Available in English and Bahasa Malaysia. If the two versions differ, the English version prevails.
1. Who we are
This Privacy Policy is issued by Clean Lemons Enterprise (registration no. 202503143170 (003734553-M)) ("we", "us"), a data user under the Personal Data Protection Act 2010 (PDPA). It applies to www.cleanlemons.com and system.cleanlemons.com.
Your Antlerzone account works across all our group's products. Antlerzone Sdn Bhd is the data user for that account. Each product's company (Antlerzone Sdn Bhd, Coliving Management Sdn Bhd or Clean Lemons Enterprise) is the data user for the records of the service it gives you.
Data Protection Officer: Lim Ye Yong, info@antlerzone.com.
2. Personal data we collect
| Category | Examples | Who it is about |
|---|---|---|
| Contact | Name, phone, email, address | Everyone |
| Identity | IC or passport number, IC / passport photos, nationality, date of birth, gender, Singpass or MyDigital ID link | Tenants, guests, owners, staff, building visitors |
| Biometric (sensitive) | A face photo and liveness check taken during identity verification (eKYC), used once to match you to your ID document; we do not keep the selfie | Anyone who chooses to verify their identity by face |
| Financial | Bank name and account, account holder, tax ID, payment records; card brand and last 4 digits only (full card numbers are handled by the payment provider) | Owners, staff, payees, subscribers |
| Employment | Salary, EPF, SOCSO, EIS, PCB, attendance, leave | Staff of our group and of operators using our payroll features |
| Location and vehicle | Clock-in location, vehicle plate, fuel gauge and receipt photos | Drivers and field staff; plates for visitors and tenants |
| Property and access | Unit and property address, door PINs, smart-meter usage, handover and room photos | Tenants, guests, owners |
| Agreements | Signed tenancy and owner agreements, signature, signing time and IP address | Tenants, owners, operators |
| Communications | WhatsApp, Messenger, Instagram, WeChat, Telegram, email and web-chat messages; voice call audio and transcripts | Anyone who contacts us or an operator through AntlerChat |
| Pet | Pet name, breed, health notes, vaccination records, photos | Pet owners |
| Technical | IP address, browser and device, login records; login cookies only, no advertising cookies | Everyone who uses our sites |
We tell you on the form which fields are required. If you do not give required data, we may not be able to provide that service (for example, a tenancy cannot be signed without identity verification).
3. Why we use it
- To provide each service: bookings, check-in, tenancies, cleaning and handyman jobs, building visitor access, pet stays and renovation projects.
- To verify identity, where the operator, the building management or the law requires it.
- To process payments, payouts, refunds, payroll and statutory contributions.
- To keep accounting and tax records.
- To answer messages and calls, including by an AI assistant that drafts or gives replies on the operator's behalf.
- To keep our systems secure, prevent fraud and fix problems.
- To meet legal duties and respond to lawful requests.
We do not sell personal data and do not use it for third-party advertising.
4. Sensitive personal data
Biometric data is sensitive personal data under the PDPA. We process it only with your explicit consent, which you give by tapping the "I agree" button on the verification screen, and only to match your face to your ID document. You may choose not to verify by face; some services that require verified identity will then not be available.
5. Who can see your details (connections)
One Antlerzone account works across our products (homestay, coliving, cleaning, handyman, security, pet and renovation services). Each company that uses these products is a separate operator. Your account details belong to you. Two kinds of details are treated differently:
- Contact details are shared: your name, phone number, email and whether your identity is verified may be shared with the companies on our platform that you deal with (for example when you message them on WhatsApp), so they can recognise and contact you. By using an Antlerzone account you agree to this.
- Everything else needs your approval: your IC / passport number and photos, bank, statutory (EPF) and address details are only seen by a company after you approve it.
- Before you approve: apart from your contact details, the company only sees what it typed in itself. It cannot see your IC / passport, bank or other details from your account, and it cannot change your account.
