Privacy Policy

This Privacy Policy explains how RentDeck, operated by Appcademy, collects, uses, discloses, and protects your personal data in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA).

1. Data We Collect

• Account data — name, email, phone number, password (stored as a hash), and your role (seeker, operator, or agent).
• Enquiry data — details you provide when enquiring (including budget and preferred move-in date), the enquiry channel (form or WhatsApp), and your IP address and user agent for security and spam prevention.
• Verification documents — copies of documents such as SSM registration, identity card, or REN certificate submitted by operators and agents. These are stored on private storage and are accessible only to administrators for review purposes.
• Usage data — first-party cookies for language and login session, and agent referral attribution (the 30-day rd_ref cookie), plus referral click tracking that records your IP address in hashed form only, never the raw value.

2. Purposes of Use

We use your data to: operate accounts and the Platform; deliver your enquiries to the relevant operators; process operator/agent verification; calculate agent attribution and commissions; send notifications you subscribe to (saved searches, price drops, viewing appointments — each can be turned off in your profile settings); and maintain the Platform's security and integrity.

3. Disclosure to Third Parties

3.1. When you submit an enquiry, the relevant listing's operator receives your contact details (name, phone, email if provided) for the purpose of that enquiry only.

3.2. We do not sell your personal data to any party. Data is disclosed only where required by law or a valid court order.

3.3. Service providers assisting our operations (such as hosting) process data under confidentiality obligations.

4. Security and Retention

We apply reasonable technical and organisational measures: passwords and sensitive values are encrypted or hashed, verification documents are held on private storage, and administrator access is restricted and logged. Personal data is retained while your account is active or as required for audit and legal purposes; data no longer needed is deleted or anonymized.

5. Your Rights

Under the PDPA, you have the right to: access the personal data we hold about you; correct inaccurate data; withdraw consent to processing (subject to the Platform's operational needs); and delete your account. Some of these rights are self-service on your account profile page (update details, notification settings, or delete account — which also anonymizes your email). For other requests, contact us at [email protected].

6. Cookies

We use first-party cookies only, for essential functions (session, language) and agent referral attribution. No third-party advertising cookies are used.

7. Changes to This Policy

Any changes will be published on this page together with the updated date. Continued use after changes constitutes acceptance of the updated policy.

Last updated 17 July 2026. For any questions about personal data, contact [email protected].