Privacy Policy

EMAN EMAN ("we", "our", "the App") respects your privacy. This Privacy Policy explains what personal data we collect through the EMAN EMAN application and website, why we collect it, how we use and protect it, and what rights you have over it — in accordance with Indonesia's Law No. 27 of 2022 on Personal Data Protection ("UU PDP").

By registering an account or using the EMAN EMAN application, you agree to the collection and use of information in accordance with this policy.

1. Data We Collect

a. Account data (User)

• Name, email address, phone number
• Password (stored as a one-way hash — we never see or store your actual password)
• Profile photo (optional)

b. Account data (Merchant)

• Business name, address, phone number, email, business photo
• Bank account information (for commission settlement — see Section 3)

c. Location data

• Approximate device location, used only to show nearby food listings and search radius
• Merchant location, shown publicly on the map so buyers can find them

d. Transaction & activity data

• Order history, pickup codes, payment status, promo codes used
• Chat messages and photo attachments between buyers and merchants
• Reviews and ratings you submit for merchants
• Points balance and savings statistics calculated from your order history

e. Technical data

• Push notification token (FCM), used solely to deliver notifications to your device
• Basic website visit logs (hashed IP address, page visited) for public website statistics only

f. Biometric data

If you enable fingerprint login, your session token is encrypted using a key stored in your device's own secure hardware (Android Keystore). Your fingerprint data itself never leaves your device and is never sent to or stored on our servers.

2. Legal Basis & Consent

We process your personal data based on your explicit consent given at registration, and where necessary to perform our contract with you (processing your orders), comply with legal obligations, or pursue our legitimate interest in operating and improving the platform. You may withdraw consent at any time by deleting your account (Section 6).

3. How We Use Your Data

• To create and secure your account, and verify your identity
• To process food orders, payments, and commission settlements with merchants
• To enable communication (chat, voice call) between buyers and merchants
• To send you relevant push notifications (order updates, new listings, messages)
• To calculate and display your savings impact and loyalty points
• To maintain platform security and prevent fraud

We do not sell your personal data to third parties, and we do not use your data for targeted advertising.

4. Sharing Data with Third Parties

To operate the App, certain data is shared with trusted service providers, strictly limited to what each service needs to function:

• Midtrans (payment processor) — receives order amount and your name/email to process GoPay/QRIS payments. Midtrans has its own privacy policy governing payment data.
• Firebase Cloud Messaging (Google) — receives your device's push notification token to deliver notifications.
• Agora (voice call infrastructure) — facilitates the audio connection for in-app calls; call audio is not recorded or stored by us.

We do not share your data with any other third party except where required by law.

5. Data Security

We apply reasonable technical and organizational measures to protect your data, including: password hashing, encrypted session tokens, hashed verification/reset codes with expiry limits, HTTPS encryption in transit, and restricted database access. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights

In accordance with the UU PDP, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data — via the "Edit Profile" menu in the app
• Delete your account and associated data — via the "Delete Account" menu in the app, or by contacting us directly
• Object to certain processing of your data
• Withdraw consent at any time

When you delete your account, personal identifiers are permanently removed or anonymized, except where we are legally required to retain certain transaction records (e.g., for financial reporting/tax purposes).

7. Data Retention

We retain your personal data for as long as your account is active, or as needed to provide services to you. Order and invoice records related to financial reporting obligations may be retained for a longer period as required by applicable law, even after account deletion.

8. Children's Privacy

EMAN EMAN is not directed at children under the age of 13, and we do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us via the WhatsApp number listed on our homepage, or through the in-app support menu.