- How you approve: when a company adds you, we email you a request and you answer it on your profile page under "My connections". When you start something yourself (for example signing a tenancy, checking in to a stay, registering as a visitor to a building, or having your QR code scanned at a pet hotel), the screen tells you which company will see which details, and continuing means you approve that company. When you check in to a homestay, the same agreement also covers the security of that building, so guards can verify your IC and photos.
- After you approve: that company can see your verified name, IC / passport, phone and email, and where it pays you or employs you, your bank and statutory details. Details you verified with eKYC are locked so the company cannot edit them.
- Cancelling: you can cancel an approval at any time under "My connections". The company then stops seeing your account details. Records it already made with you (such as a signed agreement, invoices or payslips) stay with that company, as the law and accounting require.
- Guest stays: for homestay guests, the approval ends automatically 90 days after check-out.
6. Who we disclose personal data to
- The operator, owner or building management you deal with, as set out in section 5.
- Service providers who host or run parts of the service for us, under contract:
- Hosting, storage and identity verification: Alibaba Cloud (Kuala Lumpur region).
- Payments: Stripe, Xendit, Billplz, Payex.
- Accounting: Bukku, Xero, AutoCount, SQL Account.
- Messaging and calls: Meta (WhatsApp, Messenger, Instagram), WeChat, Telegram, Twilio, MyVoIP.
- AI processing of messages, calls and photos: OpenAI, Google (Gemini), DeepSeek, ElevenLabs, Deepgram.
- Email, calendar, maps and documents: Google, Microsoft.
- Bookings: HostPlatform and the travel platforms you booked through (such as Airbnb, Booking.com, Agoda, Expedia, Trip.com, Traveloka).
- Smart locks and meters: TTLock, CNYIOT.
- Government identity login: Singpass, MyDigital ID.
- Authorities, where the law requires.
- A buyer or successor of our business, under the same protections.
7. Transfers outside Malaysia
Our servers and databases are in Malaysia. Some providers in section 6 process data in other countries, including Singapore, the United States, the European Union and China. We use them only where the country has a law substantially similar to the PDPA, or the provider is bound to protect the data to a comparable standard, as section 129 of the PDPA allows.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account is open; cleared 30 days after an approved deletion request |
| Invoices, payments, payroll, signed agreements | 7 years after the transaction, for tax and accounting law |
| Identity document images | While your account is open, or until you replace them |
| Homestay guest connection to an operator | Ends 90 days after check-out |
| Messages and call recordings | As long as needed to provide the service and handle disputes, then deleted |
| Clock-in location and visitor scan logs | As long as needed for attendance, claims and building security, then deleted |
9. Your rights
Under the PDPA you may:
- ask for a copy of your personal data, and ask us to correct it;
- withdraw consent, including cancelling a connection under "My connections";
- ask us to send your data to you or to another data user in a common format (data portability);
- ask us to stop processing that causes damage or distress, or to stop direct marketing;
- ask us to delete your account.
Write to info@antlerzone.com. We will reply within 21 days. A copy of your data is free, unless the law allows a fee for repeat requests. You may also complain to the Personal Data Protection Commissioner.
10. Security and breaches
We protect personal data with access controls, encryption in transit and separation of each operator's data. If a breach is likely to cause you significant harm, we will notify the Commissioner within 72 hours and you within 7 days after that.
11. Children
Our services are for adults. We collect a child's data only when a parent or guardian gives it, for example as a guest in a booking.
12. Changes to this policy
We will post any change here with a new "Last updated" date and notify you in the service or by email at least 14 days before it takes effect. If you keep using the service after that date, you accept the change. If a change adds a new purpose, a new class of recipient, or affects sensitive data, we will ask for your consent again where the law requires.
13. Language
This policy is available in English and Bahasa Malaysia. If they differ, the English version prevails.
14. Contact
Data Protection Officer: Lim Ye Yong, info@antlerzone.com, 19-09, Austin 18 Versatile Business Suites, Jalan Austin Perdana 3, Taman Austin Perdana, 81100 Johor Bahru, Johor, Malaysia.