Privacy Policy | PoolStayz

PoolStayz (“we”, “our”) is committed to protecting your personal data in accordance with Malaysia’s Personal Data Protection Act 2010 (PDPA). This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

Account data: name, email address, phone number, and profile photo.
Booking data: check-in/out dates, number of guests, payment confirmation.
Payment data: transaction reference numbers. We do not store card numbers — payments are handled by Billplz.
Listing data (hosts): property address, photos, amenities, pricing, and bank account details for payouts.
Usage data: pages visited, search queries, device type, and IP address.
Communications: messages, reviews, and support emails you send us.

2. How We Use Your Data

To create and manage your account.
To process bookings and facilitate payments.
To send booking confirmations, reminders, and transactional emails.
To send platform updates and promotional emails (you may opt out at any time).
To detect fraud, enforce our Terms of Service, and comply with legal obligations.
To improve the platform through anonymised analytics.

3. Legal Basis for Processing

We process your personal data on the following bases:

Contract performance: to fulfil bookings you make or receive.
Legitimate interests: to prevent fraud and improve our service.
Consent: for marketing emails (revocable at any time).
Legal obligation: where required by Malaysian law.

4. Sharing Your Data

We do not sell your personal data. We share data only as necessary:

Between hosts and guests: guest name and phone are shared with the host of a confirmed booking, and vice versa, to enable the stay.
Billplz: payment gateway processing transactions on our behalf.
Supabase: database and authentication provider (data stored in servers compliant with international standards).
Resend: transactional email delivery service.
Legal authorities: where required by law or court order.

5. Data Retention

Account data is retained while your account is active and for 3 years after closure.
Booking records are retained for 7 years for accounting and legal purposes.
You may request earlier deletion of non-legally-required data by contacting us.

6. Cookies

We use essential cookies for authentication and session management. We do not use third-party advertising cookies. You can disable cookies in your browser settings, but this may prevent you from logging in.

7. Your Rights Under PDPA

You have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Withdraw consent for marketing communications at any time.
Request deletion of your data where no legal obligation requires retention.

To exercise any of these rights, email us at hello@poolstayz.com. We will respond within 21 days.

8. Security

We use industry-standard measures including encrypted connections (HTTPS), hashed passwords, and role-based access controls to protect your data. However, no system is completely secure and we cannot guarantee absolute security.

9. Children’s Privacy

PoolStayz is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you by email at least 14 days before significant changes take effect. The latest version is always available at poolstayz.com/privacy.

11. Contact

For privacy enquiries or data access requests, contact our data controller at:
hello@poolstayz.com