Legal

Privacy policy

Last updated 11 May 2026

This Privacy Policy explains how CoAgent (“we”, “us”) collects, uses, stores, and shares personal data when you use our platform at coagent.my and any related services. We comply with the Malaysian Personal Data Protection Act 2010 (“PDPA”).

CoAgent is a workflow platform for property agents registered under the Lembaga Penilai, Pentaksir, Ejen Harta Tanah dan Pengurus Harta (LPPEH). It is not open to the general public.

1. Personal data we collect

From agents who sign up: your full name, mobile phone number, email address, REN registration number, firm name, and the areas you specialise in. We verify your REN against the public LPPEH directory at signup.

From your use of the platform: the filters you save, the buildings you shortlist, the reports you generate, and your engagement with notifications.

From clients you send reports to:when you use the “Send to client” flow, you provide your client’s mobile phone (required) and optionally their email address. We store this contact alongside the report you sent. When the client opens the report, we record anonymous engagement events (units viewed, units marked interested) tied to a browser session token, not personally to the client.

Automatically: standard server logs (IP address, browser type, pages visited), and product-analytics events for usage measurement and product improvement.

2. How we use personal data

  • Verify that you are an LPPEH-registered agent.
  • Authenticate your account and keep it secure.
  • Match active property listings to your saved filters and notify you of new matches by email, WhatsApp, or Telegram.
  • Generate shareable reports you send to your clients, and show you which buildings and units they engaged with.
  • Operate, maintain, troubleshoot, and improve the platform.
  • Communicate service-related announcements (e.g. security notices, feature changes).
  • Detect and prevent abuse, fraud, or violations of our Terms of Use.

We do not sell your personal data to third parties.

3. How we share personal data

We share personal data only with the service providers that make CoAgent run, under data-processing terms that protect your information:

  • Hosting & database: Vercel and Supabase, for application hosting, authentication, and encrypted data storage.
  • Email delivery: Resend, for transactional and notification email.
  • Messaging: Telegram (optional, for real-time alerts you opt into) and WhatsApp deeplinks (opened in your own WhatsApp client).
  • Product analytics: PostHog, for product usage measurement.
  • Regulatory verification: the LPPEH public registry, queried one-way at signup to verify your REN.

We may also disclose personal data if required by Malaysian law, a court order, or to protect the rights, property, or safety of CoAgent, our users, or the public.

4. Data retention

We keep your agent account data for as long as your account is active. If you delete your account, we remove your personal profile data within a reasonable period, except where we are required to retain it for legal, accounting, or anti-fraud purposes.

Client contact details captured through the “Send to client” flow are retained as part of your professional outreach record. You can request deletion of a specific contact at any time by emailing us.

Engagement events linked to a report are retained for the lifetime of the report unless you revoke it.

5. Your rights under PDPA

Subject to the PDPA, you have the right to:

  • Access the personal data we hold about you.
  • Correct information that is inaccurate or incomplete.
  • Withdraw consent for processing (note: withdrawing core processing may end your ability to use CoAgent).
  • Request deletion of personal data where there is no overriding legitimate basis to retain it.
  • Object to processing for direct marketing.
  • Lodge a complaint with the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi) if you believe we have not handled your data properly.

To exercise any of these rights, email hello@coagent.my. We will respond within 21 days.

6. Security

CoAgent runs on encrypted infrastructure. Data in transit uses HTTPS/TLS; data at rest in our database is encrypted. We enforce row-level security so an agent can only see their own client contacts. No system is perfectly secure — if you spot a vulnerability or suspect unauthorised access to your account, email us immediately.

7. Cookies and tracking

We use a small number of cookies that are necessary for the platform to function (authentication sessions, CSRF protection, your preferred area set on the dashboard).

We also use a product-analytics service that may set a cookie or session token to measure how the platform is used. We do not use third-party advertising cookies.

8. Cross-border data transfers

Some of our service providers store and process data outside Malaysia. We only engage providers with data-protection commitments at least equivalent to the PDPA. By using CoAgent you consent to this cross-border processing.

9. Children

CoAgent is not directed to anyone under 18 and is restricted to LPPEH-registered property agents. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, for material changes, notify you by email or in-product banner.

11. Contact

For any privacy-related question or request, email hello@coagent.my.

See also our Terms of use.