Privacy Policy

Privacy Policy

Kebijakan Privasi

Effective date: 18 June 2026 Last updated: 18 June 2026 Governing law: UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP)

This Privacy Policy explains how Randivo collects, uses, stores, and protects your personal data when you use the Randivo platform at randivo.space. We are committed to protecting your privacy in accordance with Indonesian law, including UU PDP No. 27 Tahun 2022.

By creating an account and using the Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

The data controller for personal data processed through the Platform is:

Name: Randivo Contact: privacy@randivo.space Website: randivo.space Location: Jakarta, Indonesia

2. Data We Collect

2.1 Account Data

When you register, we collect:

• Email address
• Password (stored as a hashed value; we never store plain-text passwords)
• Account creation date and timestamp

2.2 Profile and Event Data

When you use the Platform, we collect:

• Event details you create (event name, type, date, location, guest count, budget)
• Vendor information you add or manage within your events
• Task and checklist data
• Rundown and schedule entries
• Budget line items and financial estimates
• Notes and annotations you add within the Platform

2.3 Collaboration Data

When you use collaboration features, we collect:

• Email addresses of collaborators you invite
• Collaborator role assignments (editor, viewer)
• Invitation status and timestamps

2.4 Usage Data

We automatically collect limited technical data to operate and improve the Platform:

• Login timestamps and session activity
• Feature usage patterns (which features are used and how frequently)
• Error logs and diagnostic data

We do not use third-party advertising trackers or analytics platforms that track you across other websites.

2.5 Data You Do Not Need to Provide

We do not require and do not collect: government ID numbers, payment card details (processed directly by our payment gateway provider), biometric data, or sensitive personal data categories beyond what is listed above.

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and maintain your account
• To provide, operate, and improve the Platform and its features
• To process and manage your event data as you direct
• To send transactional emails (account verification, password reset, collaboration invitations) via Resend
• To power AI features for paid tier users (event data is sent to Anthropic API for processing)
• To diagnose and fix bugs and technical issues
• To communicate with you about important service changes
• To comply with applicable Indonesian law

We do not use your data for targeted advertising. We do not sell your data to third parties.

4. Legal Basis for Processing

Under UU PDP No. 27 Tahun 2022, we process your personal data on the following bases:

• Contractual necessity: processing required to deliver the service you signed up for
• Consent: for optional features such as AI processing and marketing communications, where you have given explicit consent
• Legitimate interest: for security monitoring, fraud prevention, and service improvement
• Legal obligation: where required by applicable Indonesian law

5. Data Sharing and Third-Party Processors

We share your data with the following third-party processors who act on our behalf to deliver the Platform:

5.1 Supabase (Database and Authentication)

• Purpose: user authentication, database storage for all Platform data
• Location: Singapore region (ap-southeast-1)
• Data transferred: all account and event data
• Website: supabase.com

5.2 Vercel (Frontend Hosting)

• Purpose: hosting and serving the Platform web application
• Location: global CDN
• Data transferred: HTTP request logs (IP addresses, user agents)
• Website: vercel.com

5.3 Railway (Backend API Hosting)

• Purpose: hosting the API server that processes Platform requests
• Data transferred: API request/response data including event payloads
• Website: railway.app

5.4 Resend (Transactional Email)

• Purpose: sending account verification, password reset, and invitation emails
• Location: US-based
• Data transferred: email address and email content
• Website: resend.com

5.5 Anthropic (AI Feature Processing)

• Purpose: powering AI features for paid tier users only
• Location: US-based
• Data transferred: relevant event context data (event type, guest count, budget range, vendor information) — no raw personal identifiers
• Website: anthropic.com

We do not share your data with any other third parties except where required by law, court order, or to protect the security of the Platform and its users.

6. Cross-Border Data Transfer

Your data is stored on Supabase infrastructure in Singapore and processed by service providers in Singapore and the United States. By using the Platform, you consent to this cross-border transfer. We ensure that our processors maintain appropriate security standards for your data.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specifically:

• Active account data: retained for the duration of your account
• Closed event data: retained for 12 months after event date, then archived or deleted
• Account deletion: upon request, we will delete your account and associated personal data within 30 days, except where retention is required by law
• Backup data: may persist in encrypted backups for up to 90 days after deletion

8. Your Rights Under UU PDP

As a data subject under UU PDP No. 27 Tahun 2022, you have the following rights:

• Right to access: request a copy of personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data (subject to legal retention requirements)
• Right to restriction: request that we limit processing of your data in certain circumstances
• Right to data portability: request your data in a machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at privacy@randivo.space. We will respond within 14 business days. We may ask you to verify your identity before processing your request.

9. Security

We implement the following security measures to protect your data:

• Passwords are hashed using Supabase's bcrypt-based authentication; we never store plaintext passwords
• All data transmission is encrypted using TLS/HTTPS
• Row-Level Security (RLS) policies in our database ensure users can only access their own data
• Per-user API rate limiting to prevent abuse
• Regular security reviews of our codebase and infrastructure

No system is completely secure. If you discover a security vulnerability, please report it responsibly to privacy@randivo.space.

10. Cookies and Local Storage

The Platform uses the following cookies and browser storage:

• Authentication session cookies: set by Supabase to maintain your logged-in session. These are strictly necessary for the Platform to function and do not require consent.
• Local storage: used to store UI preferences (e.g., active tabs, filter states) locally in your browser. No personal data is stored in local storage.

We do not use advertising cookies, cross-site tracking cookies, or analytics cookies that send data to third parties.

11. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us at privacy@randivo.space and we will promptly delete the account and associated data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and notify you via email or in-app notification for material changes. Continued use of the Platform after the effective date of the updated Policy constitutes acceptance of the changes.

13. Contact

For privacy-related questions, data access requests, or to report a concern:

• General: randivo.team@gmail.com
• Website: randivo.space