Privacy Policy

1. Who we are and our role

VERASPACE SDN. BHD. (Registration No. 202601027605 (1689701-X)) operates VeraSpace. Our business address is 44, Jalan SS21/35, Damansara Utama, 47400 Petaling Jaya, Selangor, Malaysia. When we decide why and how personal data is used for VeraSpace accounts, websites, listings, tours, digital name cards, analytics and direct services, we act as the data controller.

When an agent, agency or other business customer connects WhatsApp Business or Telegram Business and instructs us to process customer communications on its behalf, that business customer is the controller and VeraSpace acts as its service provider or processor.

For customer data obtained through connected WhatsApp Business or Telegram Business, VeraSpace accesses, uses, processes and discloses the data only on behalf of, at the direction of and with the authorisation of that business customer, and only to provide the connected messaging and VeraSpace workspace services requested by that customer. We do not use that data for unrelated VeraSpace purposes or disclose it to unrelated customers.

This notice also covers VeraSpace-hosted agent websites and digital cards, the mobile workspaces for agents, technicians and internal staff, and customer communications through Facebook or Instagram where those connections are approved and enabled. The same business-customer instructions and separation apply to those connected channels. A business customer remains responsible for its own customer notices and lawful instructions; this notice does not replace them.

2. Personal data we collect

• Account and contact data, such as name, email, phone number, login details, language, preferences and verification status.
• Agent, developer-company and organisation data, such as agency, company registration, REN or licence details, authorised-representative role, team membership, project registration or advertising-permit details and verification material.
• Property and content data, such as listings, photos, panoramas, tours, floor plans, inventory, digital name-card content and information you submit.
• Communication and customer-service data, such as enquiries, appointments, messages, notes, opt-in and opt-out records, support requests and audit events.
• Connected WhatsApp Business and Telegram Business data, which may include business-account, bot, connection and phone-number identifiers, configuration, templates, message content and media, sender and recipient identifiers, timestamps, delivery status and webhook events.
• Payment data, such as order, amount, receipt, transaction reference, payment status and limited payment-method metadata. We do not receive full card numbers or online-banking credentials from the payment gateway.
• Device and usage data, such as IP address, browser, pages, clicks, tour activity, approximate network information, cookies and security identifiers.
• Inferences generated to assist the customer, such as property preferences, enquiry category, urgency, suggested next action and matching rationale.
• Operational data for technicians and staff, such as assigned jobs, appointment and access instructions, job status, submitted photos, work profiles, leave requests and approval records where those features are used. Staff employment records are handled for administration and applicable duties, not exposed as public property content.
• New agent verification uses REN information and supporting professional evidence, not a new identity-card upload. Legacy verification material may remain under restricted access pending the applicable retention or deletion review. Do not place identity documents or unrelated sensitive information in listings, customer notes or AI prompts.

3. Where data comes from

We receive data from you, authorised users of your organisation, people who contact a participating business, visitors who use VeraSpace pages, connected services such as Meta, WhatsApp and Telegram, payment and technology providers, and permitted public or partner sources. A business customer may provide customer data only where it is authorised to use that data with VeraSpace and has given the notices and obtained the permissions required for its communications.

4. Why we use personal data

We process personal data with consent where required, to provide a requested service or perform an agreement, on a business customer's lawful instructions, to comply with legal duties, and for other purposes permitted by applicable law. Required fields are needed for the relevant account, connection, order, booking or workflow; without them, we may be unable to provide that feature. Optional permissions, integrations and marketing can be declined or withdrawn.

