Privacy Policy

XWheels is a vehicle rental marketplace operated by Helios Capital Sdn. Bhd., a company registered in Malaysia under registration number 202601012737 (1674835-A). In this policy, “XWheels”, “we”, “us”, and “our” refer to that company. We are responsible for the personal data we collect and use to operate XWheels.

This policy explains how we collect, use, disclose, retain, and protect personal data when you visit our websites, use our customer or operator applications, create an account, verify your identity, arrange a rental, or contact us. The information we process depends on the features you use and whether you are a renter, vehicle operator, operator team member, or visitor.

Vehicle operators and third-party platforms may also process information for their own purposes and have their own privacy notices. This policy covers processing by XWheels; it does not replace those notices. You can contact our privacy team at support@xwheels.my.

Personal data means information that identifies you or can reasonably be linked to you. We collect the following categories when they are relevant to the service you request. You do not need to provide every category simply to browse the marketplace.

• Account and contact information. Your name, email address, phone number, profile picture if provided, account identifier, sign-in and verification records, language preference, and notification choices.
• Identity and driving eligibility. Identity card or passport information, driving licence details and document images, and relevant information such as date of birth, nationality, verification results, and review notes. These documents can contain sensitive information and are collected for identity checks, rental eligibility, and fraud prevention, rather than advertising.
• Rental and transaction information. Vehicles you select, rental dates, pickup and return arrangements, locations you enter or select, booking references, invoices, amounts, payment and refund status, payment provider references, vouchers, and referral records. Vehicle handover, return, damage claims, and disputes may also involve photographs, signatures, and correspondence.
• Operator information. Business name and registration records, business address and contacts, authorised representatives and team members, vehicle and fleet information, verification documents, payout bank details, and billing records needed to operate a rental business on XWheels.
• Communications and content. Messages, support requests, attachments, reviews, complaints, and the information you choose to send us, together with relevant conversation identifiers, timestamps, and message delivery records.
• Technical and device information. IP address, browser and operating system information, device or session identifiers, access and error logs, interactions with the service, and security events. Mobile apps may also register a device notification token and platform type to deliver push notifications.

We receive information directly from you when you register, complete a form, upload a document, book a vehicle, submit a review, or contact support. Some technical information is generated automatically when your browser or device connects to the service.

We also receive information from the operator involved in your rental, payment and communication providers, and a sign-in provider you choose to use, such as Google, Apple, or a Meta sign-in feature where offered. Depending on the provider and your permissions, sign-in information may include an account identifier, name, email address, and profile picture. The sign-in provider handles its own password; you should not send that password to XWheels.

If you provide information about another person, do so only when you are authorised and have made them aware of how their information will be used. Avoid including unnecessary personal information in public reviews or support messages.

We use personal data for the purposes below, with consent where required and where processing is permitted by applicable law. Depending on the circumstances, processing may also be necessary to enter into or perform a contract with you, meet a legal obligation, or protect the service and its users. Where the law requires explicit consent for sensitive personal data, we obtain it before that processing.

This policy is a notice about our practices. It is not, by itself, consent to marketing or to every optional use of your information.

• Provide the marketplace. Create and manage accounts, authenticate users, verify identity and driving eligibility, display relevant vehicles, and manage operator listings and team access.
• Fulfil rentals and payments. Arrange bookings, coordinate collection and return, process payments, deposits and refunds, issue invoices, manage operator payouts, and administer vouchers and referrals.
• Communicate and provide support. Send verification, account, booking, payment, and service messages; respond to enquiries; and manage complaints, damage claims, and disputes.
• Protect and improve the service. Investigate fraud, misuse and security incidents, troubleshoot errors, maintain reliable services, understand service performance, and improve usability. We use aggregated or de-identified information where it can meet these purposes.
• Meet legal requirements. Keep required accounting and transaction records, respond to lawful requests, and establish, exercise, or defend legal claims.
• Optional marketing. Send offers or promotions only where permitted and with any required permission. You can withdraw that permission or opt out without closing your account.

We identify required information in the relevant form or process. Account identifiers are needed to maintain an account; identity and driving documents are needed for the rental verification process; booking and payment details are needed to complete a transaction; and operator business and payout information is needed to provide operator services.

If you do not provide required information, or withdraw consent needed to process it, we may be unable to create or maintain an account, verify eligibility, fulfil a booking, or provide the affected service. We explain the consequence for the relevant request. Optional profile information, marketing permission, and optional device permissions are not a condition of browsing the marketplace.

We disclose information only where needed for the purposes explained in this policy, with your direction or consent, or as permitted or required by law. We do not sell personal data or rent customer lists. Access by staff and service providers is limited to their responsibilities.

Service providers that process information on our behalf must protect it and use it for the services we instruct them to provide, subject to applicable contractual and legal requirements. Where a provider independently processes information, its own privacy notice also applies.

