Privacy Policy

A1. What We Collect From Guests

When a Guest makes a booking, Jominap collects their name, phone number, email, state of origin, stay dates, and purpose of visit. Where a property has switched it on, Jominap may also ask for an arrival time, vehicle plate number, and expected visitor count — these fields are always optional at the platform level and only appear when a specific Owner has requested them.

A2. Sharing With the Homestay Owner

The Owner of the property a Guest books receives that Guest's booking details, because the Owner needs them to prepare for and fulfil the stay. This is the core of how Jominap works — a booking cannot happen without the Owner seeing who is booking.

A3. Sharing With Payment Gateways

If a booking is paid through an Owner's connected payment gateway (bayar.cash, or historically Toyyibpay), the name, email, and phone number given at booking are shared with that gateway to process the payment. On a Basic-plan property, payment is a direct bank transfer and no payment gateway is involved at all.

A4. WhatsApp Notifications

WhatsApp notification links (to an Owner, or from an Owner to a Guest) are generated in your own browser and are only sent if you choose to tap them. Opening one shares its contents with WhatsApp; Jominap does not send anything via WhatsApp on your behalf without that tap.

A5. Retention & Anonymization

Guest booking details are kept for up to 24 months after the stay's checkout date, to support the Owner's own record-keeping and any dispute resolution, after which they are automatically anonymised — the name is replaced and the phone, email, and state are cleared.

A6. Your Rights & How to Request

Under the PDPA, a Guest may request access to, correction of, or deletion of their personal data, or opt out of marketing communications, at any time. Submit a request at jominap.my/privacy-request using just an email address or a booking reference — no account is needed.

B1. What We Collect From Owners

When someone signs up as an Owner, Jominap collects their name, phone, email, business address, and — once they go live — their bank account details and, for an Advance-plan Owner who connects one, their own payment gateway credentials. Gateway credentials are written only through a secured, challenge-gated profile flow and are never shown back to the Owner or anyone else after they're saved.

B2. How We Use Owner Data

Owner data is used to operate their subscription and billing, to run the one-time Semak Mule anti-fraud check before a listing can accept bookings, and to operate the platform generally — including sending booking notifications and account emails.

B3. AI Listing Assistance

An Owner may optionally use Jominap's AI-assisted tools to draft a listing description or extract details from an existing post or link. Only when an Owner chooses to use these tools is the text they provide sent to Jominap's AI provider (Anthropic) to generate a result — this never happens automatically.

B4. Visitor Analytics

Jominap logs basic visit information for every page load on the public site — the page visited, an approximate country/state, device type, and whether the visitor appears to be a bot — to understand traffic and property performance. This does not use cookies and does not store your IP address or user agent directly: both are combined and one-way hashed before being stored, so the record cannot be reversed back into your original IP address.

B5. Data Storage & International Transfer

Owner and Guest data is stored with Supabase, Jominap's database and authentication provider, with access controls that restrict each user to their own data. Some services Jominap uses to run the platform — including its database host, its AI listing-assistance provider, and its email delivery — may process data on servers located outside Malaysia. Jominap only uses these providers to the extent needed to operate the platform.

Cookies

Jominap uses a small number of strictly necessary cookies: to keep you signed in, to remember your language preference, and to remember which role (guest or owner) you're using on a shared account. Jominap does not use cookies for advertising or analytics tracking — the visitor analytics described in Part B, clause B4 works without cookies.

Changes to This Policy

Jominap may update this Privacy Policy from time to time; a material change will update the version date shown at the top of this page.

Contact / Request Channel

For any question about this policy, or to exercise your rights under the PDPA, use the request form at jominap.my/privacy-request, or write to privacy@jominap.my.