Cookies notice
The cookie page expands on the tracking section here. Both pages use the same category labels — essential, functional, analytics — so consent choices line up wherever you make them.
LEGAL REFERENCE
Privacy Policy for Your to388 login Account
This is how we look after the data tied to your to388 login account. We explain what we collect when you open the lobby, what we store for...
Data handlingCookiesAccount recordsYour rightsContact paths
Our Policy Posture and Scope
We process your personal data only where local law permits and only inside supported regions for Indonesia. The categories we hold are limited to what your account needs: identity fields you give us at signup, device and session signals when you load the lobby, and transaction references when you fund the account via DANA, OVO, GoPay or QRIS. We do not sell
your data. We share it with payment processors and licensed auditors strictly to settle balances and meet our reporting duties. You can request access, correction or deletion of your records through the contact paths below, and we will respond within the windows set by the jurisdiction that applies to your account.
Service availability is jurisdiction-dependent. Users are responsible for checking local law before access.
REVIEW SIGNALS
How We Keep This Policy Honest
Named reviewers
Every clause on this page is signed off by a named privacy reviewer on our side, not an anonymous template...
Annual refresh
We revisit the full policy once a year, and sooner if Indonesian rules shift or our processors change. The header...
Plain wording
We write in plain English-ID rather than legalese. If a sentence needs a defined term, we define it on the...
Processor list
We keep a current list of third parties that touch your data — payment rails, KYC checkers, hosting partners. Ask...
Breach protocol
If something goes wrong, we tell affected account holders within the legal window and explain what was exposed, what we...
Independent audit
Our security controls are audited by an outside firm each year. The summary letter is available on request and informs...
BENCHMARKED
Consistency Across Our Policy Pages
Terms of service
Terms govern your account contract; this policy governs your data. Where the two overlap on identity checks, the wording is mirrored word-for-word to avoid confusion.
KYC notes
The KYC page lists which documents we request. This policy explains how long those documents are stored after verification and when they are purged from our systems.
Promo terms
Promo pages reference the marketing consent flag set here. Toggling marketing off in your account removes you from promo emails without affecting account-critical notices.
Payment policy
DANA, OVO, GoPay and QRIS references on the payment policy match the processor disclosures here, so the same partner names appear in both places.
Complaints policy
Our complaints page points back to the compliance escalation path above. Both pages quote the same response windows for Indonesia account holders.
Cookie controls
In-account cookie controls inherit the categories defined in this document. Changing a toggle there updates the consent log referenced in this policy immediately.
PLATFORM SNAPSHOT
What Shapes This Policy Page
Version header
At the top of the page we mark the effective...
Section anchors
Each clause has its own anchor link so you can...
Defined terms
Words like account, processor and supported region are defined inline...
Rights summary
A short rights summary sits above the long clauses so...
Contact block
The privacy inbox, chat route and escalation address are repeated...
Change log
A short change log below the final clause records the...
Privacy Policy Questions
At signup we take your name, contact details, date of birth and the identity document needed for verification. After that we log session data and the transaction references tied to your DANA, OVO, GoPay or QRIS funding.
Only with processors we need to run your account — payment rails, KYC checkers, hosting and audit partners. Each one is bound by contract to use your data only for the task we hired them for, nothing more.
Account and transaction records are held for the period Indonesian financial rules require, then purged. Marketing preferences and support transcripts have shorter windows, which we list in the retention clause on this page.
Yes, you can request erasure through the privacy inbox. We will delete what we are legally allowed to remove and explain which items must stay — for example, transaction records held under anti-money-laundering duties.
DANA, OVO, GoPay and QRIS details flow through encrypted channels to the processor and are not stored in clear text on our side. We hold a reference token so we can match a deposit to your account, nothing more.
Essential cookies keep you signed in and protect the session. Functional and analytics cookies only fire if you opt in through the consent banner, and you can change that choice from your account settings at any time.
Ask for compliance escalation through the contact block. A senior reviewer reopens the file, looks at the original request and our response, and writes back with a final outcome inside ten working days.