Version: 1.1.3-2026-10-23 · Effective: 2026-10-23

Bukujanji Privacy Policy

Version: 1.1.3 Effective Date: 23 October 2026

1. Introduction

Bukujanji ("we") respects your privacy and is subject to Law No. 27 of 2022 on Personal Data Protection (UU PDP), PP 71/2019, Permenkominfo 5/2020, and sound international privacy practice. This policy explains what data we collect, how we process it, with whom we share it, and the rights you have as a data subject.

Data Controller: PT Kreatif Sistem Teknologi, Jakarta. Data Protection Officer (DPO): Ryan Sunaryo, President Director (Direktur Utama) — ryan.sunaryo@kreatifcity.com.

2. Data We Collect

2.1 Identity and contact data

• Name, email address, WhatsApp number, country code, city, profile photo.
• For Organizer Owners: KTP (national ID number, name, address), selfie photo, NPWP (if applicable), bank account details.
• For Participants booking on behalf of a child: child's name, date of birth, gender, relation to the booker.

2.2 Transaction and booking data

• Booking history for events/packages, payment status, refund history, promo codes used.
• Check-in records (QR scan timestamp), reviews you submit.
• Payment instrument data (card number, VA) is not stored on our servers — it is processed and stored by Midtrans in line with PCI-DSS standards.

2.3 Device and usage data

• IP address, device type, OS, browser, locale, push token (OneSignal).
• Pages visited, actions taken, timestamps.
• Cookies and similar technologies (see Cookie Policy).

2.4 Communication data

• The content of messages you send to customer service, history of broadcast emails we send to you, and your notification preferences.

2.5 Health declaration data

• For classes that require it (e.g. yoga, sports), you may be asked to fill out a short health declaration. This is not a medical record; it is stored on the booking record as basic information for the Organizer Owner.

2.6 Medical records (clinics using the Medical Records module)

• Clinics using the Medical Records module record their patients' health data in Bukujanji: patient identity (including NIK, place and date of birth, address, contacts), allergies, consents, and visit content (complaint, medical history, examination, vital signs, diagnosis, procedures, plan, payment method) and the practitioner's signature.
• For this data the clinic is the data controller, and Bukujanji (PT Kreatif Sistem Teknologi) processes it on behalf of and as instructed by the clinic as a data processor. Patients' requests about their medical records (access, copies, correction) go to the clinic; we help the clinic fulfil them.
• Clinical content, NIK, and supplementary patient identity are stored encrypted per column (AES-256-GCM) with a separate key, opened only by practitioners or clinic staff with permission, and every access is logged.

3. Lawful Basis for Processing

Per Article 20 UU PDP, we process your data on the following bases:

• Explicit consent — when you check a consent box at signup/booking.
• Performance of contract — to deliver the booking service you requested.
• Legal compliance — for tax, audit, and lawful orders.
• Legitimate interest — for platform security, fraud prevention, and product improvement.

You may withdraw consent at any time; see Section 7.

4. How We Use Data

• Process bookings, payments, refunds, and settlements.
• Send booking confirmations, event reminders (email + push), and receipts.
• Allow Organizer Owners to manage their event rosters (they see the name, email, and phone of participants who booked their event).
• Display public reviews with masked names (e.g. "Sari W.").
• Detect fraud and maintain platform integrity.
• Aggregate analytics for product improvement (not individual targeting).
• Opt-in only marketing communications (new-organizer broadcasts, promos) — you can unsubscribe at any time.

5. Data Sharing With Third Parties

We share data on a limited, contractually-bound (DPA) basis with:

• The Organizer Owner of an event you booked: name, email, phone, health declaration, participant identity (for roster + check-in). They do not receive your booking history with other organizers.
• Midtrans for payment processing.
• Iris by Midtrans for disbursement to Organizer Owners / Outlets.
• AWS S3 (file storage — KTP, bank account photos, employee documents, etc.) — hosted in the Jakarta, Indonesia region.
• AWS SES (transactional email delivery) — hosted in the Singapore region.
• OneSignal for push notifications.
• Meta (WhatsApp Business API) for transactional messaging when enabled.
• Language model (AI) providers for automated replies in WhatsApp chat and webchat: if you interact with our automated assistant, your message content and your name are sent to that provider to generate a reply. The provider we currently use is Moonshot AI (MOONSHOT AI PTE. LTD., servers in Singapore according to their platform privacy policy); we may also use OpenAI (United States). That provider states the content submitted is used for training and refining their models and algorithms, and is retained for as long as our account with them remains active — not for a fixed period. You can avoid this processing by asking to be served by a human agent.
• Telegram for internal operational notifications to our team (e.g. balance withdrawal requests), which may include your name, phone number, and transaction amounts.
• Google Analytics 4 and Meta Pixel on our website to measure visits and advertising effectiveness (see Cookie Policy).
• Ministry of Health (SATUSEHAT platform): signed medical-record visits are sent to SATUSEHAT on the clinic's behalf, using the clinic's own credentials, when the clinic enables that integration as part of its obligations as a healthcare facility. SATUSEHAT servers are in Indonesia.
• Lawful authorities when there is a valid court order, police summons, or other lawful request.

