Privacy Policy

Effective date: 29 August 2026

This Privacy Policy explains how SmartHarta (“SmartHarta”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal data when you use our website, applications, portals, subscription plans, add-ons, and related services (collectively, the “Service”).

SmartHarta processes personal data in accordance with applicable Malaysian law, including the Personal Data Protection Act 2010 (“PDPA”) and its amendments.

1. Scope of This Policy

This Policy applies to property owners, account administrators, staff, team members, tenants, maintainers, affiliates, website visitors, and other individuals whose personal data is processed through the Service.

Where a property owner uploads or manages personal data about tenants, staff, maintainers, or other individuals, that owner is responsible for providing appropriate notices and obtaining any consent or authority required by law. SmartHarta processes that data to provide the Service on the owner’s instructions.

2. Personal Data We Collect

Depending on how you use SmartHarta, we may collect:

Account data: name, email address, telephone number, password hash, profile image, account role, status, and verification information;

Property data: property names, addresses, unit details, ownership or lease information, images, documents, and assigned users;

Tenant and maintainer data: contact details, tenancy information, employment details, identification or KYC records where enabled, maintenance requests, and communications;

Financial and transaction data: invoices, rental amounts, deposits, expenses, payment status, subscription records, and transaction references;

Uploaded content: agreements, receipts, invoices, photographs, attachments, and other files submitted to the Service;

Technical data: IP address, browser type, device information, operating system, timestamps, logs, cookies, and security events;

Support and communication data: enquiries, tickets, feedback, WhatsApp requests, email correspondence, and support-session records; and

AI input and output: prompts, selected content, generated drafts, and related usage information when AI features are used.

3. How We Collect Personal Data

We collect personal data directly from you, from an owner or administrator who creates or manages your account, through your use of the Service, from uploaded documents, through cookies and logs, and from integrated service providers where permitted.

4. Purposes of Processing

We may process personal data to:

create, authenticate, administer, and secure accounts;

provide property, tenant, invoice, expense, maintenance, document, reporting, and team-management functions;

process subscriptions, add-ons, payments, renewals, cancellations, and transaction verification;

send service notices, invoices, reminders, security alerts, and support communications;

provide AI-assisted drafting or analysis requested by the user;

monitor performance, prevent fraud, investigate misuse, and improve security;

diagnose errors, maintain backups, and improve the Service;

comply with legal, regulatory, tax, accounting, and law-enforcement requirements; and

send marketing communications where consent is required and obtained.

5. Legal Basis and Consent

We process personal data where necessary to provide the Service, perform contractual obligations, comply with legal duties, protect legitimate business and security interests, or where valid consent has been provided. Where processing relies on consent, you may withdraw that consent subject to legal or contractual restrictions.

6. Disclosure of Personal Data

We may disclose personal data only where reasonably necessary to:

authorised owners, staff, team members, tenants, and maintainers according to their roles and assigned property access;

payment gateways, cloud-hosting providers, email providers, storage providers, analytics or security providers, and customer-support tools;

integration providers such as WhatsApp, Telegram, OpenAI, or other services selected or enabled by the user;

professional advisers, auditors, insurers, or prospective business transaction parties under appropriate confidentiality obligations; or

government authorities, regulators, courts, or law-enforcement agencies where required or permitted by law.

We do not sell personal data.

7. Payment Information

Payments may be processed by third-party gateways such as Stripe or ToyyibPay. SmartHarta generally receives transaction references, payment status, subscription identifiers, and limited billing information. Full payment-card details are handled by the relevant payment provider according to its own privacy and security practices.

8. AI Features

When you use an AI feature, the information included in your prompt or selected content may be sent to the configured AI provider to generate a response. Do not submit unnecessary sensitive personal data to AI features. AI output may be stored with the relevant draft or activity where required to provide the feature.

9. Cookies and Similar Technologies

SmartHarta may use essential cookies for authentication, session management, security, language preferences, and core functionality. We may also use analytics or preference cookies where enabled. Further information is available in our Cookie Policy.

10. Cross-Border Data Transfers

Some service providers may process or store data outside Malaysia. Where personal data is transferred across borders, SmartHarta will take reasonable steps to use providers and safeguards consistent with applicable PDPA requirements.

11. Data Security

We use reasonable administrative, technical, and organisational measures designed to protect personal data against loss, misuse, unauthorised access, alteration, disclosure, or destruction. These measures may include access controls, role permissions, authentication, logging, encrypted connections, backups, and restricted support access.

No internet-based service can guarantee absolute security. You must protect your password, limit account access, assign suitable permissions, and notify us promptly of suspected unauthorised activity.

12. Support Access and Impersonation

Authorised SmartHarta superadministrators may access an owner or staff account in a clearly identified support mode when necessary to investigate or resolve a reported issue. Such access is restricted, displayed in the interface, and recorded in system logs.

13. Data Retention

We retain personal data only for as long as reasonably necessary to provide the Service, maintain business and transaction records, resolve disputes, enforce agreements, maintain security, and comply with legal obligations. Retention periods vary according to the type of data and applicable requirements.

When data is no longer required, we may securely delete, anonymise, or aggregate it. Backup copies may remain for a limited period until they are overwritten according to backup schedules.

14. Your Rights

Subject to the PDPA and applicable exceptions, you may request to:

access personal data held about you;

correct inaccurate, incomplete, or outdated personal data;

withdraw consent where processing is based on consent;

limit certain processing or direct marketing; and

raise a complaint concerning our handling of personal data.

We may need to verify your identity and authority before processing a request. If your data is controlled by a property owner using SmartHarta, we may direct your request to that owner or assist the owner in responding.

15. Marketing Communications

You may opt out of promotional email or direct-marketing communications using the available unsubscribe method or by contacting us. You may still receive essential account, transaction, security, and service messages.

16. Children’s Data

The Service is intended for adults and business use. You must not submit a child’s personal data unless you have a lawful reason and all necessary authority or consent to do so.

17. Third-Party Links and Services

The Service may contain links to third-party websites or services. Their privacy practices are governed by their own policies. SmartHarta is not responsible for third-party privacy practices outside our control.

18. Data Breaches

SmartHarta maintains procedures to investigate and respond to suspected personal-data breaches. Where required by applicable law, we will notify the relevant authority and affected individuals within the required manner and timeframe.

19. Changes to This Policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. Material changes will be communicated through the website, Service, or registered email address. The effective date above indicates the latest revision.

20. Contact Us

For privacy questions, requests, or complaints, please contact SmartHarta through the Contact Us page or the official contact details displayed on our website. Please include sufficient information for us to identify your account and understand your request.