Your Data Matters

1. Information We Collect

We process personal data in accordance with the Personal Data Protection Act 2010 (PDPA) of Malaysia. This section explains what we collect, and why.

• Personal identifiers: Your name, email address, phone number, and — for hosts — your national ID (IC) and bank details, for verification and payout only.
• Booking data: Check-in/check-out dates, homestay preferences, payment details, and booking history.
• Technical data: IP address and access timestamps recorded automatically for security and abuse prevention. Our analytics service (see section 6) also records general device, operating system, and browser information.
• Communications: Messages exchanged between guests and hosts through our platform.
• Payment information: We do not store card or online banking credentials. Payments are processed by CHIP (FPX).

2. How We Use Your Data

Your data is used for the following purposes:

• Process bookings and payments through CHIP (FPX)
• Verify host and guest identities to prevent fraud and impersonation
• Send booking confirmations, reminders, check-in codes, and updates
• Provide customer support and resolve disputes
• Understand how the platform is used, so we can improve it
• Comply with legal and regulatory requirements

3. Data Security

We use the following measures to protect your data:

Data in transit is encrypted using TLS/SSL. Passwords are hashed and never stored in readable form. User input is sanitised on the client before rendering and again on the server before storage.

No system is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach that affects your personal data, we will notify you and the relevant authority as required by the PDPA.

4. Data Sharing

We never sell your personal data. Information is shared only in the following circumstances:

• With hosts: To complete a booking, we share the guest's name, phone number, and booking dates with the host of that property.
• With CHIP: For payment processing, we share the booking ID, guest name and email (for the receipt), and the amount charged.
• With service providers: The third parties listed in section 8, who process data on our behalf or provide the services described.
• Legal compliance: Where required by law enforcement or a regulatory authority.
• With your consent: Where you have explicitly authorised us to share information.

5. Your Data Rights

Under the Personal Data Protection Act 2010 (PDPA), you have the following rights:

• Right to access: Request a copy of the personal data we hold about you.
• Right to correction: Ask us to correct any inaccurate or incomplete data.
• Right to restrict processing: Ask us to limit how we use your data — for example, to stop using it for analytics while keeping it for booking records.
• Right to withdraw consent: Withdraw your consent to processing at any time. This does not affect the lawfulness of processing already carried out. Note that withdrawing consent for essential processing may mean we can no longer provide the service.
• Right to deletion: Request deletion of your data, subject to the legal retention requirements in section 7.

To exercise these rights, contact us at support@kundasanghomestay.my. We respond to all privacy requests within 48 hours, and action requests within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Department of Personal Data Protection (JPDP), or contact our team first and we will try to resolve it.

6. Cookies & Analytics

We use a small number of cookies. They fall into two groups:

• Essential cookies. Session and authentication cookies that keep you logged in and protect the site against cross-site request forgery. The platform cannot work without these.
• Analytics cookies. We use Google Analytics 4 to understand which pages are visited and how people find us. Google Analytics sets cookies (including _ga and _ga_ prefixed cookies, which can last up to 2 years) and may process your IP address, approximate location, device type, browser and operating system, and the pages you view.

We do not use advertising cookies, and we do not run targeted advertising. We do not sell or share your data with advertising networks. Some analytics data may be processed by Google outside Malaysia — see section 8.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google's browser opt-out add-on. Blocking essential cookies may prevent you from logging in or booking. For the full cookie list, see our Cookie Policy.

7. Data Retention

We keep different categories of data for different periods:

• Host IC images and bank QR codes: deleted once the host's listing is approved, unless you ask us to keep them on file.
• Booking and payout records: retained for 7 years, as required for Malaysian tax and financial record-keeping.
• Guest account data: retained while your account is active, and for as long as needed to resolve disputes and meet legal obligations.
• Analytics data: retained according to the retention setting in our Google Analytics property.

You may request deletion of your data at any time, subject to the retention requirements above. Requests are actioned within 30 days.

8. Third-Party Services

We use the following third-party services, which may process your data:

• CHIP: payment processing, including FPX online banking (Malaysia)
• Cloudflare: hosting, security, DDoS protection and content delivery
• Resend: transactional email delivery (booking confirmations, check-in codes)
• Cloudinary: image hosting for property photos
• Google Analytics: website usage analytics (Google LLC)

Some of these providers are based outside Malaysia, so your data may be transferred to and processed in other countries. Where we rely on such providers, we do so on the basis that they are contractually required to protect your data. Each provider also has its own privacy policy.