Privacy Policy

This Privacy Policy explains what personal data KUYY collects, why, who it is shared with, how long it is kept, and the rights you have over it. It applies to the KUYY app on iOS and Android, the kuyy.app and kuyy.id websites and their subdomains, host websites built with the KUYY Website Builder, and the KUYY mini app inside partner apps (for example BCA and GoPay). Please read it together with our Terms of Service.

This Policy is written to comply with Indonesian Law No. 27 of 2022 on Personal Data Protection (the "PDP Law") and its implementing regulations. Section 11 contains additional terms for users outside Indonesia.

1. WHO WE ARE

The controller of your personal data is PT Kreasi Untuk Indonesia ("KUYY", "we", "us"), Gedung Menara Olahraga Senayan (MOS), 11th floor FX Office Tower, Jl. Jenderal Sudirman, Gelora, Tanah Abang, Central Jakarta, DKI Jakarta 10270, Indonesia.

For questions, requests, or complaints about personal data, contact us at hello@kuyy.app with the subject "Personal Data", or through the kuyy_official chat in the app.

KUYY is a platform where activity organizers ("Hosts") open registration for classes, training sessions, competitions, and other events to participants ("Participants"). For data a Host collects from its own Participants through KUYY (for example registration form answers and documents the Host uploads), the Host is the controller for its own purposes and KUYY processes it as the platform provider. Section 4 explains this split.

2. PERSONAL DATA WE PROCESS

Data you give us

Account and profile. Name, username, email address, mobile number (verified with an OTP code sent over WhatsApp), profile and cover photo, and date of birth. Optionally you can add a bio, gender, city, height and weight, and your Instagram handle. Height and weight relate to your physical condition; fill them in only if you want to, and you can remove them at any time from Edit Profile. Your name, username, photo, bio, and city appear on your public profile; your email, mobile number, and date of birth do not.

Signing in. You sign in with an OTP code sent to your email, or with a Google or Apple account. If you use Google or Apple, we receive the name, email address, and profile photo from that account according to the permission you grant. Apple lets you hide your real email behind a relay address.

Activity registration. When you register for an activity, we process your choices (number of spots, seat, add-ons, voucher code, pass used), your answers to the registration form created by the Host, and your digital signature on a waiver if the Host requires one. Registration forms are created by Hosts; the Host is responsible for asking only what is relevant to its activity.

Participants you register. You can register other people, including your child, for an activity from your own account. The name and other details you enter for them are processed on the basis of your consent as their guardian or authorized person. See Section 9 on children's data.

Payments and balance. For payments, we keep the method you chose, the amount, the status, and the reference number from the payment partner. Card numbers, bank PINs, and e-wallet credentials are processed directly by the payment partner and are never stored on KUYY systems. For KUYY Balance withdrawals, we keep the bank name, account number, and account holder name confirmed by the bank. For KUYY Balance, we store your PIN as a hash.

Host data. If you are a Host: activity details, prices, schedules, locations, photos, branches, staff with their fees and payslips, passes and vouchers you issue, the content of the site you build in the Website Builder, and your earnings and payout history. Hosts on the Business plan can also upload personal documents for a Participant (report cards, certificates, assessment results).

Communications. The content of activity chats, chat channels, personal chats, and chats with kuyy_official, including attachments you send. Moments (photos or videos) you upload to an activity. Reports you file about an activity, Host, or another user.

Surveys and feedback. If you complete a survey or give feedback, we keep your answers.

Data collected automatically

Device and session. Device model, operating system and version, app version, language, time zone, IP address, push notification token, and session identifier. We record sign-in times and the device used to keep your account secure.

Location. With your permission, the app reads your device location to show activities near you, to fill in the location when you create an activity, and to verify attendance if the Host enables location-based check-in. Location is read only while that feature is in use and is not tracked in the background. You can revoke location permission in your device settings; features that depend on it will ask for a location manually.

App and website usage. Screens opened, buttons tapped, activities viewed, searches, and technical events (crashes, load times). In the app we use Firebase Analytics, Crashlytics, and Performance Monitoring from Google, and Meta App Events. On kuyy.app and kuyy.id we use Google Tag Manager to load our analytics and campaign measurement tools.

Cookies and similar technologies. Our websites use cookies that are necessary to keep you signed in and make the site work, plus analytics and marketing cookies and pixels loaded through Google Tag Manager. Section 10 explains how to limit them.

Host websites. Sites built by Hosts with the KUYY Website Builder may load the Host's own analytics and advertising pixels (Google Analytics, Meta Pixel, TikTok Pixel) that the Host configures. For that tracking the Host is the data controller; check the privacy policy of the Host concerned.

Notifications. We log the notifications, emails, and WhatsApp messages we send you and their delivery status.

Data from Threads

Threads posts about KUYY. KUYY's official Threads account (@kuyy.app) is connected to our team's internal tool through Meta's Threads API. Through that connection we read public Threads posts that mention @kuyy.app, replies under KUYY's own posts, and public posts that match topics we search for (for example, people looking for someone to run with). For each post we keep its author's username, the text, when it was posted, and its link. This applies whether or not you have a KUYY account; we do not link these posts to KUYY accounts.

3. WHY, AND ON WHAT LEGAL BASIS

The PDP Law requires every processing activity to have a legal basis. These are our purposes and their bases.

• Providing the service: creating your account, showing activities, processing registrations and payments, issuing e-tickets, running chat, paying out Hosts. Basis: performance of our contract with you (the Terms of Service).
• Verification and security: verifying your mobile number, preventing fraud and abuse, securing accounts, logging sessions, screening content that breaks the rules. Basis: our legitimate interests and those of other users, and legal obligations.
• Transactional notices: registration confirmations, activity reminders, e-tickets, invoices, payment notices, schedule changes, cancellations, and payouts, by push notification, email, and WhatsApp. Basis: performance of contract.
• Customer support: answering your questions through the kuyy_official chat and email, including with the automated KUYY AI assistant. Basis: performance of contract and legitimate interests.
• Answering on Threads: reading posts about KUYY or about activities KUYY can help with (Section 2), so our team can reply publicly from @kuyy.app. Every reply is written and posted by a person on our team, never automatically. Basis: legitimate interests in answering people who talk about KUYY and in managing KUYY's presence on Threads.
• Providing data to Hosts: showing the Participant list, form answers, payment status, and attendance to the Host of an activity you joined; providing participant statistics (including age and gender distribution in aggregate) in the Host's analytics plan. Basis: performance of contract; the Host processes it as a controller for its own purposes.
• Product improvement: analyzing usage, measuring performance, fixing errors. Basis: legitimate interests.
• Marketing by KUYY: sending information about features, promotions, and surveys by email or push notification. Basis: your consent, which you can withdraw at any time (Section 10).
• Marketing measurement: measuring the effectiveness of KUYY campaigns on Google and Meta platforms, without device advertising identifiers from the app. Basis: legitimate interests, with your right to object and limit it (Section 10).
• Legal obligations: keeping transaction and tax records, responding to lawful requests from law enforcement, meeting our duties as an Electronic System Operator. Basis: legal obligation.

We do not make decisions with legal effect on you solely by automated means without human review. Automated content screening only flags content for review; account closures are decided by our team.

4. WHO YOUR DATA IS SHARED WITH

We do not sell your personal data. We share it only in the following cases.

With Hosts and other Participants

With the Host of an activity you join: your name, username, profile photo, registration number, payment status, registration form answers, the waiver you signed, attendance status, and, if you enable it, your email address or mobile number for invoicing. Hosts can download their Participant list. Hosts use this data to run their activity and are responsible for how they use it outside KUYY.

With a Host's Participants: if you are a Host, your verified mobile number is included in the confirmation emails, reminders, and e-tickets sent to Participants who have joined, so they can reach you if something goes wrong on the day. This number does not appear on your public profile.

With other users: your public profile, the activities you host, and content you post to shared spaces (activity chat, channels, moments) can be seen by other users according to the privacy settings of the activity and your account. A Host can hide an activity's participant list.

With our service providers

The following parties process data on our instructions, under contract, and only to the extent of their function:

• Payments: Xendit, Midtrans, PT Bank Central Asia Tbk (including blu), PT Bank Mandiri (Persero) Tbk, GoPay, and the QRIS, OVO, and ShopeePay providers reached through those partners, to accept payments, verify bank accounts, and send withdrawals. Apple and Google for KUYY Premium and Business subscriptions bought through the App Store and Google Play.
• Messaging and email: Meta Platforms (WhatsApp Business Platform) for mobile number verification OTP codes, invoices, and activity notices over WhatsApp; Amazon Web Services (Amazon SES) for email, including sign-in OTP codes; Google (Firebase Cloud Messaging) for push notifications.
• Automated support assistant: OpenAI to generate KUYY AI replies in the kuyy_official chat. The content of your messages in that support conversation (up to the last 10 messages) is sent to OpenAI together with KUYY's official help documents. Your name, email, mobile number, and account data are not sent; if you type them into a message, they go with it. We use the OpenAI API service, which under its terms does not use API customer data to train models. You can skip the automated assistant by tapping "Chat to a real person".
• Threads reply drafts: OpenAI, to label the Threads posts in Section 2, score how useful a reply would be, and suggest a reply that our team then edits. Only the post's text, its author's username, and, for a reply under a KUYY post, that KUYY post's text are sent. We use the OpenAI API service, which under its terms does not use API customer data to train models.
• Support tickets: Atlassian (Trello) to log conversations escalated to our human support team. The ticket card contains your name, account identifier, category, the transaction or activity referred to, and the content of your message.
• Infrastructure: Google Cloud (Google Kubernetes Engine and Firebase) and Amazon Web Services (Amazon S3) for servers and storage; Cloudflare for networking, security, and Host site domains.
• Maps: Google Maps Platform to display and pick activity locations.
• Analytics and marketing: Google (Firebase Analytics, Crashlytics, Performance Monitoring, Google Tag Manager and the tools loaded through it) and Meta Platforms (Meta App Events), as described in Sections 2 and 10.

With AI apps a Host connects

If you are a Host on the Business plan and connect an AI app such as ChatGPT (OpenAI) or Claude (Anthropic) to your KUYY account, that app can read your business data on your instruction: sales, earnings, Activities, Participants' names and booking status, your Balance, its history and withdrawals (bank account numbers masked), staff with their classes and payslips, Passes, vouchers, and flash sales. The app receives no Participant or staff email addresses, phone numbers, form answers, or documents, and it cannot change anything. The AI app's provider processes that data as a separate controller under its own terms and privacy policy. Full reports download straight from your KUYY dashboard and never pass through the AI app. A Host can disconnect an app at any time in Settings > AI assistant.

With authorities and in other cases

• Law enforcement, courts, or government agencies, where required by law or in response to a lawful request.
• Legal advisers and parties to a dispute, to the extent needed to enforce our rights or respond to a claim.
• A party that acquires or merges with KUYY, in a merger, acquisition, or asset sale, with notice to you before your data becomes subject to a different privacy policy.
• In aggregated or anonymized form that cannot identify you, for statistics and research.

5. TRANSFERS OUTSIDE INDONESIA

KUYY's primary servers are in Indonesia (Jakarta) and Singapore. Some of the service providers in Section 4 process data outside Indonesia, mainly in the United States (Google, Meta, OpenAI, Atlassian, Amazon Web Services, Cloudflare, Apple) and Singapore.

In line with Article 56 of the PDP Law, we transfer data abroad only to providers bound by data processing agreements with an equal or higher level of protection, or on the basis of your consent for processing that is genuinely optional (marketing and tracking). You can ask for details of the safeguards in place through the contact in Section 1.

6. HOW LONG WE KEEP DATA

We keep personal data only as long as needed for the purposes in Section 3, then delete or anonymize it.

