Privacy Policy

This Privacy Policy explains how MAPAN ("we") collects, uses, stores, and protects your personal data when you use the MAPAN app and website (the "Service"). By signing up for and using the Service, you agree to the practices described in this policy.

1. Data We Collect

a. Account & profile data

• Full name, email address, and password (stored as a hash, never in plain text).
• Optional profile data: photo/avatar, gender, date of birth, occupation, relationship status, province, and city/regency of residence.
• If you sign in with Google, we receive your name, email, and Google account ID from Google.

b. Verification & security data

• One-Time Password (OTP) codes sent to your email for account verification and password resets.
• Your login session (session token), stored as an HttpOnly cookie on your device.
• Account activity records (audit logs) for security purposes, such as logins and changes to important data.

c. Financial data you enter yourself

• Wallet and pocket (sub-wallet) balances, transactions (income, expenses, transfers, adjustments), categories, budgets, savings goals, and inputs for the financial roadmap.
• Receipt scan (OCR) results if you use the Receipt Scan feature.
• All of this data consists of personal records that you enter yourself — MAPAN is not connected to your bank accounts or cards and cannot move real money.

d. Mapan Bisnis data (if you create or join a business)

• The name, type, and stage of the business you register, along with its business cash balance (separate from your personal wallet).
• Catalog data: item/product names & variants, selling prices, cost prices, and stock (including warehouse stock if you enable that feature).
• Sales (cashier/POS) transactions, invoices, and business receivables and payables.
• Customer/supplier contact data that you save yourself for business record-keeping.
• Team member data: the email addresses you invite and the roles you assign.
• This data can be accessed by other team members of the same business according to their roles — see section 3 below.

e. Subscription & payment data

• The subscription plan you choose (personal or Mapan Bisnis), payment status, transaction ID, and subscription history.
• Paid plans are processed by a licensed third-party payment gateway provider — currently iPaymu (this may change from time to time depending on the provider we use). MAPAN does not store your card numbers, bank account numbers, or payment credentials — that data is handled directly by the payment gateway provider in line with industry security standards (PCI DSS).

f. AI Assistant & other AI-powered feature data

• Conversations you send to the AI Assistant, receipt scan (OCR) results, and the context you provide to other AI suggestion features (e.g. transaction category suggestions, business onboarding suggestions) are processed using a third-party AI service (Google Gemini API) to generate replies and insights.

g. Support & feedback data

• The content of messages you send through the contact form or feedback feature, including the email address you provide so we can reply.
• If you are signed in, feedback is recorded with your account so we can follow up on it.
• Testimonials: feedback is only shown on the MAPAN website if you tick the testimonial consent box, together with the display name and description you enter yourself (both optional — leave them empty to appear anonymously as "MAPAN user"). We never show your email or account details.

h. Technical data

• Device information, browser type, IP address, and access times — used for security, detecting suspicious activity, and improving app performance.
• IP addresses are also used to rate-limit requests and automatically block abuse, such as repeated sign-in attempts or suspicious traffic spikes.

2. How We Use Your Data

We use the data we collect to:

• Provide and operate the core features of the Service (wallets, transactions, budgeting, goals, roadmap, AI Assistant) and the Mapan Bisnis features (catalog, cashier/POS, invoices, business cash, receivables and payables).
• Process subscription activation and status updates after payment is confirmed by the payment gateway provider.
• Send verification emails (OTP), transaction notifications, and important account notices.
• Respond to your questions and support requests.
• Keep your account secure, prevent abuse, and investigate suspicious activity.
• Improve the quality and reliability of the Service based on aggregated usage patterns.

We do not sell your personal data to third parties, and we do not use or share your in-app financial data for targeted advertising. Ads (if any) appear only on the site's public pages, not inside the app.

3. Sharing Data with Third Parties

We only share data as necessary with:

• iPaymu — the payment gateway provider we currently use, to process your subscription payments.
• Google — for signing in with a Google account (OAuth) and processing AI Assistant conversations (Gemini API).
• Cloudflare — the network provider in front of our site and API (proxy/CDN), protection against attacks and bots, Cloudflare Turnstile (anti-bot verification on the sign-in, sign-up, forgot-password, and contact forms), and Cloudflare Web Analytics for visit statistics. Because traffic to the Service passes through Cloudflare's network, Cloudflare processes technical request data such as IP address, browser type, and the pages requested.
• Google AdSense — to show ads on the site's public pages (home, articles, and guides). Google and its partners may use cookies to serve ads based on your visits to this and other sites.
• Email service providers — to send OTP codes and email notifications.
• Legal authorities, when required by the laws and regulations in force in Indonesia.

Some of the providers above process data on servers located outside Indonesia. We strive to ensure that every partner maintains adequate data protection standards.

Beyond the third parties above, if you use Mapan Bisnis, your business cash, catalog, invoice, contact, and business transaction data can be accessed by the team members you invite to that business, according to the roles you assign them. This is not sharing data with external third parties, but collaborative access within the same business, under your control as the business owner.

4. Data Storage & Security

• Passwords are stored as one-way hashes, never in plain text.
• Sensitive configuration (such as payment gateway credentials) is encrypted before being stored in the database.
• Login sessions use HttpOnly cookies that cannot be accessed by browser-side scripts, reducing the risk of session theft.
• Access to data is restricted by role (role-based access) and authentication tokens (JWT) that expire automatically.
• We keep your data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable time, except for data we are required to keep longer for legal compliance or payment dispute resolution.

5. Your Rights over Your Personal Data

You have the right to:

• Access the personal data we store about you through the Profile page.
• Update or correct your profile data at any time.
• Request deletion of your account and related personal data by contacting us at [email protected].
• Withdraw testimonial consent at any time by contacting us at [email protected] — we will promptly remove your testimonial from the website.
• Request a copy of your data in a reasonable format.
• Withdraw your consent, in which case you may no longer be able to use some or all of the Service.

6. Cookies

We use an essential session_token cookie to keep your login session active. We also use Google Analytics (analytics cookies) to understand how the site is used and, where applicable, Google AdSense (advertising cookies). Both are fully active only if you consent through the cookie banner on your first visit; without consent, analytics and advertising cookies are not set and ads are not personalised.

We also use Cloudflare Web Analytics for aggregate visit statistics (pages viewed, loading performance, referrers, and device and browser type). According to Cloudflare, this service does not use cookies or local storage on your device, does not fingerprint visitors, and does not count unique visitors by IP address. For that reason its script runs without waiting for the cookie banner choice. Cloudflare may also set essential technical security cookies (for example for anti-bot verification) where needed. You can change your choice at any time via the Cookie settings link at the bottom of the page. On the site's public pages, Google AdSense and its advertising partners may store cookies or similar identifiers on your device to serve and measure ads, including personalised ads. These cookies are not set inside the app (after you sign in). You can manage or turn off ad personalisation in Google Ad Settings, learn how Google uses data at policies.google.com/technologies/partner-sites, or clear cookies in your browser settings.

7. Children's Privacy

The Service is intended for users aged 18 and over or who have the legal capacity to manage their personal finances. We do not knowingly collect data from children under that age. If you become aware of an underage account using the Service, please contact us so we can delete it.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email before they take effect. The "Effective since" date at the top of this page shows the latest revision.

9. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights over your personal data, please contact us at [email protected].