1. Who handles your information
Nexaprop is operated by Simplify Interiors Sdn Bhd, company registration number Pending confirmation, business address Pending confirmation, business telephone Pending confirmation. The proposed name change to Simplify AI Sdn Bhd has not been treated as completed.
Contact support@nexaprop.com for privacy requests and concerns. Edmund is responsible for handling these requests during launch; this does not represent him as a registered Data Protection Officer. Support hours are daily, 10am–6pm Malaysia time. Effective date: Not yet effective for paid launch.
We handle account, security, support and billing information for our own service operations. Agents decide what information they lawfully upload about owners, clients and properties, and how to share it. When processing that information on an agent's instructions, our responsibilities and the agent's responsibilities must be reflected in our agreed service and data-processing terms. The label “software provider” does not remove our responsibilities for information we use for our own purposes.
2. Information, sources and purposes
| Information | Where it comes from | Why it is handled |
|---|---|---|
| Name, phone, email, professional registration and company/address details | You, or an authorised person arranging your account | Account creation, verification, support and accurate professional/account records |
| Password hash, verification and recovery records, sessions, access and security events | Your interactions and the service | Authentication, recovery, access control and abuse prevention; we do not need your readable password |
| Listings, property photographs, owner contacts, requirements, notes and collections | You and users you authorise; authorised sharing by other agents | Store and organise your work, find relevant authorised inventory and deliver the sharing functions you select |
| Profile details, selected contact information, shared listings and collections | Your publication choices | Display the profile or shared content to its intended audience |
| Invoice details, payment evidence, bank references, paid dates, refund records and accepted terms version | You, the payer and our payment reconciliation records | Verify payments, provide access, issue records, investigate errors and reconcile refunds |
| Support correspondence and request records | You or an authorised requester | Resolve problems and handle rights, complaints and account changes |
| Technical request and device/browser information, essential session cookies and hosting/security logs | Use of the website and infrastructure | Deliver pages, maintain sessions and diagnose security or reliability problems |
Other agents' information becomes available only through authorised collaboration. Information being publicly visible elsewhere does not automatically authorise its reuse in Nexaprop.
3. Required and optional information
Fields marked required on account and payment forms are needed to open, verify and administer the account or reconcile the relevant purchase. Missing or inaccurate details can prevent verification, access or payment processing. If an optional field is omitted, only the related feature may be unavailable.
Adding a portrait, publishing a public profile, sharing a collection or opting a listing into Co-A is a separate choice. Do not put client identity into requirement notes or private owner details into descriptions or photographs intended for sharing. Supply only information you have authority to use. Avoid identity-card copies, sensitive personal information and unrelated bank transactions unless a specific, justified request is made. Never send banking passwords, OTPs or account passwords to support. Mask unrelated balances and transactions in payment evidence.
4. Who can receive information
Authorised Nexaprop personnel access information when necessary to support, secure and operate the service. Infrastructure, storage, account email and support providers may process relevant information on our behalf. Our bank, accountant and professional advisers may receive the information needed for payment reconciliation, accounts or advice. We may disclose information where legally required, with the scope checked against the request.
The technical implementation uses Cloudflare services for application infrastructure/storage and Resend for account/service email, and runs within a Sites/OpenAI hosting and administrative environment. The detailed provider register, including contracting entities, data access, locations and protections, is being verified before the paid launch. These references describe the reviewed technical integration, not a completed supplier compliance assessment.
Your sharing choices can disclose selected information to participating agents, intended clients or the public. Someone with a public collection link may forward it. Publicly displayed agent contact details may be copied. Private fields are separately controlled, but writing private information into a public description or image can expose it. Revoking a link or withdrawing a listing prevents subsequent supported access; it cannot retrieve copies already made by recipients.
5. Processing outside Malaysia
Our infrastructure and service providers may handle data outside Malaysia. We do not promise Malaysian-only storage. Destination locations and the applicable transfer arrangements are being verified before the paid launch. We must assess and document the applicable protection and transfer arrangements before relying on them. This notice is not blanket consent to any future destination or unrelated use. Where consent is the condition relied on, we will explain the transfer and obtain and record the required consent.
6. Cookies, marketing and AI assistance
Essential session cookies support sign-in and security. Blocking them can prevent account functions. The deployed cookie and analytics inventory is under review before the paid launch. Any nonessential tracking must be disclosed with the relevant choices before it is enabled. This draft does not authorise advertising trackers or optional marketing. Service, security and payment notices are distinguished from marketing; you can ask support to stop direct marketing.
AI may assist Edmund with support triage and drafting. Any use of customer information in an AI provider must first be covered by the verified provider assessment, appropriate permissions and this notice. We aim to minimise and redact personal information used for support assistance. Ask for human review of a response or decision. This is not a claim that Pro Max or other roadmap AI features are already supplied, nor a promise about an external provider's training or retention settings that has not been verified.
7. Security and retention
Access restrictions, password hashing and separated public/private sharing controls are used in the reviewed implementation. No system can guarantee absolute security. Report suspected exposure promptly to support. We investigate incidents and make notifications required by applicable law.
We keep information for the purpose for which it is needed and applicable legal, accounting, security and dispute requirements. After subscription access lapses, workspace records are preserved for at least 90 days under the launch offer; there is no automatic deletion on day 91. This recovery commitment does not override a valid rights request or legal duty. Contact support about access, export or closure; this is an assisted process, not a promise of an existing self-service export feature.
The detailed retention schedule and backup handling are under review before the paid launch. Financial evidence and security logs may have different retention needs from listing content. Where information must be retained after closure, we explain the reason and restrict its use. A payment cancellation is not itself a request to erase account data.
8. Your choices and requests
Contact support to request access or correction, withdraw consent where processing relies on it, object to direct marketing, raise concerns about processing that may cause damage or distress, or request closure and deletion where applicable. You may request transmission of your personal data to another controller where applicable, subject to technical feasibility and format compatibility. These rights have legal conditions and exceptions; a request does not automatically require deletion of financial records or another person's information.
We verify identity proportionately and explain the scope, next steps and any applicable lawful limitation. We do not routinely need a full identity-card copy. Withdrawing consent needed for a particular function may prevent that function from continuing; we explain the consequence. Requests about another agent's use of your information may require that agent's involvement, while we still address our own handling. You may complain to Malaysia's Personal Data Protection Commissioner through the official JPDP channels.
9. Changes
We identify the current version and effective date and communicate material changes before new uses apply. A company rename does not by itself authorise a new purpose for your data. We will update the notice when the registered operator details or actual service practices change.