How We Handle Your Data at kobratoto
This is our privacy policy, written for you in plain language. We explain what account details we collect when you open kobratoto, why we keep them, and how...
Privacy Posture and Your Rights
Our privacy posture follows the data-protection rules that apply where local law permits across Indonesia and supported regions. We collect only what your account flow needs: identity references, contact channel, device fingerprint for fraud checks, and payment metadata when you link DANA, OVO, GoPay or QRIS. We do not sell your data to third parties. You can request access, correction or deletion
of your records at any time by writing to our privacy desk. Retention windows follow tax and anti-fraud obligations, after which records are purged from active systems. Consent can be withdrawn for marketing channels without affecting your core account.
Service availability is jurisdiction-dependent. Users are responsible for checking local law before access.
Privacy Contact Paths
If a privacy clause is unclear, or you want to act on a data right, these are the channels we monitor. Each one routes straight to the privacy desk, not general support, so your request lands with the right reviewer the first time.
Privacy Inbox
Email our dedicated privacy address for access, correction or deletion requests. We acknowledge within two working days and resolve standard requests inside the statutory window where local law permits.
In-Lobby Chat
Open the chat bubble after signing in and type 'privacy' to be routed to a reviewer. Useful when your question touches account data you can already see on screen.
Postal Channel
For formal notices or legal correspondence, our registered address accepts written submissions. Include your account reference so we can match records without asking for extra identity proof later.
How We Review This Policy
This policy is not a static page. It is reviewed on a schedule and after any meaningful change in how we process your data. Here is who signs off and what we...
Legal Sign-Off
Every clause is reviewed by counsel familiar with Indonesia data-protection practice before publication, so wording reflects current obligations rather than copy-paste templates borrowed from other jurisdictions.
Quarterly Refresh
We re-read the full policy every quarter and after any product change touching account data. Version dates sit at the foot of the page so you can spot what shifted.
Payment Data Audit
DANA, OVO, GoPay and QRIS reference flows are audited separately because they involve external processors. We confirm what metadata returns to us and what stays with the wallet.
Access Logs
Staff access to your records is logged and reviewed. Only roles with a stated reason can open an account file, and the log is kept for the retention window.
Vendor Checks
Third-party tools that touch your data are vetted before onboarding and reviewed annually. If a vendor falls short, we replace them rather than weaken our posture.
Breach Drill
We rehearse breach notification steps so that, if something ever went wrong, the alert to you and to regulators would arrive within the windows that apply where local law permits.
Consistency With Our Other Policies
This privacy policy lines up with our other legal pages so you are not chasing contradictions. Here is how it sits next to the sibling documents.
| Terms of Service | Defines the account contract; this policy explains the data side of that contract. |
|---|---|
| Cookie Notice | Covers browser storage specifically; privacy policy covers the broader account record. |
| AML Statement | Identity checks live there; we cross-reference rather than duplicate the wording. |
| Payment Disclosures | Wallet-specific notes for DANA, OVO, GoPay and QRIS sit alongside the relevant clause. |
| Marketing Consents | Opt-in choices are mirrored in your account preferences panel for easy review. |
| Retention Schedule | Exact retention windows are listed in a separate annex referenced from this policy. |
| Complaints Path | Escalation steps match what the terms describe so the route is identical. |
What This Policy Page Shows You
The privacy page has its own layout cues so the document is easy to navigate. These are the visible elements you'll meet as you scroll, not the policy text itself.