This policy explains how IndoWaris, operated by PT Indo Smart Media ("we"), Jalan Crusher No. 26, Arcamanik, Bandung 40293, as data controller, processes your personal data in line with Indonesian Law No. 27 of 2022 on Personal Data Protection.
1. Data we collect
- Account data: name, email, phone (optional), password (stored as a bcrypt hash).
- Family data you enter: names, gender, birth/death dates, relationships, national ID numbers (optional) and notes.
- Technical data: IP address, browser type and activity logs for security.
2. Purposes
- Providing the family tree, inheritance calculation and document services.
- Keeping accounts secure (suspicious login detection, attempt limits).
- Processing payments when paid services are enabled (via Xendit).
3. Legal basis
Your consent at registration, performance of the service agreement, and our legitimate interest in system security. You are responsible for ensuring you are entitled to enter the family members' data.
3a. Artificial intelligence (AI) processing
- IndoWarisVA and document reading use a third-party AI service whose servers may be located outside Indonesia (cross-border transfer).
- When you ask IndoWarisVA a question we send your question and a summary of the open case (names, gender, birth/death dates, family relations and results). National ID numbers and private notes are not included.
- IndoWarisVA questions and answers are logged (including from visitors who are not signed in, identified by a random visitor cookie) to maintain service quality and for internal analysis. Only IndoWaris administrators can see these logs; they are not sold or shared.
- When you upload a document (Family Card, ID card, death certificate) its content is sent to that AI service to be read. We do not store the original file; only the extracted data is kept, and it enters your case only after you review and approve it.
- AI features run only when you use them, with consent requested before uploading documents. You can use IndoWaris without AI.
4. Security
- All traffic uses HTTPS; passwords are hashed; payment keys are AES-256 encrypted.
- Case data is accessible only to its owner; administrative actions are logged.
- We never sell or rent your personal data.
5. Sharing
Data is shared only with required processors (hosting in Indonesia, Xendit payment gateway, email provider) under confidentiality obligations, or when required by law.
6. Retention
Data is kept while your account is active. You may delete cases at any time; deleting your account removes all data within 30 days, except records the law requires us to keep.
7. Your rights
You may access, correct, delete, restrict processing, withdraw consent and request a copy of your data. Contact us via the Contact page.
8. Cookies
We only use strictly necessary cookies: login session, security token (CSRF) and language preference. No advertising cookies.
9. Changes
Changes will be announced on this page together with their effective date.
Last updated: 2026-09-26