• The operator involved in your rental. Information needed to arrange and fulfil the booking, such as your name, contact details, rental arrangements, verification status, and relevant handover or dispute information. Customer identity document uploads are held separately from ordinary operator booking access. Operators are responsible for information they separately collect or use to fulfil the rental and meet their own legal obligations.
• Payment and financial providers. Providers such as Stripe and Curlec and relevant banks process payment, refund, payout, billing, transaction, and fraud-prevention information. Payment credentials are submitted through the relevant payment provider. XWheels does not store full payment card numbers or card security codes in its own application database.
• Hosting, authentication, storage, and technical providers. Providers supporting our infrastructure, database, authentication, file storage, security, and error monitoring, including Supabase and, where enabled, Sentry. The information shared depends on the service they provide.
• Messaging and customer support providers. Providers used for email, SMS, WhatsApp, push notifications, and support, such as Resend, Twilio, Meta/WhatsApp, Firebase Cloud Messaging, and Chatwoot, where those channels are used. They process the recipient details, message content, delivery information, and support context needed for that channel.
• Other users and the public. Operator listings and reviews you choose to publish can be visible to other users or the public. Do not include identity documents, private contact details, or information about another person that is not necessary for a public review.
• Professional advisers, authorities, and business successors. Relevant information may be shared with accountants, auditors, lawyers, regulators, or law enforcement where necessary and lawful. If the business is reorganised, transferred, or acquired, relevant data may be transferred with appropriate confidentiality and data protection safeguards and any notice required by law.

If you contact or interact with XWheels through WhatsApp, Facebook, Instagram, or another platform, we may receive the information made available through that interaction, such as your phone number or platform identifier, profile name, messages and attachments, timestamps, and delivery status. We use this information to handle your enquiry, provide the requested service, and maintain relevant communication records.

Where a Facebook or other Meta sign-in or account-connection feature is offered and you choose to use it, we receive the account identifier and profile fields made available under the permissions you authorise, which may include your name, email address, and profile picture. A connected-platform API feature may also involve the page or business account identifiers and information, messages, or content needed for the specific feature you select, together with its granted permissions and connection credentials. We use these only to authenticate you, connect the selected account, or provide that authorised feature. We do not ask for your Meta password. Basic sign-in permission is not permission to access unrelated private content, contacts, or conversations.

For WhatsApp messaging, we use your number and the permissions you provide to send messages relevant to the service or category you agreed to receive. You can ask us to stop WhatsApp communications by replying to the conversation or contacting support@xwheels.my. We respect opt-out requests, including requests made outside WhatsApp. Where a service message is still necessary, we may need to use another appropriate channel.

Information obtained through Meta platform services is used only for the disclosed, permitted purpose. We do not sell, license, or use it for unrelated profiling. We delete it when it is no longer needed, when you request deletion, or when the platform requires deletion, subject only to retention permitted by the platform’s terms and applicable law. The deletion instructions below apply to this information as well as other XWheels personal data.

You can revoke a connection or permission using the relevant platform’s app, website, or business integration settings. You can also contact us to disconnect a linked account or delete the information already held by XWheels. Removing a connection stops the access authorised by that connection but does not automatically erase our existing records; use the deletion instructions for those records. If you rely on that provider to sign in, contact support before disconnecting it so we can help you retain access through an available alternative.

Do not send identity documents, full identity card or passport numbers, bank account details, card numbers, passwords, or verification codes through WhatsApp or public social media. Use the relevant secure account, verification, or payment process instead. Each platform also processes information under its own privacy policy.

Our web service uses cookies and similar storage to maintain authentication sessions, remember language preferences, and support security and basic functionality. The installable web app may cache pages and assets on your device for performance and offline access. Mobile session storage and notification tokens support sign-in and message delivery.

We may use technical logs and aggregated service statistics to understand reliability and usage. XWheels does not currently use Meta Pixel, Google Analytics, or third-party advertising trackers. If we introduce optional analytics or advertising technologies that require consent, we explain that use and obtain the required permission before enabling them. Necessary authentication or security storage is not treated as permission for advertising.

You can clear or restrict cookies, site storage, and cached content through your browser or device settings. Doing so may sign you out, reset preferences, or limit features. A provider used for sign-in, payment, or messaging may apply its own storage practices when you use that provider’s service.

Where a feature asks for device permission, camera or selected-photo access supports document or handover uploads, and notification permission supports push messages. You can manage these permissions in your device settings. Refusing an optional permission affects the relevant feature rather than granting us access by another means.

Rental location information includes pickup, return, delivery, or search locations that you enter or select. Technical information such as an IP address can also indicate an approximate location. The rental workflows covered by this policy do not require continuous background tracking of your device location.

XWheels operates from Malaysia. Some hosting, payment, communication, sign-in, or support providers may process or store personal data in other countries. Those countries may have different data protection laws.

Where we transfer personal data outside Malaysia, we use an applicable legal basis and appropriate safeguards under the Malaysian Personal Data Protection Act 2010, as amended, and other laws that apply to the transfer. Depending on the transfer, these may include assessing the protection in the receiving country, contractual protections, and reasonable precautions to protect your information. Contact us for information about a transfer relevant to your data.

