Privacy Policy

1. Data we collect from agents

• Account details: registered name, display name, email address, mobile number, WhatsApp work number, profile photo, languages spoken and service areas.
• Registration details: registration type (REN, REA or PEA), registration number, firm name and firm registration number, and the outcome of our verification.
• Sign-in data: your password (stored only as a one-way hash) and one-time codes. If you sign in with Google, we use the name, email and profile photo Google confirms to create your account; we don't store a Google account identifier.
• Listings: the listing details, descriptions and photos you upload or import, their edit history, and the close reason and deal source you give when closing a listing.
• Transactions: House purchases and usage, amounts, and Stripe payment references. We never receive your card number or online banking credentials.
• Technical data: IP address, browser and device type, and logs of requests and errors.

2. Data we receive when buyers use ChatGPT

When a buyer or tenant asks ChatGPT about property and ChatGPT uses our plugin, OpenAI sends us the request for that tool call. From it we record:

• the search criteria, such as sale or rent, area, nearby station, budget, property type, bedrooms and furnishing;
• an anonymous user identifier and an anonymous conversation identifier generated by ChatGPT. We store the user identifier only as a one-way hash;
• an approximate location (city, state and country) and the language or locale, when ChatGPT provides them;
• which listings appeared in results, which listing cards were displayed and which listings were opened in detail;
• clicks on contact buttons (WhatsApp, phone or email), which go through our own link so we can count them; and
• reports about a listing (for example, that it is no longer available), with the reason given.

We do not receive the buyer's name, email address, phone number or ChatGPT account details, the content of their conversation with ChatGPT, or their precise location. We also receive the IP address of each request, which we use only for rate limiting and abuse prevention and do not store with these records. The one exception: when a report about a listing comes without an anonymous identifier, we keep a one-way hash of the IP address with that report so the same person cannot report a listing twice.

When a buyer contacts an agent, the conversation happens directly on WhatsApp, by phone or by email, outside the Platform. We do not see it. What ChatGPT itself does with a conversation is governed by OpenAI's privacy policy.

3. Other data

• Listing and agent pages: when someone opens a link-only listing or agent page, we record the visit and any contact click (listing, channel, time and whether it came from ChatGPT), together with technical data.
• Invited agents: to invite agents to join, we use the name, registration number, mobile number, email address and agency they publish in their public property listings (for example on PropertyGuru) and in the LPPEH (BOVAEA) register. We send the invitation by email or from our own WhatsApp account. Every invitation says it is from METAKORE SDN. BHD., where we found the details and links to this policy, and includes an opt-out link. If you opt out we do not contact you again: we delete your name, mobile number, email address and agency straight away and keep only a one-way hash of your number and email so we know not to. Whether or not you opt out, your registration number is deleted along with any remaining details 180 days after we added you or last sent you an invitation (30 days after you sign up, because your account then holds that data). The hashes are deleted with the record 3 years after it was added.
• Complaints and support: what you tell us in a registration misuse report or an email, including your contact details.

4. How we use personal data

• To create and secure accounts, verify email addresses and mobile numbers, and verify agents' registrations.
• To show agents' listings and contact details to buyers in ChatGPT and on listing pages.
• To give agents performance statistics for their own listings and to record where deals came from.
• To keep listings clean: detecting duplicate or reused listings, handling buyer reports and making sure free Houses are given once per registration number.
• To process House purchases, keep accounting records and handle refunds.
• To send service messages such as verification codes, contact notifications, expiry reminders and changes to our terms.
• To prevent fraud and abuse, keep the Platform secure, fix errors and improve the service.
• To meet legal obligations and respond to lawful requests from authorities.

We process personal data because it is necessary to provide the service you asked for, with your consent (given when you sign up or use the plugin), to comply with the law, or for the legitimate purposes listed above. We do not use personal data for advertising and we do not sell it.

5. What agents can see

Agents see statistics about their own listings: counts of appearances, card displays, detail views and contact clicks, the number of distinct buyers, summaries of the search criteria that led to their listings, and buyer locations at city and country level. Agents never see a buyer's identity or conversation. Comparisons with other listings use anonymous aggregates and are hidden when fewer than 5 listings are available, so no single listing can be identified.

6. Who we share data with

Listing details and the contact details an agent has switched on are shown publicly: to ChatGPT users who search for matching property, and to anyone who has the link to a listing or agent page. Otherwise we share personal data only with the service providers below, each for the stated purpose, and under contracts that require them to protect it:

We may also disclose personal data where the law requires it, to protect our rights or users' safety, or to a buyer or successor of our business, who will be bound by this policy.

7. Transfers outside Malaysia

Some of these providers process data outside Malaysia, for example on servers in Singapore, the United States or the European Union. When we transfer personal data abroad we take the steps required by the PDPA, including contractual safeguards, so that it is protected to a comparable standard.

8. How long we keep data

9. Cookies

We use only the cookies and browser storage the Platform needs to work, such as keeping you signed in. We do not use advertising or analytics cookies. See our Cookie Policy.

10. Your rights

Under the PDPA you can ask to access the personal data we hold about you, correct it, withdraw your consent, limit how we process it, and, where applicable, receive a copy of it in a portable format. Email contact@shelterx.property from the address on your account. We reply within 21 days. Agents can correct most details themselves in Settings.

Buyers: because we hold only hashed anonymous identifiers from ChatGPT, we usually cannot link records to a particular person. You can stop ChatGPT from sending us requests by disconnecting the ShelterX plugin in ChatGPT.

If you are not satisfied with our response, you can complain to the Personal Data Protection Commissioner of Malaysia.

11. Deleting your account

Agents can delete their account in Dashboard → Settings → Delete account. Deletion is immediate and cannot be undone. You are signed out everywhere, all your listings are removed from ChatGPT and their links stop working, and your mobile and WhatsApp numbers are released for use on a new account. Remaining Houses are forfeited. Records we must keep, such as accounting records, are kept as described in section 8.

12. Security

We protect personal data with encryption in transit (TLS), hashed passwords, HTTP-only sign-in cookies, private file storage, access controls, rate limiting and bot protection. No system is completely secure. If a personal data breach is likely to cause significant harm, we will notify the Personal Data Protection Commissioner and the people affected as the law requires.

13. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect their personal data.

14. Changes to this policy

We may update this policy. We will tell agents about material changes by email or in the dashboard, and the date at the top always shows the latest version.

15. Contact

For privacy questions or requests, contact our data protection officer at contact@shelterx.property, or write to METAKORE SDN. BHD., Lot 4-401 & 4-402, Level 4, The Starling, 6, Jalan SS 21/37, Damansara Utama, 47400 Petaling Jaya, Selangor, Malaysia.