Effective Date: March 7, 2026
Last Updated: March 7, 2026
Introduction
Buku.Menu (“we,” “us,” or “our”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use our platform—a link-in-bio and digital menu solution for food & beverage businesses in Indonesia.
This policy complies with Indonesia’s Personal Data Protection Law (UU PDP No. 27/2022) and international best practices for SaaS platforms.
Definitions
Legal Basis for Data Processing
We process your personal data based on the following legal grounds as required by UU PDP No. 27/2022:
Information We Collect
Business Owner Data
When you register as a business owner, we collect:
| Category | Data Types |
| Identity Data | Business name, owner name, brand logo, business type (restaurant, cafe, cloud kitchen, etc.) |
| Contact Data | Email address, phone number (WhatsApp), business address (per branch), social media handles |
| Financial Data | Payment method details (for subscription), billing address, transaction history |
| Business Data | Branch locations, operating hours, menu items (names, descriptions, prices, images), facilities (parking, prayer room, etc.), service types (dine-in, delivery, take-away) |
| Marketing Data | Promotional content, campaigns, special offers, referral program participation |
| Technical Data | IP address, browser type, device information, login timestamps, usage patterns |
Table 1: Business Owner Personal Data Categories
Customer Data
When customers view business profiles, we collect:
Influencer/Content Creator Data
Automatically Collected Data
Our platform automatically collects:
How We Use Your Information
Primary Purposes
Data Sharing and Disclosure
Third-Party Service Providers
We share data with trusted partners who help us operate the platform:
| Category | Purpose | Examples |
| Hosting | Infrastructure | Cloudflare Workers, cloud storage providers |
| Database | Data storage | Supabase |
| Analytics | Usage tracking | Google Analytics, Meta Pixel (if applicable) |
| Payment | Transaction processing | Payment gateway providers |
| Communication | Email/SMS | Email service providers, WhatsApp Business API |
| Authentication | Account security | OAuth providers (Google, Facebook login) |
Table 2: Third-Party Data Processors
All third parties are contractually bound to protect your data and only use it for specified purposes.
Business Transfers
If Buku.Menu is involved in a merger, acquisition, or asset sale, your data may be transferred. We will notify you before this occurs and your data becomes subject to a different privacy policy.
Legal Requirements
We may disclose your data when required by law, to:
Public Information
The following data is publicly accessible on your business profile:
Data Security
We implement industry-standard security measures to protect your information:
Technical Safeguards
Organizational Safeguards
Data Breach Protocol
In the event of a data breach, we will:
Your Rights Under UU PDP
As a data subject in Indonesia, you have the following rights:
Right to Information
You have the right to know what personal data we collect and how it is used.
Right of Access
You can request a copy of your personal data at any time by contacting us.
Right to Rectification
You can update or correct inaccurate information through your account dashboard or by contacting us.
Right to Erasure
You can request deletion of your personal data. We will comply unless we have legal grounds to retain it (e.g., for accounting purposes, legal disputes).
Right to Withdraw Consent
You can withdraw your consent for data processing at any time. This may affect your ability to use certain features.
Right to Object
You can object to automated decision-making or profiling that significantly affects you.
Right to Restrict Processing
You can request that we limit how we use your data in certain circumstances.
Right to Data Portability
You can request your data in a structured, machine-readable format (e.g., JSON, CSV) to transfer to another service.
How to Exercise Your Rights
To exercise any of these rights, contact us at:
We will respond within 10 business days as required by UU PDP.
Data Retention
We retain your data for the following periods:
| Data Category | Retention Period |
| Active account data | Duration of subscription + 1 year |
| Inactive account data | 2 years after last activity, then deleted |
| Transaction records | 10 years (tax/accounting requirement) |
| Analytics data (anonymized) | 3 years |
| Customer service logs | 2 years |
| Security logs | 1 year |
| Marketing consent records | Until consent withdrawn + 1 year |
Table 3: Data Retention Schedule
After retention periods expire, we securely delete or anonymize your data.
International Data Transfers
While Buku.Menu primarily serves Indonesian users, some of our service providers may be located outside Indonesia (e.g., cloud hosting). When we transfer data internationally, we ensure:
Countries where data may be processed: United States (Cloudflare, analytics providers), Singapore (regional data centers).
Cookies and Tracking Technologies
What Are Cookies?
Cookies are small text files stored on your device that help us provide and improve our services.
Types of Cookies We Use
| Type | Purpose |
| Essential | Required for platform functionality (login sessions, security) |
| Analytics | Help us understand how users interact with the platform (Google Analytics) |
| Preference | Remember your settings (language, display options) |
| Marketing | Track campaign effectiveness (optional, with consent) |
Table 4: Cookie Categories
Managing Cookies
You can control cookies through:
Note: Blocking essential cookies may prevent platform functionality.
Children’s Privacy
Buku.Menu is not intended for children under 17 years old. We do not knowingly collect data from children. If we discover we have collected data from a child, we will delete it immediately.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us.
Changes to This Privacy Policy
We may update this policy periodically to reflect:
When we make significant changes:
Previous versions of this policy are available upon request.
Contact Information
Data Protection Officer
For questions, complaints, or to exercise your rights:
Regulatory Authority
If you are not satisfied with our response, you have the right to lodge a complaint with:
Special Provisions
For Business Owners Using WhatsApp Integration
When you connect WhatsApp Business to Buku.Menu, customer messages go directly to your WhatsApp—we do not intercept or store these conversations. WhatsApp’s own privacy policy applies to these interactions.
For Users of OAuth/Social Login
If you sign in using Google or Facebook, we only receive basic profile information you authorize (name, email, profile photo). We do not access your social media content or contacts.
For Payment Processing
We do not store your full credit card details. Payment information is processed securely by our payment gateway partners who are PCI-DSS compliant.
For Analytics and Marketing
You can opt out of marketing communications at any time by:
Opting out of marketing does not affect service-related communications (e.g., subscription renewals, security alerts).
Acknowledgment and Consent
By using Buku.Menu, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, please discontinue use of our platform.
For business owners: By creating a profile, you confirm you have the right to share business information (including employee data if applicable) and customer data displayed on your profile.
Appendix A: Glossary of Technical Terms
Appendix B: Document Control
| Version | Date | Changes |
| 1.0 | March 7, 2026 | Initial policy release |
Table 5: Version History
Next Review Date: March 7, 2027