Privacy Policy

1. Who we are

TenancyDesk is a tenancy management platform operated from Malaysia and used by landlords worldwide. Our registered email is hello@tenancydesk.my. We handle personal data in line with applicable data protection laws, including Malaysia's Personal Data Protection Act 2010 (PDPA) and, where relevant, the EU/UK GDPR.

2. What data we collect

• Account data — name, email, Google profile (if you use Google sign-in)
• Tenant data you enter — names, national ID or passport numbers, contact details, tenancy history
• Property data — addresses, rental amounts, unit details
• Payment records — subscription amounts, dates, receipt history
• Usage data — pages visited, features used, timestamps

3. How we protect your data

Sensitive tenant identifiers (national ID and passport numbers) are encrypted at rest using AES-256 encryption. Application data is stored on servers located in Malaysia/Singapore. We use HTTPS for all data in transit. Access to personal data is restricted by role — only Owners and Admins can view sensitive tenant identifiers.

4. How we use your data

• To provide tenancy management features
• To generate PDF documents and receipts
• To send rent reminders and notices on your behalf
• To improve the platform (aggregated, anonymised analytics only)
• To comply with legal obligations

We do not sell your data to third parties.

5. Third-party services

We use the following sub-processors:

• Paddle — payment processing and Merchant of Record for international customers (handles card details and applicable sales tax/VAT)
• HitPay — payment processing for customers in Malaysia
• OpenAI — AI document drafting (prompts only; no sensitive tenant identifiers are sent)
• Google — OAuth sign-in; Google Analytics (website usage measurement); Google Ads (advertising conversion measurement)
• Meta (Facebook) — Meta Pixel, used to measure how our advertising on Facebook and Instagram performs
• Sentry — error monitoring (anonymised)
• PostHog — product analytics (aggregated usage)

6. Cookies, analytics and advertising

We use the Meta Pixel and Google Analytics to understand how people find TenancyDesk and which pages and adverts lead to sign-ups. These set cookies and share limited technical data — your IP address, browser, and the pages you visit — with Meta and Google, who act as independent controllers of that data.

These tags load across our website, including while you are signed in. We never send tenant personal data, rent amounts, or document contents to Meta or Google.

You can opt out at any time using your browser's cookie controls or an ad blocker, and via Google Ads Settings and Meta ad preferences. Opting out does not affect your use of TenancyDesk.

7. Your rights

Depending on your jurisdiction (for example under the PDPA or GDPR), you have the right to access, correct, export, and request deletion of your personal data. You can export all your data from Settings → Account → Export Data. To delete your account and all associated data, go to Settings → Account → Delete Account.

8. Data retention

We retain your data for as long as your account is active. When you delete a workspace, uploaded files (agreements, signatures, notices, receipts, documents) are permanently removed and tenant personal data (national ID/passport numbers, contact details, notes) is scrubbed shortly after deletion. Payment and webhook transaction records are retained for up to 7 years where required for tax and financial compliance purposes.

9. Contact

For privacy concerns, email hello@tenancydesk.my.