1. Who we are
Replyjer is operated by Manta Tech PLT (Registration No. 202604001280 / LLP0046513-LGN), a Malaysian limited liability partnership ("Replyjer", "we", "us", "our"). Our website is replyjer.com.
For any question about this Policy, or to exercise your rights, contact us at hello@replyjer.com.
2. What this Policy covers
This Policy explains how we collect, use, store, share, and protect personal data across Replyjer's public-facing surfaces, namely:
- this website (replyjer.com), including its "chat with us" WhatsApp button, which connects you directly to our own company WhatsApp line (a person at Replyjer) — not the AI assistant;
- our AI WhatsApp property-enquiry assistant (the "assistant"), which property buyers reach only after submitting a Facebook or Instagram lead form run by a property developer; and
- the account and contact details of the property developers (and their authorised staff) who subscribe to Replyjer.
Replyjer is a software tool used by property developers and the licensed sales agents working under them. When you enquire about a property through our WhatsApp assistant, the developer you enquired about is the party that decides how your enquiry is used to follow up with you; Replyjer operates the platform on their behalf. Some additional personal data may be collected later in the sales process (for example, when you complete a booking with a developer). That processing is governed by a separate agreement between Replyjer and the developer and is not covered by this public Policy.
3. What data we collect
From website visitors
- Access logs: IP address, browser/user-agent, pages visited, referrer and timestamp, recorded by our hosting provider (Vercel) for hosting operations, abuse detection and performance monitoring.
- Web fonts: our pages load typefaces from Google Fonts. When a page loads, your browser requests these font files from Google (fonts.googleapis.com / fonts.gstatic.com), which exposes your IP address to Google LLC (United States). We use this only to display the site's fonts — see section 6 and the cross-border note in section 8.
The website itself sets no advertising or analytics cookies and uses no tracking pixels, and we do not run analytics or tracking on it. Your language choice (EN / MS / ZH) is stored only in your own browser and is never sent to us. The only third party that receives any data from a visit to the public website is Google, for the web-font request described above.
From people who message our company WhatsApp line
The "chat with us" button on our website opens a WhatsApp conversation with our own company line, which is operated by a person at Replyjer — it is not the AI assistant. If you message us there, we receive your WhatsApp number and the content of your messages, and we use them only to respond to your enquiry (for example, if you are a developer interested in Replyjer). We do not put these messages through the AI assistant, and we do not share them with any property developer as a lead.
From buyers who reach our WhatsApp assistant
When you enquire about a property through our WhatsApp assistant — which you reach via a property developer's Facebook or Instagram lead ad — we may collect:
- Contact and identity: your WhatsApp phone number; the name you tell the assistant; and the language we detect you are using (English, Malay or Chinese).
- Message content: the full content of the messages you send and receive in the conversation, together with delivery metadata (direction, timestamp and a message reference ID).
- Affordability and property-demand information you choose to share: your purchase purpose (own-stay, investment, or both); whether you are a first-home buyer; your stated budget range; your monthly income; your monthly liabilities or commitments; whether you are applying jointly and, if so, a co-applicant's income; the number of existing home loans you have; your EPF Account 2 balance; the unit type or size you are interested in. You only share this if you choose to answer the assistant's questions; it helps us indicate whether a property may be within budget and helps the developer understand buyer demand.
- Viewing-appointment details: any time slot you book to view a property, the booking status, and notes the sales agent records about the appointment.
- Reliability flag: if you book a viewing and do not attend, we may record a no-show count and the date of the last no-show against your phone number, so that the next agent at handoff is aware of it.
- Opt-out records: if you reply STOP, UNSUBSCRIBE, BERHENTI or 退订, we record your phone number, the time, and the keyword used, so that we stop sending you further messages.
- Operational logs: if a message fails to deliver, we keep a short technical record of your phone number, a failure reason code and a timestamp for monitoring and abuse detection. These records never contain the content of your messages.
If the developer activates post-sale milestone messaging (for example, construction updates after you have purchased), we may also store your phone number, a snapshot of your name, the unit code and the message text in order to deliver those notifications. This feature is not active by default.
From developer subscribers and their authorised staff
Our paying customers are property developer companies. Where a developer authorises sales agents or lawyers to use the platform under its account, we collect their details too. At a high level we collect:
- Account holders: full name, email address, phone number, role (developer, agent or lawyer), agency affiliation, the BOVAEP registered estate agent (REN) tag number for agents, and an authentication identifier.
