Privacy Policy

Last updated: 23 October 2026

This policy explains how Sambutku ("we"), the operator of Sambutku, collects, uses, stores and protects personal data, in line with Indonesia's Personal Data Protection Law, Law No. 27 of 2022 ("UU PDP").

1. Who we are and our role

Sambutku is a service for QR menus, ordering from the table, waiting lists, number queues, room booking and appointments for businesses such as restaurants, offices, clinics and salons ("clients").

• For the accounts of clients and their staff, and for visitors of this website, we are the data controller.
• For the data of a client's guests and customers (for example the name and WhatsApp number on a waiting list or for an appointment), the client is the data controller and we are the data processor, processing that data on the client's behalf and instructions. Questions about that data are best asked to the business concerned; we help them answer.

2. The data we process

Clients and their staff

• Name, e-mail address, phone number, password (stored as a hash that cannot be read), preferred language, role (owner, manager or staff) and two-step verification settings (stored encrypted).
• Business data: name, address, tax number (if given), logo, menu, services, staff, rooms and other settings.
• Billing data: package, subscription periods, invoices and payments.

Guests and customers of clients

Only what the feature in use needs, erased automatically:

• Waiting list: name, group size and WhatsApp number; the name and number are erased after 30 days.
• Number queue (offices): no personal data, only the queue number.
• Ordering from the table: the order and a name (optional); the name is erased after 30 days.
• Appointments: name, WhatsApp number, service and time; the name and number are erased 90 days after the appointment.
• Room booking: name, WhatsApp number and, optionally, organisation, purpose and number of people; erased 90 days after the booking.
• Automatic WhatsApp (if the client uses it): the number and the text of the message; erased from our records after 30 days.
• Phone notifications (only if the guest allows them): the browser's notification address, valid for that queue number only.

Queue numbers, orders and statistics (for example the number of QR code scans per day) are kept without anything that identifies a person.

All users and website visitors

• Technical data: IP address, browser type, pages opened and when, in the server logs for 14 days, for security and to fix errors.
• Website visit statistics (home, prices, privacy policy and terms): the pages opened, where visitors came from, device and browser type, country and page speed, through Cloudflare Web Analytics, without cookies and without identifying visitors. These statistics are not used on guest pages or dashboards.
• Cookies: see section 7.

3. Purposes and legal bases

• Running the service for clients and their guests: performing our agreement with the client; for guests, the consent given in the form or the client's legitimate interest in serving its guests.
• Necessary e-mails: subscription reminders, invoices, notices of booking requests and the monthly report (which can be switched off on the profile page).
• Security: preventing abuse (for example limits on the number of attempts), detecting errors and making backups.
• Improving the website: cookie-free visit statistics, to learn which pages are read and where visitors come from; legal basis: legitimate interest.
• Legal obligations, for example keeping invoices as tax regulations require.

We do not sell personal data, do not use it for advertising, and do not put third-party analytics or trackers on guest pages.

4. Who receives data

We use these providers to run the service. They only process data for us and are bound to confidentiality:

• Google Cloud: servers and backups, located in Jakarta, Indonesia.
• Cloudflare: network and website security, and website visit statistics (Cloudflare Web Analytics); requests (including IP addresses) pass through its network.
• Brevo: sending e-mail.
• Sentry: technical error reports, so we can fix problems. They come from our servers and, passed on by our own server, from guest pages (menu, order and queue pages, kiosks and TV screens): the error message, where in the program it happened, the kind of page, and the browser and its version. These reports contain no names, phone numbers, e-mail addresses, form contents, IP addresses or guests' personal links.
• Meta Platforms (WhatsApp) or Fonnte: only if the client uses automatic WhatsApp.
• Browser notification services (Google, Apple, Mozilla): only if a guest allows notifications.

We may also disclose data when the law or a competent authority requires it.

5. Transfers outside Indonesia

Data is stored in Indonesia. Some of the providers above (Cloudflare, Brevo, Sentry, Meta and browser notification services) may process data outside Indonesia. We only use providers that offer an equal or higher level of protection, as Article 56 of the UU PDP requires.

6. How long data is kept

• Guest data: erased automatically after the periods in section 2.
• Client account data: for as long as the subscription runs. After it ends, the data stays so the client can continue, unless the client asks us to delete it.
• Invoices and payment records: as long as tax regulations require (currently 10 years).
• Server logs: 14 days. Backups (encrypted): 30 days.

7. Cookies

We only use cookies the service needs to work: session and security cookies (login and form protection), cookies that remember your queue number, order or booking on this phone, and a language cookie. We use no advertising or tracking cookies.

8. Security

Connections are always encrypted (HTTPS). Passwords are stored as hashes, secrets such as tokens are stored encrypted, platform admins must use two-step verification, access is limited by role, and backups are encrypted. If personal data protection fails, we notify the client, the people affected and the competent authority in writing within 3 × 24 hours, as Article 46 of the UU PDP requires.

9. Your rights

Under the UU PDP you have the right to:

• be informed about the processing of your personal data;
• access your personal data and receive a copy;
• correct inaccurate data;
• have your personal data erased;
• withdraw your consent;
• suspend or restrict processing, and object to it.

Contact us (section 11). We respond within the periods the UU PDP sets. For your data as a guest of a business, you can also contact that business directly.

10. Children

The service is not designed to collect children's data. Children under 18 should ask a parent or guardian to fill in forms (for example a booking or the waiting list).

11. Contact

Sambutku
E-mail: [email protected]

12. Changes

We may update this policy. We announce important changes to clients by e-mail; the date above shows the latest version. This policy is written in Indonesian and English; if they differ, the Indonesian version prevails.