Data Handling Explanation

1. Database and Hosting

SewaManager's core database is hosted on Supabase (PostgreSQL) in the Southeast Asia region (Singapore). We utilize Supabase Row Level Security (RLS) to ensure that users can only access data they own or have been explicitly granted permission to view (e.g., a landlord viewing their own tenant's data).

2. Document Storage (Tenancy Agreements, IDs, Payment Proofs)

Sensitive documents such as tenancy agreements, identity documents (IC/Passport), and payment receipts are stored in private Supabase Storage buckets.

• Private Buckets: These buckets are not publicly accessible via the internet.
• Signed URLs: Access to files requires a temporary, time-limited signed URL, which is only generated for authenticated, authorized users via our secure API.

3. Communication Data (WhatsApp)

SewaManager utilizes the Meta WhatsApp Business API to send automated notifications (e.g., rent reminders, viewing confirmations).

• Phone numbers are stored securely in our database and used exclusively for transaction-related communications.
• Message templates are pre-approved by Meta and do not contain sensitive financial data beyond invoice amounts and due dates.

4. Public Listings and Profiles

Information intended for public consumption, such as property listings and agent profiles, is stored in public-read database tables and public storage buckets. Only information explicitly provided for the purpose of a public listing is exposed in this manner.

5. Data Deletion and Export

Users can request the deletion of their personal data via our Data Deletion Request form. We also support exporting your core data (profile, tenancies, invoices) in JSON format for your own records via our authenticated API. Note that some financial and tenancy records may be retained for up to 6 years as required by the Malaysian Limitation Act 1953.