Privacy Policy

We collect the following categories of information:

1.1 Information you provide directly. When you register an account, we collect your name, email address, and a hashed representation of your password. We do not store passwords in plain text.

1.2 Business information. When you operate a restaurant on the Service, we collect business profile data including outlet name, address, contact details, branding assets, menus, pricing, operating hours, and other content you choose to upload or configure.

1.3 Transactional information. We process records of orders placed through your digital menus, payment events handled via Makan Pay, subscription invoices, refunds, and supporting metadata required for accounting and audit purposes.

1.4 Technical and usage information. We automatically collect device identifiers, IP address, browser type and version, operating system, referring URLs, pages viewed, timestamps, and feature interactions. This information is used to operate, secure, and improve the Service.

1.5 Marketing attribution. We remember how you first reached our site: the website you came from, the page you landed on, and any campaign tags in the link (UTM values, the Google Click Identifier (gclid) and Facebook’s click identifier (fbclid)). We keep this in a first-party cookie for up to 30 days and, when you create an account, store it with your account for the limited purpose of learning which channels bring customers and measuring campaign performance. We do not do this if you decline analytics or your browser sends a Do-Not-Track or Global Privacy Control signal. Deleting your account deletes this record, and you can clear the cookie at any time in your browser. If you answer the optional setup question “Where did you hear about Makan?”, or tell us during setup that you work at a restaurant that already uses Makan, we keep your answers with your account to learn how restaurant owners find Makan; our team sees where you heard about Makan when you create a restaurant. We delete these answers when you delete your account; the message our team already received about a restaurant you created is not recalled.

We use the information described above for the following purposes:

• To provide, maintain, and improve the Service and its features;
• To create and manage your account and authenticate sessions;
• To process subscription payments, issue invoices, and prevent payment fraud;
• To send service-related communications such as security alerts, password resets, and order confirmations;
• To send a few onboarding emails that help you finish setting up your restaurant (at most two per step, each with an unsubscribe link);
• To respond to inquiries and provide customer support;
• To detect, investigate, and prevent fraudulent, unauthorised, or abusive activity;
• To measure the effectiveness of our marketing and product initiatives in aggregate;
• To comply with applicable legal, regulatory, and tax obligations.

We do not sell your personal data, and we do not disclose your personal data to third parties for their independent marketing purposes.

We process personal data on one or more of the following legal bases recognised under Law No. 27 of 2022 on Personal Data Protection (UU PDP) and applicable regulations:

• Performance of the contract under which we provide the Service to you;
• Compliance with legal obligations to which we are subject;
• Our legitimate interests in operating, securing, and improving the Service, and in offering Makan to businesses that publish their contact details (see section 6), where such interests are not overridden by your rights and freedoms;
• Your consent, where required and obtained.

To deliver the Service, we engage trusted third-party providers under written agreements that require appropriate confidentiality, security, and data protection commitments. These providers process personal data only on our instructions and for the purposes set out below:

• Cloudinary — image and asset hosting for menu and brand content;
• Pusher — real-time delivery of order and kitchen notifications;
• Resend — delivery of transactional email;
• Amazon Web Services — cloud hosting, encrypted backups, and object storage;
• Google Analytics 4 and Google Ads — analytics and conversion measurement, limited to our marketing pages;
• Anthropic and OpenAI — AI models used to score how well Makan may suit a business and to write the first line of the outreach messages described in section 6;
• Telegram — delivery of the daily list of outreach messages to our team (see section 6).

Some of these providers operate servers outside of Indonesia. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with UU PDP and any subsequent implementing regulations.

We use a limited set of cookies and browser storage mechanisms:

• Strictly necessary — session cookies required to authenticate users and operate core features;
• Functional — preferences such as language and interface settings;
• Marketing attribution — a first-party cookie that remembers how you first reached our site, for up to 30 days (see section 1.5);
• Outreach link — a first-party cookie that is set only when you open a link in a message we sent you, and only if you have not declined analytics and your browser does not send a Do-Not-Track or Global Privacy Control signal. It holds only a random identifier, lasts 30 days, and is used to tell us you came from our message when you sign up (see section 6);
• Analytics — Google Analytics 4 may set cookies, and only on our public marketing pages.

We do not use third-party advertising cookies inside the authenticated dashboard. You can control cookies through your browser settings; disabling strictly necessary cookies may impair functionality.

This section is for people who do not use Makan. If your business lists a phone number in a public business listing on an online map, we may contact you to offer Makan. The retention periods in section 7 are for Makan accounts; the periods for business contacts are set out below.

6.1 Where the data comes from. We find businesses in public business listings on maps, and we collect the listing data through a scraping provider, Apify. Apify runs the collection for us and keeps the listing data until we have imported it, or until its own retention period ends.

6.2 Data we keep. For each business we keep:

• The business name and category, and the city or neighbourhood of the listing (we do not keep the street address);
• The phone number and website;
• The rating and the number of reviews;
• The place identifier of the listing;
• The message we prepared for you and the date it was sent; and
• If you reply to us, a lead record with your business name, phone number, and our conversation (see 6.5 below).

