Data Handling Explanation

1. Database and Hosting

SewaManager's core database, authentication, and file storage use Supabase. Row Level Security (RLS) and server-side authorization checks restrict private records according to account role, ownership, and tenancy or agency relationships. Public listing rows are governed by separate publication and moderation rules.

2. Document Storage (Tenancy Agreements, IDs, Payment Proofs)

Sensitive documents such as tenancy agreements, identity documents (IC/Passport), and payment receipts are stored in private Supabase Storage buckets.

• Private Buckets: These buckets are not publicly accessible via the internet.
• Signed URLs: Access to files requires a temporary, time-limited signed URL, which is only generated for authenticated, authorized users via our secure API.

3. Communication Data (WhatsApp)

SewaManager utilizes the Meta WhatsApp Business API to send automated notifications (e.g., rent reminders, viewing confirmations).

• Phone numbers are used for expected tenancy, enquiry, support, and account-related communications.
• Messages can contain tenancy context such as an amount, due date, property label, or onboarding link. Users should avoid placing identity-document images or unnecessary sensitive data in message text.

4. Public Listings and Profiles

Moderated property listings and public agent-profile fields can be read without signing in. Publication checks exclude drafts, archived rows, demo records, and incomplete rows. A public listing may include its location, price, photos, supplied contact route, publisher attribution, and precise public review claims; identity documents and private review evidence are not included in the public claim view.

5. Data Deletion and Export

Users can request deletion via our Data Deletion Request form. The request receives a reference and enters an identity-verification workflow before any destructive action. Authenticated users can export core profile, tenancy, and invoice data in JSON. Some records may be restricted or retained for accounting, stamp-duty, fraud-prevention, dispute, or legal-hold reasons as described in the Privacy Policy.