Curhat

Privacy Policy / Kebijakan Privasi

Effective Date: July 06, 2026

Welcome to HaloBestie, a service operated by PT Aksara Sahabat Cakrawala ("Company," "we," "us," or "our"), a company incorporated under the laws of the Republic of Indonesia.

This Privacy Policy explains how we collect, use, store, share, and protect your information when you access or use the HaloBestie mobile application, website (mybestieindonesia.com), and related services (collectively, the "Service").

HaloBestie is designed to provide a safe and anonymous space where users can express thoughts, feelings, or concerns through conversations with trained peer listeners ("Besties"). To support this mission, we intentionally minimize the collection of personal information and design our systems to prioritize anonymity.

This Privacy Policy is prepared in compliance with Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) and other applicable data protection regulations in the Republic of Indonesia.

PT Aksara Sahabat Cakrawala acts as the Pengendali Data Pribadi (Data Controller) as defined under UU PDP.

By accessing or using HaloBestie, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy.

1. Information We Collect

We follow a data minimization principle — we only collect information that is necessary to operate the platform, maintain security, and improve service quality.

1.1 Account Information

  • Phone Number — Required for account registration and authentication. Used to verify legitimate users, prevent abuse, and maintain platform integrity. Your phone number is never visible to other users or Besties.
  • Anonymous Display Name — A nickname you choose for use during conversations. This is not intended to contain your real identity. Our system architecture ensures that your display name and phone number are not paired in any user-facing interaction.

We do not require real names, government identification, photographs, or detailed personal profiles.

1.2 Session and Conversation Data

During conversations between users and Besties, messages are processed to facilitate real-time communication.

Conversation data is handled with strict confidentiality and is used only for:

  • Enabling real-time communication between users and Besties
  • Maintaining platform safety and investigating reports of abuse or misuse
  • Quality assurance through aggregate, anonymized analysis

We do not publicly display, sell, or share the content of private conversations.

Regarding encryption: We currently implement encryption for data in transit using industry-standard protocols (TLS/SSL). We are actively working toward implementing end-to-end encryption for conversation data to further strengthen user privacy. Until end-to-end encryption is fully deployed, authorized personnel may access conversation data solely for safety and abuse investigation purposes under strict internal policies.

1.3 Payment Information

Payment transactions are processed through our authorized third-party payment provider. We collect transaction metadata including payment method type, transaction amount, currency, and transaction status.

We do not store full payment credentials such as credit card numbers, bank account details, or e-wallet PINs on our servers. These are processed and stored exclusively by the payment provider in accordance with their own security standards and privacy policy.

1.4 Technical and Usage Data

We automatically collect limited technical data to maintain reliability and security:

  • Device type and operating system version
  • Application version
  • Crash reports and performance diagnostics
  • Basic usage analytics (session frequency, feature usage patterns)
  • IP address (for security and fraud prevention only, not used for user tracking or profiling)

1.5 Cookies and Tracking Technologies

The HaloBestie website may use essential cookies only to maintain session functionality and security. We do not use advertising cookies, retargeting cookies, or third-party marketing trackers.

We may use anonymized analytics tools (such as Firebase Analytics) to understand general usage patterns. These tools collect aggregate, non-personally-identifiable data only.

2. Legal Basis for Processing

In accordance with UU PDP, we process personal data based on the following legal grounds:

  • Consent (Persetujuan) — When you create an account, you provide explicit consent for the collection and processing of your data as described in this policy. You may withdraw consent at any time.
  • Contractual Necessity (Pemenuhan Kewajiban Perjanjian) — Processing necessary to provide the Service as outlined in our Terms of Service.
  • Legitimate Interest (Kepentingan yang Sah) — Processing necessary for platform safety, fraud prevention, and service improvement, provided it does not override your fundamental rights.
  • Legal Obligation (Pemenuhan Kewajiban Hukum) — Processing required to comply with applicable Indonesian laws and regulations.

3. How We Use Your Information

We use collected information only for the following purposes:

  • Providing, operating, and maintaining the Service
  • Facilitating anonymous peer support sessions
  • Processing payments and maintaining financial records as required by law
  • Ensuring platform safety, preventing fraud, and investigating abuse
  • Improving product functionality, reliability, and user experience
  • Resolving technical issues and providing customer support
  • Communicating service updates or responding to support requests
  • Complying with applicable legal and regulatory obligations

We do NOT:

  • Use personal information for targeted advertising
  • Sell, rent, or trade personal data to any third party
  • Create user profiles for marketing purposes
  • Send marketing communications unless you explicitly opt in

4. Data Sharing and Disclosure

We do not sell, rent, or trade personal information to advertisers, marketing companies, data brokers, or any third party for commercial purposes.

Information may be disclosed only under the following limited and specific circumstances:

4.1 Service Providers (Prosesor Data Pribadi)

We engage trusted third-party service providers to help operate the platform. These include:

  • Payment processing services
  • Cloud hosting and infrastructure providers
  • Anonymized analytics services
  • Push notification services

All service providers are bound by contractual obligations to maintain strict confidentiality, process data only as instructed by us, and implement adequate security measures in accordance with UU PDP.

4.2 Legal Compliance

We may disclose information when required by law, including in response to valid and binding legal requests from Indonesian courts, regulators, or law enforcement authorities. We will comply with such requests only to the extent required by law.

4.3 Safety Protection

We may review conversation data internally when there is a credible report of abuse, harassment, or behavior that poses a risk of harm to any user, Bestie, or third party. Such review is conducted under strict internal protocols and limited to authorized personnel only.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets involving PT Aksara Sahabat Cakrawala, user data may be transferred as part of the business transaction. You will be notified of any such transfer and your data will continue to be subject to this Privacy Policy or a substantially similar policy.

5. International Data Transfers

We primarily use cloud service providers whose servers may be located outside the Republic of Indonesia. When personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with UU PDP, including:

  • Contractual obligations requiring equivalent data protection standards
  • Ensuring the receiving country provides an adequate level of data protection, or implementing supplementary measures where necessary

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy and to comply with legal obligations.

Specific retention periods:

  • Account information — Retained while your account is active. Upon account deletion request, personal data will be deleted or anonymized within 30 (thirty) calendar days, unless retention is required by law.
  • Conversation data — Processed in real-time for communication. Retained for a limited period for safety and quality purposes, then deleted or anonymized.
  • Payment and transaction records — Retained for a minimum period as required by applicable Indonesian tax and financial regulations (currently a minimum of 10 years for financial records under UU Perpajakan).
  • Technical and security logs — Retained for up to 12 (twelve) months for security, diagnostics, and fraud prevention, then deleted.

When data is no longer needed, we take reasonable steps to securely delete, anonymize, or aggregate it so that it can no longer be associated with an individual.

7. Your Rights as a Data Subject

In accordance with UU PDP, you have the following rights regarding your personal data:

  • Right to Information (Hak atas Informasi) — Know what data we collect and how it is processed
  • Right to Access (Hak Akses) — Request a copy of the personal data we hold about you
  • Right to Correction (Hak Perbaikan) — Request correction of inaccurate or incomplete data
  • Right to Deletion (Hak Penghapusan) — Request deletion of your personal data, subject to legal retention requirements
  • Right to Withdraw Consent (Hak Menarik Persetujuan) — