隐私政策

1. What SifuProperty collects

• Buyer inquiries: name, phone, email, message — shared with the agent you contact.
• Agent accounts: name, email, phone, REN/REA registration number, agency, profile bio.
• Identity verification (agents): we verify your REN/REA number against the public register maintained by the Board of Valuers, Appraisers, Estate Agents and Property Managers (BOVAEP/LPPEH), and may ask you to submit your REN tag and a photo of yourself holding it for manual review. We do not collect MyKad (NRIC) numbers — under the PDPA 2010 these are sensitive personal data that we do not need for verification.
• Listings: property details and photos you upload.
• Usage data: pages viewed, searches, saved listings (anonymous token or your account).
• Analytics: aggregated, non-identifying — to improve the product.

2. Why SifuProperty collects it

• To connect property buyers with BOVAEP-registered real estate negotiators (RENs) and estate agents (REAs).
• To verify that agents are who they say they are — by checking the REN/REA number and name against the BOVAEP public register and reviewing the identity documents submitted.
• To send inquiry notifications and (with consent) listing alerts.
• To prevent fraud and abuse, including impersonation of an agent using a publicly-available REN number.
• To comply with Malaysian tax and consumer law.

Agent identity verification is document-based: with your consent at sign-up, SifuProperty checks your name and REN/REA number against the public register maintained by BOVAEP (LPPEH), and our team manually reviews the REN tag and photo identity evidence you submit — solely to confirm you are the registered practitioner. We do not use, request, or store MyKad numbers for this process.

3. Who it is shared with

When you submit an inquiry, SifuProperty shares your contact details with the receiving agent only — never with other agents, marketers, or third parties.

SifuProperty uses the following sub-processors:

• Supabase (database + auth) — US/EU regions, SOC 2 certified.
• Resend (transactional email) — US.
• Anthropic Claude API (AI assistance) — listing details are sent to generate descriptions/scoring. Buyer contact info is not sent for AI training; Claude API data is not used to train models.
• Stripe (payments) — handles all card data for agent subscriptions and for services-marketplace payments, escrow and payouts to vendors (via Stripe Connect); SifuProperty never sees your card details.
• Mapping/geocoding provider — listing addresses are sent to a mapping service to place properties on the map; no buyer contact details are included.

4. How long your data is kept

• Inquiries — kept by the receiving agent for as long as their account is active, plus 3 years for tax records.
• Anonymous saved listings — until you clear browser storage.
• Agent accounts — deleted on request, or auto-deleted 2 years after the last sign-in.
• Listings — kept while active; archived for 1 year after deletion for fraud investigation.

5. Your rights under the PDPA 2010

You can ask SifuProperty to: access the personal data held about you, correct inaccuracies, delete your account and data, withdraw consent to processing, or stop direct marketing communications (as provided by the PDPA 2010). Email privacy@sifuproperty.com.

You can lodge a complaint with the Personal Data Protection Department (JPDP), the regulator under the PDPA 2010, if you believe your data has been mishandled.

6. Cookies & tracking

SifuProperty uses first-party cookies for authentication and to remember your saved listings. SifuProperty does not use third-party advertising or marketing trackers. Where an agent adds an introduction video to their profile, it is embedded through YouTube’s privacy-enhanced player (youtube-nocookie.com), which may set cookies on your device only if you press play.

7. Security

Data is transmitted over HTTPS and stored encrypted at rest. Passwords are hashed with bcrypt. Database access is restricted by row-level security to the owning agent or admin.

8. Changes

If this policy materially changes, SifuProperty will notify agents via email at least 30 days before the change takes effect.

9. Data Protection Officer

SifuProperty’s Data Protection Officer (appointed in line with the Personal Data Protection (Amendment) Act 2024) can be reached at dpo@sifuproperty.com.