6.3 Why we use it. We use this data for the following purposes:

• To offer Makan to your business by WhatsApp, in a message sent by a person on our team;
• To calculate an automated fit score that estimates how well Makan may suit your business;
• To have an AI model write the first line of the message from the listing data;
• To record whether the link in our message was opened and, if you later sign up for Makan in the same browser, to match the sign-up to your business;
• If you reply, to keep a lead record so that our team can answer you.

6.4 Legal basis. Our intended legal basis under UU PDP is legitimate interest: our interest in offering Makan to businesses that publish their contact details, where that interest is not overridden by your rights and freedoms.

6.5 How long we keep it. These periods are counted in whole days and our cleanup runs once a day, so an erase can come up to a day later than the period shown. We often erase sooner.

• A business we never put on our list of messages to send is deleted no later than 30 days after we found it;
• For a business we put on that list but have not messaged, we erase the details we hold about it (such as name, phone number, website, and message) no later than 90 days after it was put on the list;
• For a business we have messaged, we erase those details no later than 180 days after the message was sent (or, if we have no send date, 180 days after we put it on the list or found it);
• When you ask us to stop, we remove your details at once from our list of businesses, from any lead record (see below) unless the lead record is linked to a Makan account, which is handled with account deletion (section 7), and from any stored copy of the daily list.

After the details are erased we keep the place identifier of the listing, the automated fit score and segment we gave it, the search we found it by, the link to any account or lead record that came from it, the reason we set it aside if we did, and the counts and dates of each step (for example when a message was sent), so that we do not collect the same listing again and can measure how the outreach performs. If you ask us to delete your data, we delete that record entirely instead. A do-not-contact record of your phone number and place is kept so that we do not contact you again.

If a business replies to us, we also keep a lead record with its business name, phone number, and the conversation, so that our team can answer it. We handle it with the rest of our sales leads, so the periods above do not erase it and it stays until we delete it. When you ask us to stop, we remove the name, business name, phone number, and email from it and close it, unless the lead record is linked to a Makan account, which is handled with account deletion (section 7). When you ask us to delete your data, we also remove its identifiers and the conversation recorded in it.

The daily list of messages for our team is stored in a queue until it is delivered. When you ask us to stop or to delete your data, we blank your details in any stored copy of that list; otherwise a stored copy is blanked after 7 days, whether or not it was delivered. A message already delivered to our team's Telegram chat stays there until our team deletes it, which we do by hand when you ask us to delete your data. Copies in our logs expire within 14 days.

6.6 Who receives it. To score listings and write the first line, we send listing data to AI providers, Anthropic and OpenAI, and the daily list of messages for our team to send is delivered through Telegram. These providers may process data outside Indonesia under the safeguards we select. Section 4 lists them too.

6.7 Stopping, and seeing or deleting your data. Every message names PT. Biissa Maju Bersama, tells you where we found your number, and ends with a line that lets you reply STOP or BERHENTI. If you do, we will not contact you again. You can also email admin@biissa.com to see or delete the data we hold about you, to tell us that something is wrong (we then remove the record), or to ask us to stop. You may also ask us to explain why we rely on legitimate interest as the legal basis for processing your data, and we will answer in writing.

We retain personal data for as long as your account remains active and for such additional period as is reasonably necessary to fulfil the purposes set out in this Policy or as required by applicable law. Upon account deletion, we will delete or irreversibly anonymise your personal data within thirty (30) days, except where:

• Retention is required by Indonesian tax, accounting, or anti-money laundering legislation (typically up to ten (10) years for financial records); or
• Retention is necessary for the establishment, exercise, or defence of legal claims.

Subject to and in accordance with UU PDP, you have the right to:

• Obtain confirmation as to whether we process your personal data and access a copy of such data;
• Request correction or completion of inaccurate or incomplete data;
• Request deletion of your personal data;
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal;
• Object to or request restriction of certain processing activities;
• Receive your personal data in a structured, commonly used format (data portability);
• Lodge a complaint with the competent supervisory authority.

To exercise these rights, please contact us at admin@biissa.com. We will respond within the period required by applicable law.

We implement administrative, technical, and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These safeguards include encryption of data in transit using TLS, encryption of backups at rest, password hashing, role-based access controls, audit logging, and regular review of our security posture. While we work to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is intended for use by businesses and the adults operating them. It is not directed to children under the age of 13, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at admin@biissa.com and we will take appropriate steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes to our practices, the Service, or applicable law. Where changes are material, we will provide reasonable advance notice through the Service or by email. The “Effective date” at the top of this Policy indicates when the current version took effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For questions, requests, or complaints regarding this Privacy Policy or our processing of your personal data, please contact:

PT. Biissa Maju Bersama
Email: admin@biissa.com
Website: makan.biissa.com