We retain personal data only for as long as it is needed for the purpose for which it was collected or for an applicable legal requirement. The period depends on the type of information, account and booking status, and any outstanding obligation or claim. We do not apply a blanket tax-record retention period to every item of account or identity data.

When information is no longer needed, we delete it or irreversibly anonymise it. Copies in backups are subject to the applicable backup retention cycle and access restrictions; they are not used to restore a deleted account for ordinary business use. If a backup is restored for recovery, applicable deletion requests must be reapplied.

• Account and profile data. Kept while needed to provide your account and services, then removed or anonymised following a verified deletion request unless a specific retention exception applies.
• Identity and verification documents. Kept only while needed for verification, rental eligibility, a relevant fraud investigation or dispute, or a legal requirement. They are not kept indefinitely simply because an account once existed.
• Booking, payment, invoice, and payout records. Kept for the applicable accounting, tax, transaction, and legal recordkeeping period. Only the information needed for that obligation is retained after account deletion.
• Support, handover, security, and dispute records. Kept as necessary to resolve the matter, maintain service security, and meet applicable legal or claim-related requirements. Unneeded attachments and identifiers are removed or anonymised.
• Connected-platform information. Removed when no longer needed for the permitted purpose, on a valid deletion request, or when required by the platform. A platform’s stricter deletion rules apply to data obtained through it.

We use technical and organisational measures appropriate to the information we process, including authenticated access, role-based permissions, restricted document storage, and controls over access to verification materials. We limit personal data access to authorised personnel and providers with a relevant need.

No online service can guarantee absolute security. Protect your account credentials and notify us at support@xwheels.my if you suspect unauthorised access or identify a security concern. Where a personal data breach requires notification, we notify the relevant authorities and affected individuals as required by applicable law.

Subject to applicable law, you can request access to your personal data, correct inaccurate or incomplete information, withdraw consent, and ask us to limit or stop processing in circumstances recognised by law. You may also have rights to data portability, deletion, restriction, or objection under the law that applies to your request. We assess each request against that law rather than assuming every right applies identically in every country.

You can update available profile details and notification choices in your account. To exercise a right, make a complaint, or request help where a setting is not available, email support@xwheels.my. We may verify your identity using only information reasonably needed for the request. We explain any lawful limitation, applicable fee, or additional information needed before proceeding.

You can opt out of marketing using the instructions in the message, available account preferences, or our support email. You can also disable push notifications in device settings or ask us to stop an optional messaging channel. Some essential account, security, booking, and payment communications remain necessary to provide the service, but they do not give us permission to send marketing.

Withdrawing consent does not make earlier lawful processing unlawful. If withdrawal affects a service you requested, we explain the consequence. You can complain to Malaysia’s Personal Data Protection Commissioner or another relevant data protection authority where applicable.

You can request deletion of your XWheels account, all associated personal data, or specific information, including information received through Meta or another connected platform. This option is available to everyone, whether or not you can sign in, still have the app installed, or live in Malaysia.

After we verify the request, we delete or irreversibly anonymise information that is no longer needed. We retain only information necessary to meet a legal obligation or to address a specific outstanding transaction, fraud or security issue, or legal claim. We explain any applicable exception and how long it applies when responding to your request. For data received through Meta, any retention must also be permitted by Meta’s applicable terms; where those terms require deletion unless the law requires retention, that stricter rule applies.

Deleting the app, signing out, or removing a platform connection does not by itself delete information already held by XWheels. A XWheels deletion request does not delete your Facebook, Instagram, WhatsApp, Google, or Apple account. Those services manage their own records and deletion requests.

1. Send your request. Email support@xwheels.my with the subject “XWheels data deletion request”. State whether you want to delete your account and associated data or only specific data, such as WhatsApp correspondence or connected-platform information.
2. Help us find your records. Use the email address linked to your XWheels account where possible. Include your registered email address or phone number, and the platform involved if relevant. If you cannot access that email address, explain this so we can arrange another appropriate verification method. Do not send passwords, one-time codes, full payment card details, or identity documents with your initial request.
3. Verification and confirmation. We may ask for the minimum additional information needed to verify your identity and protect against unauthorised deletion. We respond without undue delay and within the period required by applicable law. We confirm the outcome, explain any information that must be retained, and tell you if additional information or time is needed. You can reply to the same email thread to check progress.

XWheels is intended for adults arranging vehicle rentals and for authorised operator personnel. It is not directed to children under 18, and we do not knowingly collect personal data from children for an account or rental service. Vehicle operators may set a higher minimum driving or rental age.

If you believe a child has provided personal data to XWheels, contact support@xwheels.my so we can investigate and remove information where appropriate.

We may update this policy when our services, data practices, or legal requirements change. The date at the top identifies the latest revision. We provide additional notice of material changes and obtain new consent where required; updating this policy alone does not authorise a new use that requires your permission.

For privacy enquiries, access or correction requests, consent withdrawal, security concerns, and account or data deletion, contact the XWheels privacy team at support@xwheels.my. The responsible company is Helios Capital Sdn. Bhd., registration number 202601012737 (1674835-A), Malaysia.