Privacy Policy

This Privacy Policy explains how MAPAN ("we") collects, uses, stores, and protects your personal data when you use the MAPAN app and website (the "Service"). By signing up for and using the Service, you agree to the practices described in this policy.

1. Data We Collect

a. Account & profile data

• Full name, email address, and password (stored as a hash, never in plain text).
• Optional profile data: photo/avatar, gender, date of birth, occupation, relationship status, province, and city/regency of residence.
• If you sign in with Google, we receive your name, email, and Google account ID from Google.

b. Verification & security data

• One-Time Password (OTP) codes sent to your email for account verification and password resets.
• Your login session (session token), stored as an HttpOnly cookie on your device.
• Account activity records (audit logs) for security purposes, such as logins and changes to important data.

c. Financial data you enter yourself

• Wallet and pocket (sub-wallet) balances, transactions (income, expenses, transfers, adjustments), categories, budgets, savings goals, and inputs for the financial roadmap.
• Receipt scan (OCR) results if you use the Receipt Scan feature.
• All of this data consists of personal records that you enter yourself — MAPAN is not connected to your bank accounts or cards and cannot move real money.

d. Mapan Bisnis data (if you create or join a business)

• The name, type, and stage of the business you register, along with its business cash balance (separate from your personal wallet).
• Catalog data: item/product names & variants, selling prices, cost prices, and stock (including warehouse stock if you enable that feature).
• Sales (cashier/POS) transactions, invoices, and business receivables and payables.
• Customer/supplier contact data that you save yourself for business record-keeping.
• Team member data: the email addresses you invite and the roles you assign.
• This data can be accessed by other team members of the same business according to their roles — see section 3 below.

e. Subscription & payment data

• The subscription plan you choose (personal or Mapan Bisnis), payment status, transaction ID, and subscription history.
• Paid plans are processed by a licensed third-party payment gateway provider — currently iPaymu (this may change from time to time depending on the provider we use). MAPAN does not store your card numbers, bank account numbers, or payment credentials — that data is handled directly by the payment gateway provider in line with industry security standards (PCI DSS).

f. AI Assistant & other AI-powered feature data

• Conversations you send to the AI Assistant, receipt scan (OCR) results, and the context you provide to other AI suggestion features (e.g. transaction category suggestions, business onboarding suggestions) are processed using a third-party AI service (Google Gemini API) to generate replies and insights.

g. Support & feedback data

• The content of messages you send through the contact form or feedback feature, including the email address you provide so we can reply.

h. Technical data

• Device information, browser type, IP address, and access times — used for security, detecting suspicious activity, and improving app performance.

2. How We Use Your Data

We use the data we collect to:

• Provide and operate the core features of the Service (wallets, transactions, budgeting, goals, roadmap, AI Assistant) and the Mapan Bisnis features (catalog, cashier/POS, invoices, business cash, receivables and payables).
• Process subscription activation and status updates after payment is confirmed by the payment gateway provider.
• Send verification emails (OTP), transaction notifications, and important account notices.
• Respond to your questions and support requests.
• Keep your account secure, prevent abuse, and investigate suspicious activity.
• Improve the quality and reliability of the Service based on aggregated usage patterns.

We do not sell your personal data to third parties, and we do not use your financial data for targeted advertising.

3. Sharing Data with Third Parties

We only share data as necessary with:

• iPaymu — the payment gateway provider we currently use, to process your subscription payments.
• Google — for signing in with a Google account (OAuth) and processing AI Assistant conversations (Gemini API).
• Email service providers — to send OTP codes and email notifications.
• Legal authorities, when required by the laws and regulations in force in Indonesia.

Some of the providers above process data on servers located outside Indonesia. We strive to ensure that every partner maintains adequate data protection standards.

Beyond the third parties above, if you use Mapan Bisnis, your business cash, catalog, invoice, contact, and business transaction data can be accessed by the team members you invite to that business, according to the roles you assign them. This is not sharing data with external third parties, but collaborative access within the same business, under your control as the business owner.

4. Data Storage & Security

• Passwords are stored as one-way hashes, never in plain text.
• Sensitive configuration (such as payment gateway credentials) is encrypted before being stored in the database.
• Login sessions use HttpOnly cookies that cannot be accessed by browser-side scripts, reducing the risk of session theft.
• Access to data is restricted by role (role-based access) and authentication tokens (JWT) that expire automatically.
• We keep your data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable time, except for data we are required to keep longer for legal compliance or payment dispute resolution.

5. Your Rights over Your Personal Data

You have the right to:

• Access the personal data we store about you through the Profile page.
• Update or correct your profile data at any time.
• Request deletion of your account and related personal data by contacting us at support@mapan.digital.
• Request a copy of your data in a reasonable format.
• Withdraw your consent, in which case you may no longer be able to use some or all of the Service.

6. Cookies

We use an essential session_token cookie to keep your login session active. We do not use third-party tracking cookies for advertising purposes.

7. Children's Privacy

The Service is intended for users aged 18 and over or who have the legal capacity to manage their personal finances. We do not knowingly collect data from children under that age. If you become aware of an underage account using the Service, please contact us so we can delete it.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email before they take effect. The "Effective since" date at the top of this page shows the latest revision.

9. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights over your personal data, please contact us at support@mapan.digital.