Privacy Policy

Last updated: 22 July 2026

1. Introduction

RUMADWELL SOLUTIONS (SSM: 202603085092) ("RumaDwell", "we", "our", or "us") operates the RumaDwell mobile application and website (together, the "Platform"), a booking marketplace that connects property hosts with guests in Malaysia. This Privacy Policy explains what personal data we collect, why we collect it, and the rights you have over it. It is written to be consistent with Malaysia's Personal Data Protection Act 2010 ("PDPA").

2. Information We Collect

We collect the following categories of personal data:

  • Account & Contact Information: Name, email address, phone number, and profile photo.
  • Host Verification Data: Identity card (IC) details, a selfie captured for liveness / identity matching, and other information submitted during the host verification process.
  • Property Information: Property name, location and coordinates, images, amenities, pricing, and availability, as submitted by hosts.
  • Booking & Payment Information: Booking dates, guest counts, transaction and settlement history, and banking details (for host payouts and guest refunds). Card and FPX payment details are collected and processed directly by our payment gateway, Fiuu — RumaDwell does not store full card numbers.
  • Guest Check-in Data: Phone number (for OTP verification), and, where a host or property requires it, optional ID and selfie captured during check-in.
  • Location Data: Property coordinates and, if you grant permission, your device location, used to show nearby properties and directions.
  • Usage & Device Data: App and website interactions, log data, device identifiers, and approximate location derived from IP address.
  • Communications: Messages sent through the Platform's contact-host feature, WhatsApp (where enabled by a host), and support correspondence.

3. How We Use Your Information

We use personal data to:

  • Create and manage accounts, and verify host identity
  • Facilitate bookings, process payments, and settle host payouts and guest refunds
  • Enable check-in, calendar sync, and host–guest communication
  • Send booking confirmations, verification updates, and service notifications
  • Investigate disputes, detect fraud, and enforce our Terms & Conditions
  • Comply with legal and regulatory obligations
  • Improve the Platform's features, reliability, and security

4. Who We Share Information With

We do not sell personal data. We share data only as needed to operate the Platform, with:

  • Hosts and guests involved in a booking — e.g. a guest's name, contact number, and check-in details are shared with the host of the property they book, and vice versa.
  • Supabase — our database, authentication, and file storage infrastructure provider.
  • Fiuu — our licensed payment gateway, for processing FPX and card payments.
  • Google Maps — for property location display, geocoding, and directions.
  • WhatsApp — where a host has enabled WhatsApp contact, to relay booking-related messages.
  • Regulators or law enforcement — where required by law or to protect the rights, safety, or property of RumaDwell, our users, or the public.

These providers may process data outside Malaysia (for example, on cloud infrastructure located overseas). Where this occurs, we take reasonable steps to ensure the recipient provides a standard of protection comparable to the PDPA.

5. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Platform. Booking, payment, and settlement records are retained for at least 7 years to meet tax, accounting, and dispute-resolution obligations. Host verification documents (IC, selfie) are retained for as long as the host account remains active and for a reasonable period after closure to meet fraud-prevention and legal obligations. You may request earlier deletion under Section 8, subject to these legal retention requirements.

6. Data Security

We apply industry-standard safeguards — encryption in transit, access controls, and secure cloud infrastructure — to protect personal data. Payment details are handled by our PCI-compliant payment gateway and are never stored on our own servers. No method of transmission or storage is completely secure; you should use a strong password and keep your login credentials confidential.

7. Your Rights

Under the PDPA, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate or outdated data
  • Withdraw consent to processing, or request deletion of your data, subject to our legal retention obligations
  • Opt out of marketing communications at any time
  • Lodge a complaint about how we handle your data

To exercise any of these rights, email support@rumadwell.com. We will respond within 21 days as required by the PDPA.

8. Children's Privacy

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Cookies & Tracking Technologies

Our website uses cookies and similar technologies (such as local storage) to keep you signed in, remember preferences, and understand how the Platform is used, including via analytics tools. You can disable cookies in your browser settings, though this may affect functionality such as staying logged in.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related inquiries or to exercise your data protection rights, contact us at:
Email: support@rumadwell.com
Entity: RUMADWELL SOLUTIONS
SSM Reg: 202603085092