Privacy Policy

Contractors who register: business name, email, phone and WhatsApp number, business address and location (coordinates), coverage area, business description, logo and work photos, as well as the company registration number and document you submit when registering.

Clients who send an inquiry: name, phone number, email (if provided), message, and your location if you choose to share it.

Automatic: we store a hash of the IP address for form submissions — not the IP address itself. The hash cannot be reversed back to the original IP. It is used solely to limit spam.

When you tap “Use my location”, your browser will ask for your permission. That coordinate is used to calculate distance and filter contractors whose coverage area includes your location.

As a client browsing the site, your coordinates are not stored — they are used only for that search. They are only stored if you send an inquiry, in which case they are shared with the contractor you contacted so they know which area the job is in.

You can decline location permission and still search by area.

• Displaying contractor listings to clients who are searching.
• Sending client inquiries to relevant contractors.
• Verifying email and managing accounts and subscriptions.
• Limiting spam and fake registrations.
• Understanding which categories and areas are most searched.
• Measuring our ads on Facebook, Instagram and Google (only with your consent, see section 9).

We do not sell your personal information to anyone.

Contractor listing information is public — business name, phone, WhatsApp, area, category, description and photos. That’s the purpose of this directory. Don’t put information you don’t want the public to see.

Client information is not public. Inquiries are only sent to the contractor you choose.

Company registration documents are not public. They can only be viewed by our admin and by you, for verification purposes.

• Account & listing: as long as the account is active, and up to 12 months after closure — for reactivation and accounting records.
• Leads: 24 months, so contractors have a record of past discussions in case a dispute arises.
• Payment records: 7 years, as required by Malaysian tax law.
• IP hash: 90 days.

• Passwords are stored as a scrypt hash, never as plain text. We ourselves cannot see your password.
• Login sessions are stored as a hash — if the database leaks, tokens in the record cannot be used to impersonate you.
• All traffic goes through HTTPS.
• Company registration documents are stored outside the public directory and can only be accessed by our admin and their owner.

No system is completely secure. If a data breach affecting you occurs, we will notify you.

• Hostinger — hosts the site and database (servers located overseas).
• Billplz / Stripe — payment processing. Card and banking details are handled entirely by them; we never see or store them.
• Email — for account verification and lead notifications.
• Meta Platforms (Facebook / Instagram) and Google (Google Ads) — receive the ad measurement data described in section 9, only if you accept optional cookies. They process it under their own privacy policies and may store it outside Malaysia.

You have the right to:

• Request a copy of the personal information we hold about you.
• Correct inaccurate information.
• Request that your information be deleted.
• Withdraw consent and close your account.
• Restrict how we process your information.

Contractors can update most information themselves via the dashboard. For anything else, contact us and we will respond within 21 days.

Necessary (always): one session cookie to keep contractors logged in. It is httpOnly (JavaScript cannot read it) and expires after 30 days. We also store your cookie choice in your device’s storage (localStorage) so we don’t ask every time.

Optional (only with your consent): when we run ads on Facebook, Instagram and Google, we may install the Meta Pixel and the Google tag (Google Ads) on our public pages (not in the contractor dashboard or the admin panel). If you click “Accept”, they set cookies (Meta: _fbp, _fbc; Google: _gcl_au, _gcl_aw, and Google may set additional cookies on its own domains) and send Meta and Google the pages you view, browser and device information, your IP address, and whether you completed registration. We do not send form contents, passwords, documents, or your email/phone through them, and the Meta Pixel’s automatic tracking features are turned off. The only purpose is to measure and improve our ads.

If you click “Decline” (or your browser sends a Global Privacy Control signal), the Meta Pixel is not loaded at all. The Google tag is present on our pages but runs in a consent “denied” mode: it stores no cookies and ad click identifiers are stripped from its requests; Google may still receive basic technical signals that do not use cookies (for example the page address, browser type and IP address). You can change your mind at any time with “Cookie settings” at the bottom of the site. You can also manage ad preferences in your Facebook/Instagram account settings.

This site is for businesses and adults. We do not knowingly collect information from children under 18.

Privacy questions, or to exercise your rights above: admin@renomaxhub.com

See also Terms & Conditions.