• Create, verify, secure and administer accounts, organisations, teams and access permissions.
• Review developer-company and project submissions, administer publication status and display approved company or project identifiers on public project pages. Supporting verification material is not published unless expressly identified for public display.
• Operate listings, property search, tours, showrooms, digital name cards, enquiries, appointments, payments and customer support.
• Connect and manage a customer's WhatsApp Business or Telegram Business service, send and receive messages on that customer's behalf where enabled, manage approved templates where applicable, and provide message status, opt-in, opt-out and service records.
• When conversation learning is enabled and the account is enrolled, provide configured AI assistance such as summaries, classification, preference extraction, private customer memory, matching explanations, alerts and suggested next actions. Inferred requirement updates are marked provisional and may be approved, rejected, corrected or reversed by the agent; silence or the passage of time does not make them buyer-confirmed.
• Conversation learning and automatic replies are separate controls. Switching conversation learning off stops future analysis of new message content for requirement updates, while connected messages may remain stored and visible in the business customer's inbox. Conversation learning alone never sends a message. Where automatic replies are enabled, the recipient is told clearly that the reply comes from VeraSpace's AI assistant. VeraSpace does not use raw connected chats to train its own general-purpose model. Approved AI processors handle messages only for enabled conversation features.
• Measure service usage, diagnose faults, prevent abuse, maintain audit records, improve reliability and comply with legal duties.
• Send VeraSpace service or marketing communications using data collected directly by VeraSpace where permitted. Messaging through connected WhatsApp Business or Telegram Business is sent only on the business customer's instructions and subject to the required recipient permission and opt-out choices.
• Administer subscription entitlements, allowances, renewal and cancellation instructions, invoices and payment mandates; deliver assigned technician jobs and authorised internal work; and save or publish agent websites and content according to the user's separate publication choices.

5. Connected customer messaging and organisation separation

Connected WhatsApp and Telegram contacts, conversations, media, inferred preferences and customer profiles are logically separated by business customer. Access is limited to authorised users within that customer's account, team or organisation and to contracted processors acting on its behalf. Information from one customer chat is not exposed to another business customer.

VeraSpace does not sell connected-chat customer data, use it for its own marketing or cross-customer retargeting, combine it with third-party data to build advertising profiles, or use raw chats for VeraSpace's own cross-customer network matching. A private inferred requirement is not broadened to agency or network scope unless the agent separately reviews the purpose-bound requirement and deliberately expands its sharing scope.

6. Google data

If offered and selected, Google sign-in provides your Google name and email. Optional Calendar access supports availability checks and appointment management for authorised users. We do not receive your Google password.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements.

7. Who we share data with

We disclose data only as needed to provide, secure and support the relevant service: to the relevant agent, agency or authorised organisation; to Meta and WhatsApp or to Telegram for the connected messaging service selected; and to contracted hosting, storage, AI, email, analytics, security and payment providers acting for the applicable service. Razorpay Curlec and participating payment institutions process payment information under their own notices and legal duties.

For an agent-collaboration opportunity, the invited listing agent receives only a structured, identity-hidden requirement until the buyer explicitly authorises the buyer's agent to disclose the buyer's name and available contact details to that specific listing agent for that opportunity. VeraSpace records the recipient, purpose, notice version, confirmation method, time and an evidence reference for that disclosure. General permission to receive property updates does not authorise this identity disclosure.

Connected WhatsApp or Telegram customer data is disclosed only to or on behalf of the responsible business customer, at that customer's direction and for the service it requested. Contracted processors that handle it must be subject to appropriate confidentiality, security and purpose restrictions.

We may disclose data where required by law or valid process, or where reasonably necessary to protect users, VeraSpace or others. We do not sell or rent personal data.

8. International transfers, retention and security

The hosting, storage, connected-channel, AI, communications and payment providers used for a selected service may process data outside Malaysia. Such transfers are subject to applicable Malaysian cross-border requirements, including the relevant legal condition and appropriate safeguards. Contact us for information about the recipients and destinations relevant to your use. Enabling an integration is not permission for unrelated overseas processing.

Retention depends on the data and purpose: account and workspace content while needed for the service; transaction and accounting records for applicable record-keeping duties; limited security, consent and source-history records for audit, disputes and rights requests; and messaging, media and AI-derived records according to the authorised service and customer instructions. We must take reasonable steps to delete or permanently anonymise personal data when it is no longer required. A record being archived, hidden or an account being disabled does not itself establish that its data has been erased. A deletion request receives a separate review of active records, derived records, provider-held copies and relevant backups; we explain any necessary retention and completion status.

We use the safeguards described in our Security Policy, including role-based access, organisation separation, encryption in transit, logging and other reasonable controls. We take reasonable steps to keep material data accurate and current. No system is completely secure, so users should also protect their credentials and report suspected misuse promptly.