• Account and profile: while the account is active. After the account is deleted, profile data is deleted or anonymized within 30 days, except what we must keep under the points below.
• Transaction, payment, payout, and invoice records, and data needed for bookkeeping and tax: 10 years from the transaction, under the Company Documents Law and tax regulations.
• Activity registration data, forms, waivers, and attendance: for the activity and a reasonable claims period after it, and while the Host still needs it to run the activity; Hosts can delete Participant data on their side.
• Documents uploaded by a Host for a Participant: until deleted by the Host, or until the Participant's or Host's account is deleted.
• Chat content: while the owner's account is active. Support chats with kuyy_official are kept for 2 years from the last message for complaint handling.
• Technical logs, session data, and device-level analytics: 90 days for raw logs; aggregated analytics may be kept longer without personal identifiers.
• Records of a connected AI app's use (which tool it called, when, and how it ended, never the answer): 30 days.
• Threads posts in Section 2: they leave our team's queue after 3 days if nobody answers (except support questions) and are deleted 30 days after they were posted. For a post we answered, its author's username, text, and link are erased 90 days after the answer.
• Data tied to a report, dispute, or suspected fraud: until the matter is closed, plus the limitation period for claims.

7. SECURITY AND BREACH NOTIFICATION

We protect your data with encryption in transit (TLS), role-based access limits for our team, logging of staff access to user data, hashed storage of PINs and credentials, and separation of payment data to licensed payment partners. No system is completely secure; we fix vulnerabilities we find or that are reported to us.

If a personal data protection failure affects you, in line with Article 46 of the PDP Law we will notify you and the competent authority in writing no later than 3 x 24 hours after we become aware of it, stating what data was affected, when and how it happened, and the steps we have taken.

Keep your account safe: never share OTP codes or your PIN with anyone, including people claiming to be from KUYY. If you suspect someone else has accessed your account, contact us right away so we can end sessions you do not recognize.

8. YOUR RIGHTS

As a data subject you have the right to:

• Know the identity of the controller, the legal basis, and the purposes of processing your data (explained in this Policy).
• Access and obtain a copy of your personal data.
• Update or correct inaccurate data. Most profile data you can change yourself in Edit Profile.
• Delete or destroy your personal data, including by deleting your account (Section 12), except data we must keep under Section 6.
• Withdraw consent you have given, without affecting the lawfulness of processing before withdrawal.
• Object to processing based on legitimate interests or for marketing, and to solely automated decisions.
• Suspend or restrict processing in certain circumstances.
• Obtain and move your data in a common, machine-readable format.
• Sue for and receive compensation for violations in the processing of your personal data under applicable law.
• Lodge a complaint with the competent personal data protection authority.

These rights also cover your Threads posts that we keep under Section 2, even if you have no KUYY account. To have them deleted, contact us through the details in Section 1 with your Threads username.

To exercise these rights, contact us through the details in Section 1. We will verify your identity, usually by asking you to write from the email or account on file, and respond no later than 14 working days after we receive a complete request. We charge no fee except for repeated requests without reasonable grounds. Some rights may be limited where they conflict with our legal obligations or the rights of others; if so, we explain why.

9. CHILDREN'S DATA

A KUYY account may only be created by someone aged 18 or over. We do not collect data directly from children and do not market the service to children.

Many activities on KUYY are attended by children. Children's data enters KUYY in two ways: a parent or guardian registers the child from their own account, or a Host records the child's name (for example in the title of a report card document). In both cases, in line with Article 25 of the PDP Law, processing takes place with the consent of the parent or guardian, which we treat as given by the account holder who registers the child or receives documents for them. We limit the processing of children's data to running the activity concerned and do not use it for marketing or advertising profiles.

Hosts who collect children's data through registration forms are responsible for keeping their questions relevant and for obtaining the guardian's consent. A parent or guardian can request access to, correction of, or deletion of their child's data through the contact in Section 1.

If we learn that an account has been created by a child under 18, we close it and delete its data.

10. MARKETING, TRACKING, AND YOUR CHOICES

Marketing email. Every marketing email from KUYY contains an unsubscribe link. Transactional emails (confirmations, e-tickets, invoices, payment notices) continue to be sent because the service needs them.

Push notifications. Manage them from the notification settings in the app or your device settings. You can mute specific channels and chats without turning off transactional notices.

WhatsApp. Invoices and activity notices are sent over WhatsApp only if the Host enables it and you have a mobile number on your account. We do not send marketing messages over WhatsApp.

Tracking on the website. The analytics and campaign measurement tools on our website are loaded through Google Tag Manager when a page opens. To limit them, you can block third-party cookies in your browser, install the Google Analytics opt-out add-on, adjust ad personalization in Google Ads Settings and Meta's ad settings, or use private browsing. We are preparing a cookie settings control on the site so you can choose directly; this Policy will be updated when it is available.

Tracking in the app. The KUYY app does not request tracking permission (App Tracking Transparency) on iOS and does not share the device advertising identifier (IDFA or Advertising ID) with Meta or anyone else. Meta App Events and Firebase record usage events with an app installation identifier, not an advertising identifier. On Android you can still delete or reset your advertising ID from the Google settings on your device.

Public profile. You can make your account private from the account settings, so your activities and profile are visible only to followers you approve. Hosts can hide an activity's participant list.

11. USE OUTSIDE INDONESIA

KUYY is operated from Indonesia and your data is processed in Indonesia and in the countries listed in Section 5. By using KUYY from outside Indonesia, you understand this. Nothing here reduces the rights given to you by mandatory data protection law where you live.

Users in the United States

We do not sell your personal data for money. The campaign measurement tools loaded through Google Tag Manager on our website may amount to "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). You can opt out in the ways described in Section 10 or by sending a "Do Not Sell or Share My Personal Information" request to hello@kuyy.app; we will exclude your identifiers from those tools. The KUYY app does not share device advertising identifiers.

Residents of California and other states with comprehensive privacy laws have the right to know the categories of data we collect and why (Sections 2 and 3), to access, correct, and delete data (Section 8), to limit the use of sensitive data, and not to be discriminated against for exercising these rights. In the past 12 months we collected the categories of data listed in Section 2 and shared them with the parties listed in Section 4. We respond to verifiable requests within 45 days. You may designate an authorized agent to make a request on your behalf. Under California Civil Code Section 1798.83 you may also ask about disclosures of personal data to third parties for their direct marketing; we make no such disclosures.

Under the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal data directly from children under 13. Children's data enters only through a parent's or guardian's account as described in Section 9.

Users in the European Union, European Economic Area, and United Kingdom

The legal bases in Section 3 also apply under the GDPR and UK GDPR. Transfers of data outside the EEA and the UK are protected by standard contractual clauses approved by the European Commission or an equivalent mechanism. You have the right to lodge a complaint with the data protection authority in your country.

12. DELETING YOUR ACCOUNT AND DATA

You can delete your account at any time from the app: Edit Profile, the three-dot icon at the top right, Delete Account. The account is deactivated immediately and cannot be restored. Before deleting, withdraw your KUYY Balance, finish any activities in progress, and cancel your KUYY Premium subscription in the App Store or Google Play, because deleting the account does not cancel a subscription managed by the app store.

If you no longer have access to the app, send a deletion request to hello@kuyy.app from the email address on the account.

After the account is deleted, your profile is no longer accessible and your data is deleted or anonymized on the schedule in Section 6. Content you already shared to shared spaces (activity chat, moments) may remain visible to other users as content from a deleted account. Hosts can still see your registration and payment records for activities you joined, in the form needed for their bookkeeping.

13. CHANGES TO THIS POLICY

We may update this Policy as the service or regulations change. The latest version is always available at kuyy.app/about/privacy. For changes that materially affect your rights, we notify you by email or an in-app notice at least 7 days before they take effect. If you do not agree with the changes, stop using the service and delete your account.

14. LANGUAGE

This Policy is available in Indonesian and English. If the two versions differ in interpretation, the Indonesian version prevails.