Privacy Policy

1. Data we collect

• Account data: e-mail address, display name, chosen role, and a password stored only as a cryptographic hash. Restaurant and driver partners also give a contact name and phone number.
• Orders and vouchers: what you bought, when, for which venue, the voucher status, and when and where it was used (venue, time, bill reference entered by the venue).
• Payment status: our payment provider Whop tells us whether a payment succeeded, the amount, the fee and a payment reference. We never receive or store your card number or bank details.
• Partner attribution: if you open the site through a partner's QR code, we store an anonymous visit record so the partner can receive a reward for your first purchase. The partner never sees who you are.
• Location: when you allow it, your browser uses your position to sort restaurants by distance. The position stays in your browser and is not sent to our servers.
• Technical data: IP address, browser type, time of requests and security logs needed to run the service and prevent abuse; a session cookie that keeps you signed in; a setting cookie for the light or dark theme.
• Support messages: what you send us on WhatsApp or through the app, including your order number.

2. Why we use it

• To create your account, sell and issue vouchers, let venues redeem them, and handle refunds (performance of a contract with you).
• To pay restaurant and driver partners and keep accounting records (contract and legal obligations).
• To prevent fraud, double use of vouchers and abuse of the service (legitimate interest and security).
• To answer your questions and complaints.
• To send you offers by e-mail only if you ticked the optional marketing box; you can withdraw that consent at any time.

3. Who receives data

• Whop (payment provider): processes your payment on its own checkout page under its own privacy policy and receives the order reference and amount from us.
• The venue you bought a voucher for: sees that a valid voucher is presented, the voucher contents and the redemption record. It does not receive your e-mail or phone number from us.
• Driver partners: see only anonymous statistics about rewards; never your identity or contact details.
• Hosting and infrastructure providers that store and serve our systems under contract with us.
• Authorities, when the law obliges us to share data.

We do not sell personal data.

4. How long we keep it

• Account data: while your account exists and for up to 12 months after you delete it, unless a longer period is required for accounting.
• Orders, payments, refunds and redemption records: as long as accounting and tax rules require (in general up to 10 years).
• Security logs: up to 12 months.
• Voucher codes are stored encrypted and become unusable after the voucher is used, expires or is refunded.

5. Your rights

You can ask us to show, correct or delete your personal data, to stop marketing e-mails, and to explain how we use your data. Write to us on WhatsApp (number below) from the phone or e-mail linked to your account so we can verify it is you. We answer within 30 days. If you believe we have mishandled your data, you may also complain to the competent Indonesian data protection authority.

6. Security

• All traffic is encrypted (HTTPS). Passwords are stored as salted hashes, never in clear text.
• Voucher codes are stored encrypted and can only be decrypted by our servers for the account that owns the voucher.
• Access to administrative tools is limited to named staff and every action is logged.
• Backups are taken daily and kept for a limited period to allow recovery after an incident.

7. Children

The service is intended for adults. We do not knowingly collect data from persons under 18.

8. Changes

We may update this policy; the version and effective date are shown at the top. Material changes are announced on the website.