Privacy Policy

Last updated 31 August 2026

Cobro ("we", "us") runs the agents' co-broke platform at cobro.com.my and app.cobro.com.my. This notice explains, in plain words, what personal data we handle and why, as required by the Personal Data Protection Act 2010 (PDPA).

1. What we collect

• Your account: name, agency, email, WhatsApp number, REN number, login credentials (passwords are hashed and never visible to us).
• Your listings: the rows you import from your Google Sheet, including any owner names, contact numbers and unit numbers you choose to include.
• Your leads: client names, contact numbers and property requirements you save in the Leads board.
• Activity: co-broke requests, ratings, reports, pool shares, referral code use, and basic technical logs (time of visit, errors).
• Payments: handled by Stripe. We never see or store card numbers.

2. How we use it

• To run the service: import your listings, match client requirements, show pooled listings to other agents, deliver co-broke requests.
• To send you alerts on WhatsApp (lead matches, pool watches, co-broke requests). Reply STOP to any alert to pause them.
• To verify REN numbers against the public LPPEH register and show trust signals (response time, verified deals, ratings).
• To bill your subscription and send account emails (password reset, receipts).
• To keep the pool honest: handling listing reports, suspending accounts that break the rules.

3. What other agents see - and never see

Pooled listings show the property name, area, specs, price and occupancy, plus your agent name, agency and verified REN. They never show owner names, owner contacts, unit numbers or your private remarks. Your leads are never shared.

4. The Data Vault

When you enable the Data Vault, owner names, contacts, unit numbers and your clients' lead details are encrypted on your own device with a key only you hold. Cobro stores ciphertext and cannot read it. If you lose both your vault password and recovery code, that data cannot be recovered by anyone, including us.

5. Who we share data with

• Supabase (database and login, hosted in Singapore) and Vercel (application hosting, Singapore region).
• Meta / WhatsApp Business Platform to deliver alerts to the WhatsApp number you registered.
• Stripe for subscription payments.
• Google only to read the Google Sheet you link, using the view-only link you provide.
• No data is sold. No data is shared with advertisers.

6. How long we keep it

For as long as your account is active. Listings are replaced on every sheet sync. If your account is deleted, your login, listings, leads, pool shares, requests and ratings are permanently removed. Payment records are kept by Stripe as required by law.

7. Your rights

You can view and edit your profile in Settings, export all your data (Settings → Export) and stop alerts at any time. To access, correct or delete your personal data, or to close your account, email admin@cobro.com.my. We respond within 21 days as the PDPA requires.

8. Cookies

We use only the cookies needed to keep you logged in. No advertising or tracking cookies.

9. Changes

If this notice changes materially we will tell you in the app or by email. The date at the top always shows the current version.

Questions: admin@cobro.com.my