Note for the operator: this text is a template. Before opening the service to the public, fill in the data controller's identity and the Data Protection Officer (DPO) contact, then have it reviewed by legal counsel.
| Data | Purpose | Legal basis |
|---|---|---|
| Sign-in identity and account recovery | Consent & performance of contract | |
| WhatsApp number | Alternative sign-in identity and account contact (never shown publicly) | Consent & performance of contract |
| Display name | Shown only to you in the account menu (never shown publicly) | Consent |
| Password | Stored as an Argon2id/bcrypt hash — we cannot read it | Account security |
| Balance transaction history | Records of land and floor purchases | Performance of contract |
| PayPal payment records | PayPal order ID, amount and status. Card and PayPal account data are handled by PayPal and never reach us. | Performance of contract & legal obligation (tax) |
| Paywuz payment records | Order ID, Rupiah amount and status. We do not send your name, email or phone number to Paywuz; if a payment method (e.g. QRIS) needs buyer data, you enter it directly on the Paywuz page. | Performance of contract & legal obligation (tax) |
| Affiliate payout account (optional) | Bank or e-wallet name, account / phone number / PayPal email and account holder name, used only to transfer your affiliate commission. Stored encrypted; only the admin sees the full number while processing a withdrawal. Deleted when you remove it or delete your account. | Performance of contract |
| Billboard & bus ad views | When a billboard or bus ad is actually visible on your screen, we record a one-way hash of your account or session per ad slot per day, only to count unique viewers and bill advertisers. A one-way hash of your IP address is kept for 2 days to limit fraudulent views. Advertisers see totals only, never who viewed. Viewer hashes are deleted after 120 days. | Legitimate interest (advertising statistics) |
| Affiliate referrals | Which account invited you (via an invite link) and the commission earned from your payments. The person who invited you sees only commission amounts, never your identity. | Performance of contract |
| Banner photos | Displayed on your building. EXIF metadata (including GPS location) is removed automatically. | Consent |
| IP address (hashed) | Preventing login abuse and keeping security logs. Raw IP addresses are not stored. | Legitimate interest (security) |
Brand name, business description, building design, website link and approved banners. Your email, WhatsApp number and display name are never shown to other users.
Account data is kept while the account is active. Security logs and login attempts are deleted automatically after 180 days. Payment records are kept for the period required by tax law, without a link to your account once it is deleted.
Encrypted connections (HTTPS), HttpOnly and SameSite session cookies, CSRF protection, login rate limiting, validation and re-encoding of all uploads, and audit logging.
[Data controller name, address and DPO email]