- Developer company details: company name, registered address, developer licence number, advertising and sale permit (APDL) number, Housing Development Act (HDA) licence number, SST registration status, the developer's WhatsApp number and logo.
- Billing records: invoice periods, amounts (in MYR), due dates, status, line items, payment references and method, and the LHDN e-invoice identifiers we generate for our own tax compliance.
- Account activity log: a record of significant actions taken in the account (who did what, when, and to which record) for security, oversight and compliance.
- Error and crash telemetry: when something goes wrong in our software — whether in the developer/agent dashboard or in the server-side processing of a WhatsApp conversation — our error-monitoring provider (Sentry) may record a technical error report including an IP address, browser/device information, a stack trace (which may contain URL fragments) and session context. An automated filter strips out phone numbers, identity numbers, one-time passcodes and email addresses before any report is sent. Sentry does not run on our public marketing website.
Some additional, more sensitive information that a developer or its agents may handle through the platform later in a sale — such as identity-card details, identity-document scans, e-signatures, uploaded booking and legal documents, and bank-account details — is processed under our separate agreement with the developer and is described in a separate notice, not in this public Policy.
4. Why we collect it, and our lawful basis
- To answer your property enquiry and route it to the relevant developer and their sales agents (your consent, given when you submit the developer's lead form, and to take steps at your request).
- To indicate whether a property may be within budget and to score lead quality, based on the affordability information you choose to share (your consent). Any "within budget" indication is informational only — see section 9.
- To schedule and confirm viewing appointments and to manage no-shows at handoff.
- To send you follow-up messages about your enquiry. You can stop these at any time by replying STOP (see section 7).
- To operate, secure and improve the Service — including rate-limiting, abuse and fraud detection, and error monitoring (our legitimate operational interests, balanced against your rights).
- To manage developer accounts and billing, and to meet our own legal and tax obligations under Malaysian law (including LHDN e-invoicing).
5. How consent is collected (PDPA Notice & Choice)
Property buyers reach our AI WhatsApp assistant only by submitting a lead form on a Facebook or Instagram advertisement run for a property developer. The consent and notice for collecting and using your data is presented at that lead form, before the WhatsApp conversation begins. The lead-form notice names Replyjer and the developer, the purpose (handling your property enquiry, affordability indication and forwarding you as a lead), and the categories of data collected.
If you instead message us through the "chat with us" button on our website, you are contacting our company line directly; we process your message on the basis that you chose to contact us, in order to respond to you. You can stop messages at any time by replying STOP (see section 7), and you may contact us at any time to withdraw consent or request deletion of your data. This Privacy Policy is available at replyjer.com/privacy.html at any time.
6. Who we share your data with
The developer you enquired about
If you enquire about a property, your enquiry becomes a lead that we deliver to the relevant property developer and to the sales agents that developer has assigned. This means the developer and their assigned agents can see, through their dashboard: your phone number and name, your conversation transcript, the affordability and demand information you shared, your booking details, and any no-show flag. We keep an internal record of which staff member viewed which lead.
Buyers who come to us through our Facebook or Instagram ads
This sub-section explains, in plain terms, what happens to your data when you reach us through a Meta (Facebook or Instagram) lead advertisement:
- You submit a lead form on the ad (typically your name and a contact number, plus any answers to questions on the form). You give your consent on that form.
- We use those details to start a WhatsApp conversation with you about the advertised property, and the WhatsApp assistant may ask the affordability and property-demand questions described in section 3.
- The information you provide — including your lead-form details and what you tell the assistant — is shared with the property developer (or agency) that placed the ad, and with their assigned sales agents, so they can follow up with you. A sales agent or the developer may contact you directly.
- You can stop all follow-up messages at any time by replying STOP (see section 7).
Our service providers (data processors)
We use the following service providers, each bound to process data only as we instruct. Some are located outside Malaysia — see section 8 on cross-border transfers.
- Supabase (database, authentication and file storage) — Singapore. Stores conversation logs, lead and booking records, and account data.
- Vercel (hosting) — Singapore region. Hosts the website and all server functions; every request passes through Vercel's infrastructure.
- Anthropic (AI) — United States. Generates the assistant's replies; your WhatsApp messages and conversation history are sent to Anthropic as context for the reply.
- Twilio (messaging) — United States. Delivers our WhatsApp messages and any one-time verification codes. Your phone number and message content pass through Twilio, which in turn connects to Meta's WhatsApp infrastructure.