We do not sell your personal data to third parties for their own commercial purposes.

5.1 AI Connections (for outlet owners)

"AI Connections" lets an outlet owner connect an AI assistant of their own choosing — for example ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google), Grok (xAI), or another application that supports the MCP protocol — to that owner's outlet. It is separate from the automated assistant described above, which Bukujanji itself operates to reply to customers. This section applies to outlet owners who use the feature and to the customers whose data sits in the connected outlet.

• Who decides. Only the outlet owner's account can create a connection (staff accounts are refused). The owner signs in on a Bukujanji page — the password is not given to the AI provider — and then sees a consent screen that names the AI provider, lists the data that will be sent, and lets the owner untick each permission to change data. Permission to read and reply to WhatsApp Inbox chats is unticked by default. We record the owner's consent: the outlet, the permissions granted, the version of the consent text, the time, the IP address, the browser user-agent, and the name and host of the AI application.
• Roles. The outlet owner decides to send the outlet's customer data to the AI provider and is responsible for the legal basis for doing so towards the outlet's own customers. Bukujanji is responsible for sending only the data that the connected AI application requests, within the permissions the owner granted. Once data reaches the AI provider it is stored and processed under that provider's own privacy policy and terms, not this policy; we do not control, and are not responsible for, storage, use, or breaches on the provider's side. Some individual plans of an AI provider may use conversations to train models unless the owner turns that off in the provider's settings.
• Data that can be accessed. Depending on the permissions the owner grants: schedule and bookings (customer name and phone number, service, time, status, amounts due/paid, and booking notes and cancellation reasons written by staff); the customer list (name, phone, last visit, and the names of children/participants at class outlets); package, quota, and follow-up information; report summaries (revenue figures and counts); the catalogue and prices (services, tables/courts, classes, promos, vouchers); and the outlet wallet (balances, settlements, and withdrawal history — amounts only, never bank account numbers). If the owner ticks the WhatsApp Inbox permission, the contents of customer WhatsApp chats, with customer names and numbers, can also be read by the AI application. We do not send dates of birth or previously saved customer notes, and we do not send data of other outlets. Where the owner allows it, the AI application can also create or change data in the outlet (for example services, classes, promos, bookings from an active package, moving or cancelling class bookings, marking attendance, customer records and notes, WhatsApp reminders, and replies to Inbox chats). Every such change is shown as a preview and made only after the owner confirms it in the conversation, and the assistant has no ability to delete data.
• No push, only on request. Bukujanji does not send outlet data to AI providers on its own initiative. Data leaves only when the connected AI application requests it through a specific call. Each connection is limited to 60 requests per minute and, for customer lists (name and phone number), to 500 rows per day.
• Tokens and duration. Access is granted through OAuth. An access token is valid for 1 hour; a refresh token is valid for 30 days and is replaced each time it is used; the underlying authorization record is kept for up to 400 days. The tokens are tied to a single outlet and cannot be used for another outlet.
• Revocation. The owner can revoke a connection at any time in Settings → AI Connections, or change its permissions without reconnecting. Revocation cuts off the connection from the next request (at the latest within about one minute). All of an owner's connections are also revoked automatically when the owner changes their password from the account settings page; resetting the password through "Forgot password" does not currently revoke them, so revoke connections manually if you suspect someone else has accessed your account. Revocation does not delete data the AI provider has already received; to remove that data, contact the provider.
• Our activity log. For every call made through a connection we keep a record in our database containing: the connection and AI application identifiers, the name of the tool called, whether it succeeded, an error code and a short error message (maximum 300 characters, written by us; when a call is refused, this message may contain the name or phone number of a customer mentioned in the refusal, for example a number that is already registered), how long it took, a reference to the record created (for example a transaction ID), and the time. The arguments of the call are stored only in masked form: free text is reduced to its first two characters plus its length (for example "Ca…(7)"), only structural values such as dates, times, statuses, and filter types are kept as they are (maximum 60 characters each), numbers and true/false values are kept, one-time confirmation codes are dropped, and an oversized record keeps only the argument names. The content returned to the AI application is not stored in this log. We use it for security, support, abuse detection, and to show owners their connection history. This log is not currently deleted on a fixed schedule; you may ask us to delete it under Section 7.
• Feature requests. If the owner asks the AI for something that cannot be done, the assistant may leave us a short, general description of the request (maximum 500 characters, plus up to 300 characters of context), together with the connection and outlet identifiers, for our product team to review. The assistant is instructed not to include customer names, phone numbers, or other personal data in it.