9. Your choices and rights

Subject to applicable law and verification, you may ask whether we process your data and request access, correction, restriction, withdrawal of permission or deletion. An agent can review, correct, reject or reverse AI-inferred requirement updates and can switch conversation learning or automatic replies off. You may disconnect an optional service and opt out of direct marketing or automated outreach. Withdrawing permission may limit features that require the data.

If identity-sharing permission for an agent-collaboration opportunity is withdrawn, or the customer relationship is archived or deleted, VeraSpace stops returning the buyer's identity in future collaboration responses. Information already disclosed to the specific listing agent cannot be recalled; the recipient remains responsible for handling it only for the authorised opportunity and in accordance with applicable duties.

If your data is managed for an agent, agency or other business customer, you may contact that business or contact VeraSpace and identify it so the request can be routed and verified. For deletion instructions, visit VeraSpace Data Deletion. Disconnecting Meta, WhatsApp, Telegram or Google stops future access but does not by itself delete data already lawfully stored.

You may also complain to the Personal Data Protection Commissioner of Malaysia. Lawfully anonymised information that can no longer identify you is not personal data and may be retained.

10. Contact and changes

Questions, complaints or rights requests may be sent to contact@veraspace.my or +60 19-944 9066. Please do not send identity documents, card details or confidential credentials by ordinary email or WhatsApp unless we provide a secure channel.

VeraSpace is not directed to children under 18 and we do not knowingly create accounts for them.

We may update this policy when services, providers or legal requirements change. We will publish the effective date and provide additional notice or obtain fresh permission where required. Publishing an updated policy does not automatically expand the permissions recorded for earlier data.

11. Mobile permissions and device storage

The mobile app uses your signed-in role to access the corresponding workspace. Where you choose to upload a job or property image, camera or photo-library access is requested for that action; only the image you select is uploaded. Declining permission prevents that capture or upload, not unrelated account access. Avoid including bystanders, identity documents or confidential property details. We do not need your whole address book to provide these workspaces.

Session credentials are kept in the device's secure storage. Optional biometric unlock asks the operating system to authenticate you; VeraSpace receives the result, not your fingerprint or face template. Device settings control these permissions. Signing out, disabling biometric unlock, uninstalling the app, cancelling a subscription and requesting account deletion are different actions.

12. Cookies, browser storage and public websites

We use session and security mechanisms to keep accounts working, and browser storage for preferences, visitor identifiers and local drafts. QR visits can set a visitor cookie lasting up to one year; associated visit records can include the page, time, referrer, browser/device information and a protected IP-derived identifier. Digital-card and search visitor identifiers or local preferences can remain in browser storage until cleared. These identifiers are treated as personal data where linkable, not automatically anonymous analytics.

You can clear cookies and local storage using browser settings, although this may sign you out or remove saved preferences and drafts. Browser cleanup does not delete server-side records. Brand Studio can retain drafts locally; take care on shared devices. External sites or tools you choose to open have their own notices and storage practices.

A published agent website, property page or digital card is publicly accessible, even when described as a private or branded agent website. Saving a draft does not itself publish it. Unpublishing stops the platform's public presentation but does not erase retained records or copies previously downloaded, shared or indexed by others.

13. AI assistance, customer memory and sharing choices

Enabled AI features may send the necessary prompt, selected property material or authorised conversation context to an external AI processor to return a summary, draft, requirement extraction or suggested match. Do not submit personal data to an AI feature unless the relevant notice and required permissions cover that processing. Optional third-party AI processing requires the applicable choice or permission before the data is sent; accepting this notice is not blanket permission for every AI provider or future purpose.

Private customer memory can include explicit requirements, source references, confirmation dates and provisional inferred interests. Inferences can be wrong; explicit customer statements take priority over inferred interest. Matching explains possible property relevance and does not decide a person's eligibility to buy or rent. Agents can review and correct the information. Matching readiness does not by itself authorise contact or identity sharing. Proactive messages and collaboration disclosures require the relevant approval and recipient permission; separately configured automatic replies remain subject to their channel rules and controls.

A generated Brand Studio prompt or draft is not automatically sent to an external creative tool or published. If you copy, export or submit it yourself, review the included personal data and that tool's terms first. Customer-specific processing does not grant permission to train VeraSpace's own general-purpose model on raw connected chats or reuse one customer's conversations for another.