- Upstash (rate-limiting and message queue) — United States / EU. Briefly handles your phone number and message content in transit while processing inbound messages, and stores short-lived rate-limit keys derived from your phone number or IP address.
- Sentry (error monitoring) — United States. Receives technical error reports from our application servers — covering both the developer/agent dashboard and the server-side processing of WhatsApp conversations — which may include fragments of personal data; an automated filter removes phone numbers, identity numbers, one-time passcodes and emails before sending. Sentry does not run on our public marketing website.
- Google (web fonts) — United States. Our public website loads typefaces from Google Fonts; your browser's request for the font files exposes your IP address to Google. No cookies are set and no other data is sent for this.
- ipapi.co (IP geolocation) — international, no fixed data-residency. Used only in the document-signing flow to look up an approximate country/city from an IP address.
We also use two low-risk, client-side tools in the developer-facing dashboard that do not handle buyer personal data: goQR.me (Germany) to generate QR-code images of WhatsApp links, and an embedded Google Maps (United States) view to show property locations.
Authorities
We share developer billing data with the Inland Revenue Board of Malaysia (LHDN) for our own e-invoicing obligations. We do not share your buyer data with LHDN. We may disclose personal data where required by law or valid legal process.
7. Your rights under PDPA, and how to exercise them
Subject to the PDPA, you have the right to:
- Access the personal data we hold about you (s.30);
- Correct inaccurate, incomplete or outdated data (s.34);
- Withdraw your consent to our processing (s.38), and to limit processing for direct marketing (s.43);
- Request deletion of your data, subject to any legal retention requirement; and
- Lodge a complaint with the Personal Data Protection Commissioner of Malaysia.
To stop messages immediately: reply STOP (or UNSUBSCRIBE, BERHENTI, 退订) to any WhatsApp message from us. This takes effect right away and suppresses all further outbound messages. Please note that opting out stops future messages but does not, by itself, delete the data we have already collected — to request deletion, contact us as below. Replying START re-enables messaging.
To access, correct or delete your data, email us at hello@replyjer.com. These requests are handled manually; we aim to respond within 14 days. We may need to verify your identity before acting on a request.
8. Cross-border transfers (PDPA s.129)
Some of our service providers listed in section 6 are located outside Malaysia — in particular Anthropic, Twilio and Sentry (United States), Google (United States, for web fonts), Upstash (United States / EU), and ipapi.co (international). To provide the Service to you, and to display our website, your data is transferred to and processed in those jurisdictions. We rely on your consent and on the transfer being necessary for the performance of the service you requested, as permitted under section 129 of the PDPA. Our primary database and core hosting are located in Singapore; some edge functions may execute at globally distributed points of presence.
9. Affordability indications are not financial advice
IMPORTANT: Any indication that a property is "within budget" is informational only and is not financial, investment, mortgage or legal advice. Figures are estimates based on the information you provide. Loan eligibility is always subject to the bank's own assessment. Replyjer is not a licensed financial adviser. Please consult a licensed adviser and the relevant bank before making any financial decision.
10. Retention
We retain your data for as long as needed for the purposes described above:
- Conversation and lead data is retained for the duration of our relationship with the relevant developer, and is deleted when that developer's account is removed or earlier on request. We do not currently run automated time-based deletion of conversation or lead records; if you would like your data deleted sooner, please contact us.
- Operational failure logs are intended to be kept for around 30 days.
- Account-activity logs are kept on an append-only basis for security and compliance.
- Billing and tax records are retained as required by Malaysian tax law.
11. Data security
- Encryption in transit (TLS 1.2 or higher) provided by our hosting and infrastructure providers.
- Encryption at rest provided by our database and storage providers.
- Tenant isolation enforced through database row-level security and access controls, so a developer can only access data within its own account.
- Authenticated sessions for account holders; inbound webhooks verified with cryptographic signatures (Twilio, Upstash), and privileged internal tokens compared in constant time.
- Automated filtering of phone numbers, identity numbers and emails out of error reports.
Our highest-sensitivity fields rely on the encryption-at-rest and access controls (row-level security) provided by our database and storage providers rather than additional application-level or column-level encryption. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Children
Replyjer is not intended for persons under 18. We do not knowingly collect data from minors. If you believe we have collected data from a minor, contact us and we will delete it.
13. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified on this page and, where we have an active subscription relationship with you, via email or WhatsApp. The "Last updated" date above reflects the most recent revision.
14. Contact
For questions about this Policy or your data, contact us at hello@replyjer.com. You may also lodge a complaint with the Personal Data Protection Commissioner of Malaysia.