delete your account and all associated data, go to Settings → Account → Delete Account.

7. Data retention

We retain your data for as long as your account is active. After account deletion, your data is anonymised within 30 days except where legal retention requirements apply.

8. Contact

For privacy concerns, email privacy@tenancydesk.my.