6. Data Retention

• Active account data: kept while the account is active.
• Transaction records: 10 years per tax law.
• Audit and security logs: 90 days; critical events (e.g. failed logins, permission changes) 180 days.
• AI Connections: the consent record and connection status are kept after a connection is revoked, as evidence of the consent; the tool-call log is described in Section 5.1 and is not currently deleted on a fixed schedule.
• Data you request deletion of: deleted within 30 working days, except for legally mandated retention (flagged as "anonymized" and no longer used for personal profiling).
• Clinic medical records (Section 2.6): kept for as long as clinics are legally required — electronic medical records for at least 25 years after the patient's last visit (Permenkes 24/2022). Medical records are not deleted when a customer account is deleted.
• Database backups: may contain your data for up to 90 days post-deletion, then overwritten by the backup rotation cycle.

7. Data Subject Rights (Articles 5–14 UU PDP)

You have the right to:

• Access — see the data we hold about you.
• Correction — request correction of inaccurate/outdated data.
• Erasure — request deletion of your account and associated data (subject to the Section 6 exceptions).
• Portability — request a copy of your data in a common format (JSON/CSV).
• Restriction — ask us to pause processing of certain data while a request is investigated.
• Withdrawal of consent — withdraw consent for optional processing (marketing notifications, etc.).
• Complaint to authority — file a complaint with Komdigi (Personal Data Protection Supervisor) if our response is unsatisfactory.

How to exercise: email support@bukujanji.com with identity proof. We respond within 3×24 working hours per UU PDP standards.

7.1 How to delete your Bukujanji account

1. Make sure you have no active transactions or bookings.
2. Email support@bukujanji.com from the email address registered with Bukujanji, with the subject "Account Deletion Request", including your full name, registered email, and (optionally) your reason.
3. Our team reviews the request within 1–3 working days and will contact you if additional verification is needed.
4. Once approved, your account and associated data are deleted within the timeframes in Section 6, and you receive a confirmation email.

Deletion is permanent: deleted data cannot be restored, except for data we are legally required to retain (see Section 6).

8. Data Security

• Our primary database is self-hosted in a Jakarta, Indonesia data center, not a third-party managed database service.
• TLS 1.2+ for all connections.
• Bcrypt hashing for passwords (Organizer Owner / Customer login).
• Limited internal access with role-based permissions + audit logs.
• Medical-record content, NIK, and SATUSEHAT integration credentials are encrypted per column (AES-256-GCM) with a separate key; every medical-record access is logged.
• Our code has automated tests of access controls (including isolation between outlets). A penetration test by an independent party is planned and has not yet been performed.
• Material security incidents will be notified to affected data subjects and to Komdigi within 3×24 hours per Article 46 UU PDP.

9. Minors

The Platform is not intended for users under 18 as standalone account holders. If an event participant is a child, the booking must be made by a parent/guardian aged 18+ on the child's behalf (the "book for a child" feature). Child data stored is limited to name, date of birth, and gender — used only for the relevant event roster.

10. Cross-Border Transfer

Your primary data is stored in Indonesia (our database and file storage are in Jakarta). Some processing, however, takes place outside Indonesia:

• Singapore — transactional email delivery (AWS SES) and AI automated replies (Moonshot AI), if you interact with our automated assistant.
• United States — OpenAI (when used as the AI provider), Google Analytics, Meta Pixel, OneSignal.
• Global infrastructure — Meta (WhatsApp Business API), Telegram.
• AI provider chosen by an outlet owner (AI Connections, Section 5.1) — the location depends on the provider the owner connects (for example OpenAI, Anthropic, Google, or xAI); data is sent there on the owner's instruction and we do not control where the provider stores it.

For such transfers, we ensure the destination country has an equivalent level of protection or rely on Standard Contractual Clauses (SCC) as the legitimacy mechanism under Article 56 UU PDP.

11. Changes to This Policy

Material updates will be communicated via email + in-app banner 14 days before they take effect. The latest version is always available at /legal/privacy-policy.

12. Contact

Data Protection Officer (DPO): Ryan Sunaryo, President Director (Direktur Utama) — ryan.sunaryo@kreatifcity.com Customer service and data subject requests: support@bukujanji.com Mail: PT Kreatif Sistem Teknologi, Jakarta.