Privacy Notice (PDPA)

Version 0.3 (2026-07-31).

This notice explains how Kiyo Tech Engineering (Business Registration No. 002351051-P) ("we", "us", the Operator) processes personal data through the invitation-only Property Passport internal agency tool (the "Service"). The Service currently has no public advertising surface.

1. Data we collect

• Account data: name, email, role, password authentication data, and contact

number. Contact numbers are normalised to digits only with the country code.

• Identity-match data: IC or company number stored as a one-way hash. We use it

for exact-match checks only and never display the original number.

• Invitation and membership data: invited email, sender, decision, membership,

role, revocation, and related timestamps.

• Property and tenancy data: addresses, ownership and tenancy details, rent

reminder settings, media, floor plans, and uploaded title or tax documents.

• Notification data: membership changes, invitation decisions, account closures,

rent payment reminders, tenancy renewal reminders, delivery state, and opt-outs.

• Audit and closure data: security and activity logs, closure status, dates, and

the name/email snapshot retained to explain a closure event.

• Technical data: logs, browser and device information, and diagnostics needed

to operate and secure the Service.

We receive data from users, invited participants, and activity within the Service. If you provide another person's data, you must have authority and a lawful purpose.

2. Why we process data

We process data to register and authenticate accounts; address and decide invitations; manage property memberships; provide private property and tenancy workspaces; apply role-based access; send operational notifications and reminders; support account closure; preserve traceability; prevent fraud and misuse; investigate incidents; and comply with legal obligations.

Daily automated jobs process rent-payment and tenancy-renewal reminders. Each tenancy has opt-out controls for these reminder types.

3. Access and disclosure

We disclose data only as needed to operate the Service, including to our hosting, authentication, email, and infrastructure providers acting on our instructions, admins who operate the Service, joined property members within their permitted scope, professional advisers, and public authorities where lawfully required.

Personal data may be transferred to a successor operator as part of a transfer or reorganisation of the business, subject to Malaysian law (PDPA) safeguards and notice.

Admins have oversight access to all information in the Service — including every completed property record, member and portfolio details, uploaded documents on completed properties, and the account-closure register — for operating, supporting, and securing the Service. Documents on draft or deleted property records are not part of admin review.

Uploaded title and tax documents are readable only by the property owner and admins. Shared media and floor plans are readable by all joined members. Memberships bind to the accepting account and do not transfer to another account.

We do not sell personal data and do not publish property records to a public advertising surface.

4. Invitations

Invitations are addressed to an email address. Invitation records may survive account closure for security, history, and valid later re-registration flows. Re-registering an email does not transfer a former account's memberships or private records.

5. Security

We use reasonable technical and organisational controls, including authentication, role and membership checks, database row-level security, private document storage, time-limited access links, and encryption in transit. No system can be guaranteed completely secure.

Hashing an IC or company number reduces exposure but does not make the result anonymous. We continue to protect the hash as personal data.

6. Retention and account closure

Self-service account closure frees the email immediately for re-registration, clears contact details, and retains the profile name temporarily for traceability. Admins can see a closure register until the closed profile is automatically purged one year after closure.

Property records, memberships, invitation history, and audit logs may remain where other participants rely on them or they are needed for security, disputes, or legal obligations. Removing a member's copy or dashboard entry is not deletion of other copies or shared history. Closure audit entries survive the profile purge and retain the closure name/email snapshot.

7. Your choices and rights

Subject to the PDPA and applicable exceptions, you may request access to or correction of your personal data and may ask to limit processing. You may close an eligible account through the Service. You may opt out of rent-payment and tenancy-renewal reminders separately for each tenancy. Some processing is necessary to provide the Service or preserve required records.

Contact contact@aiproperty.com.my for a privacy request or complaint.

8. Cross-border processing

Data is hosted with our infrastructure providers in Japan (Tokyo, AWS ap-northeast-1), with global content delivery. We apply the requirements of Malaysian law to any cross-border transfer.

9. Planned processing — not active

We are considering the following future features:

• AI-assisted review of uploaded title documents, only with owner consent, to support

verification badges;

• rent-receipt tracking through a banking gateway;
• Telegram contact verification; and
• multiple tenancies for one property.

These features are not active. Before activating them, we will assess providers, security, retention, lawful purpose, access, consent, and any required notice changes. Uploaded title documents are not currently sent to an AI provider for this planned review, and the Service does not currently connect to a banking gateway or Telegram.

10. Changes and contact

We may update this notice as the Service changes. Material changes will be notified and may require a new acceptance. Privacy contact: contact@aiproperty.com.my.