What we keep about you, and why.
In plain words. The short version: what you give us to book a stay, nothing more, and we never sell it.
Last updated: 20 October 2026
Who we are
Mantin Forest Art Farmstay Sdn Bhd (SSM 201701015115 (1229279-V) · SST N10-1808-31006024), Lot 1813, Kampung Mantin Dalam, 71700 Mantin, Negeri Sembilan, Malaysia. For anything about your personal data, email [email protected], or WhatsApp 012-684 3166 and ask for a person.
What we collect, and when
- When you book: your name, phone or WhatsApp number, email, how many adults and children are coming and the children’s ages, your dates and rooms, and anything you type in the notes, such as an allergy or a ground-floor request. Our booking system keeps this on our own server.
- When you pay: ToyyibPay (FPX online banking) or PayPal take the payment on their own pages. Your bank or card details never reach us. We receive the amount, a reference and whether it went through.
- If you ask for a Malaysian e-Invoice: the tax identification number and the ID or company registration number that LHDN requires on it.
- When you message us on WhatsApp: the messages travel through Meta’s WhatsApp Business platform. An automated assistant answers first, at any hour, and a person takes over when needed. To write its replies the assistant sends the text of the conversation to third-party AI services, so please keep ID numbers and bank details out of the chat; we never ask for them there.
- When you ask for a group quote: your dates, headcount, the occasion and how you heard of us. The quote goes to WhatsApp only if you tap the button.
- When you visit this site: the cookies and analytics listed below.
What we use it for
To hold and confirm your booking; to send the confirmation, the receipt or the invoice by email; to answer your messages; to prepare your rooms and meals (the children’s ages, an allergy, a ground-floor request); to refund you under the cancellation terms; to keep the accounts the law requires; and to see how the website is used so we can improve it. We send you news only if you have asked for it, and you can stop it at any time.
Who else sees it
- Our own staff, to prepare your stay.
- ToyyibPay and PayPal, to take the payment.
- Brevo, which sends our emails.
- Meta, which carries WhatsApp messages, and the AI services that draft the assistant’s replies.
- Google Analytics, PostHog and Umami, which measure how the site is used.
- Meta and TikTok, whose advertising pixels let our adverts reach people who visited this site. They set their own cookies.
- Cloudflare, which carries and protects the site.
We never sell your details, and we hand them to no one else unless the law requires it.
How long we keep it
Booking and payment records for seven years, as Malaysian accounting and tax law requires. Messages for as long as the conversation helps us serve you. Analytics data for as long as each service keeps it.
Your rights
Under Malaysia’s Personal Data Protection Act 2010 you can ask to see the personal data we hold about you, have it corrected, withdraw your consent, or stop any marketing. Email [email protected]; we answer within 21 days.
Children, security and changes
Bookings are made by adults. We record children’s ages only to price the stay and prepare the rooms. The site runs on our own server behind Cloudflare, over HTTPS; payment pages belong to the banks. When this policy changes we post the new version here with a new date.