Privacy Policy

Effective date: 1 June 2026 Version: v1

This Privacy Policy explains how www.geekrumahkk.com ("we", "the site") collects and uses your personal data. The site is a property analytics tool that lets signed-in users browse listings, save favourites, and run investment-toolkit scenarios. Please read this alongside our Terms of Service. A Bahasa Malaysia version is available here.

1. Who collects your data

Personal data submitted through this site is collected by www.geekrumahkk.com.

2. What we collect

When you create an account: your name, email address, Malaysian mobile number, and a salted hash of your password (the password itself is never stored).

While you use the site: listings you save, investment-toolkit scenarios you save, sign-in timestamps, and a hashed IP address with a shortened User-Agent recorded at the moment you grant or withdraw consent (to evidence the consent transaction).

3. Why we collect it

To operate the site: authenticate your account, store the listings and scenarios you save, and — with your signup consent — contact you about properties by WhatsApp, phone, or email. Operational emails such as account verification, password reset, and account-closure confirmation are sent as part of running your account.

4. Who we share it with

Only the third-party service providers required to run the site:

• Resend — transactional email (verification, notifications).
• Cloudinary — image hosting for listings and site assets.
• Upstash — rate-limit infrastructure.
• Vercel — application hosting.

We may also disclose data to relevant authorities where compelled by Malaysian law. We do not sell your personal data and we do not share it with marketing partners.

5. International transfers

Some of the providers above operate outside Malaysia. We rely on their contractual commitments to apply security and confidentiality standards comparable to those required under the PDPA, and we transfer only what each provider needs.

6. How we protect your data

Passwords are stored as bcrypt hashes. All traffic is served over HTTPS. Sessions use a signed NextAuth JWT cookie. We apply rate-limiting and audit logging on sensitive endpoints.

7. How long we keep it

We retain your account data for as long as your account is open. When you close your account, we anonymise your name, email, and phone. Consent records are kept with a withdrawal timestamp as proof of the consent transaction, and minimal activity records may be retained where required by law.

8. Keeping data accurate

You can review and update your account details from your account settings at any time.

9. Your rights

You may access the personal data we hold about you, correct anything that is inaccurate, and withdraw consent at any time. Because the contact consent is essential to the service, withdrawing it closes your account. We aim to respond to access and correction requests within 21 days.

10. Cookies

We use a single authentication cookie issued by NextAuth to keep you signed in. We do not use third-party advertising or analytics cookies. You can clear the cookie by signing out or by clearing your browser's site data.

11. Changes to this policy

If we materially change this policy, we publish a new version (e.g. `v2`) and ask you to acknowledge it on your next sign-in. Older versions remain available at `/privacy?v=v1` for reference.

12. Contact

For any privacy question or to exercise the rights above, email geekrumahkk@gmail.com.