Privacy Policy

1. Information We Collect

We collect personal information by the following methods:

1. Information Provided Directly by Users
   Name, email address, and other details entered in contact forms, comment fields, and newsletter registrations.
2. Automatically Collected Information
   Cookies, IP addresses, access timestamps, browser/OS information, referrer URLs, etc., obtained via Google Analytics 4, Meta Pixel, Cloudflare WAF, and similar tools.
3. Information Obtained from Third Parties
   Non-identifiable data such as reservation IDs, purchase amounts, and conversion timestamps provided upon successful booking or purchase through affiliate links (e.g., Klook, Chope, Trip.com).

2. Purposes of Use

• Responding to inquiries and verifying identity
• Sending newsletters about new features and promotions
• Improving site quality and optimizing content through access analysis
• Advertising delivery and affiliate performance tracking
• Investigating and preventing violations of laws or terms of service

3. Legal Basis (GDPR Articles 6 & 13, PDP Law Article 20)

We process personal data based on one of the following legal grounds:

• User’s explicit consent
• Performance of a contract or pre-contractual steps
• Our legitimate interests (e.g., marketing, security)
• Compliance with legal obligations

4. Third-Party Provision & Joint Use

We may provide or jointly use personal information with the following service providers. Please refer to each company’s privacy policy for details.

5. Use of Cookies, etc.

We use cookies to enhance user experience and perform statistical analysis. A consent banner is displayed on first visit, allowing users to choose. You can disable cookies in your browser settings; however, some features may not function properly if cookies are disabled.

6. Cross-Border Data Transfers

Our servers are located in Indonesia, but some service providers operate servers in the United States, Singapore, and Japan. For transfers from GDPR jurisdictions, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs).

7. Data Retention Period

We retain personal data until the purpose of use is achieved, or within legally required or business-necessary periods, and then delete or anonymize it. For example, user-level tracking data in Google Analytics is automatically deleted after 26 months.

8. Data Subject Rights

Users have the following rights. To exercise any of these, please contact us at Section 13. Contact.

• Right of access (request disclosure of personal data)
• Right to rectification and erasure
• Right to restriction of processing and objection
• Right to data portability
• Right to withdraw consent

9. Security Measures

We implement appropriate technical and organizational measures, such as SSL/TLS encryption, two-factor authentication, WordPress security plugins, Cloudflare WAF, regular vulnerability scans, and least-privilege access controls to protect personal data.

10. Children’s Privacy

This Site is not directed to children under 13 and does not knowingly collect personal information from them. If we discover any such data has been collected inadvertently, we will delete it promptly.

11. Disclaimer

• We are not responsible for the privacy practices of external sites linked from this Site.
• Information voluntarily disclosed by users (e.g., via comments) may be viewed by third parties.

12. Changes to This Privacy Policy

We may revise this Policy without notice due to law revisions or service changes. Significant changes will be announced on this Site, and re-consent may be requested if necessary.

13. Contact

If you have any questions about this Policy, please contact us at: