This policy explains how IndoWaris, operated by PT Indo Smart Media ("we"), Jalan Crusher No. 26, Arcamanik, Bandung 40293, Indonesia, as the data controller, collects, uses, shares and protects your personal data in accordance with Indonesia's Law No. 27 of 2022 on Personal Data Protection (PDP Law).
By registering or using IndoWaris you confirm that you have read this policy. If you do not agree, please do not use our service.
Summary
- We only collect the data needed to run the family-tree and inheritance service.
- Your family case data is visible only to you as the account owner.
- We never sell or rent personal data, and we use no advertising cookies.
- Document files you upload for the AI to read are not stored.
- You can delete a case or your whole account at any time from your Profile.
1. Data we collect
a. Account data
- Full name, email address and phone number (required at sign-up).
- Password — stored only as a bcrypt hash, so even we cannot see it.
- Email verification status, language preference, time and IP address of your last sign-in.
b. Family data you enter
- Names of family members, gender, dates of birth and death, religion (Muslim or not, because it affects inheritance rights), family relations, marital status, estate value (optional), national ID number (optional) and notes.
- Data extracted by the AI from documents that you approve for saving.
c. Conversations with IndoWarisVA
- Questions and the assistant's answers, including from visitors who are not signed in.
- Visitors receive a random visitor identifier (cookie
iw.vid) that contains no name or email. If the same browser later registers or signs in, the identifier is linked to that account so the conversation history can be analysed as a whole.
d. Technical and security data
- IP address, browser/device type, the page you were on when asking, and activity logs (e.g. sign-ins, data changes, downloads) for security and auditing.
e. Payment data (if paid services are enabled)
- Invoice number, service, amount and payment status. Your card or bank details are processed directly by Xendit and never pass through or are stored on our servers.
f. Contact-form messages
- The name, email, subject and message you send us.
2. Why we use your data
| Purpose | Data used |
|---|---|
| Creating and securing your account, including email verification | Account data, technical data |
| Building the family tree, calculating inheritance, producing downloads | Family data |
| Answering questions and guiding you through IndoWarisVA | Your question, summary of the open case |
| Reading documents (Family Card, ID card, death certificate) at your request | Content of the uploaded document |
| Improving service quality and internal analysis of AI usage | IndoWarisVA conversation log, visitor identifier |
| Sending service emails (verification, password reset) | Name, email |
| Internal notifications to our team (new sign-ups, payments, contact messages) | Name, email, phone number, transaction/message details |
| Processing payments | Payment data |
| Preventing abuse (sign-in attempt limits, AI usage limits) | Technical data |
We do not use your data for advertising, do not build marketing profiles, and do not make automated decisions with legal effects on you.
3. Legal bases
- Consent you give at sign-up, when using IndoWarisVA and before uploading documents.
- Performance of the service agreement described in the Terms & Conditions.
- Legitimate interests in keeping the system secure and improving the service.
- Legal obligations, where the law requires it.
You are responsible for the family members' data you enter: make sure you are entitled to process it, for example as an heir or with the consent of the family members concerned.
4. Processing with artificial intelligence (AI)
- IndoWarisVA and document reading use a third-party AI service whose servers may be located outside Indonesia (cross-border transfer).
- When you ask a question we send it together with a summary of the open case: names, gender, birth/death dates, family relations and results. National ID numbers and private notes are not sent.
- When you upload a document, its content is sent to the AI service to be read and processed in memory. We do not store the original file. Photos are re-encoded so location metadata (EXIF/GPS) is removed. Extracted data enters your case only after you review and approve it.
- AI features run only when you use them. IndoWaris is fully usable without them.
- Inheritance shares are always computed by the IndoWaris engine, not by the AI.
5. Who may receive data
We share data only as needed with service providers who help us, under confidentiality obligations:
- Server provider hosting the application and database.
- AI service provider for IndoWarisVA and document reading (see section 4).
- Email service provider for verification and password-reset emails.
- Messaging service for internal notifications to the operating team (e.g. a new sign-up or payment). These messages are received only by our internal team.
- Xendit, a licensed payment gateway, if paid services are enabled.
- Competent authorities, only where required by law.
Some of these providers may process data outside Indonesia. We choose providers that apply adequate data protection standards.
6. Security
- All connections use HTTPS (encrypted in transit).
- Passwords are hashed with bcrypt; service secrets (payments, email, notifications) are encrypted with AES-256-GCM.
- Each case can be opened only by its owner; administrators cannot open case contents from the admin panel.
- Form protection (CSRF tokens), rate limiting and temporary account lock-out after repeated wrong passwords.
- Administrative actions and important activity are recorded in an audit log.
No system is completely immune. If a personal data protection failure occurs, we will notify you and the competent authority as required by the PDP Law.
7. Retention
| Data | Kept |
|---|---|
| Account and case data | While the account is active. You can delete cases at any time. |
| Document files uploaded to the AI | Not stored — processed in memory only. |
| IndoWarisVA conversations in your account | Until you press "Start a new conversation" or delete the account. |
| Conversation log for analysis | Kept for internal analysis. When the account is deleted, its link to your account is removed. |
| Security and audit logs | As long as needed for security and legal obligations. |
| Payment records | While the account is active; deleted together with the account. |
Deleting your account: go to Profile → Delete account and confirm with your password. The account and all its cases, family members and conversations are removed from the application database immediately.
8. Your rights as a data subject
Under the PDP Law you have the right to:
- be informed about how your data is processed;
- access your personal data and obtain a copy;
- correct inaccurate data (most of it you can edit directly in the app);
- erase data and end processing;
- withdraw consent;
- restrict or suspend processing;
- object and lodge complaints.
Send requests to info@indowaris.com from your registered email. We may ask you to verify your identity first and will respond within the period set by the PDP Law.
9. Cookies and on-device storage
| Name | Purpose | Duration |
|---|---|---|
iw.sid | Sign-in session and form security | Up to 7 days after last activity |
lang | Remembers your language | 1 year |
iw.vid | Random visitor identifier for the IndoWarisVA conversation log | 2 years |
The site may also cache display files (CSS, images) in your browser so it loads faster. We use no advertising cookies or third-party trackers.
10. Children
IndoWaris is intended for adults. Users under 18 must use the service with the consent and supervision of a parent or guardian. Children recorded as family members in a case are processed solely for the account owner's inheritance calculation.
11. Changes
This policy may be updated as the service or regulations change. Changes are published on this page with the update date shown at the bottom. We will also announce significant changes by email or in the app.
12. Contact
Privacy questions and data subject requests can be sent to:
- PT Indo Smart Media — Jalan Crusher No. 26, Arcamanik, Bandung, West Java 40293, Indonesia
- Email: info@indowaris.com · Phone/WhatsApp: +62 811-9629-391
Last updated: 2026-09-26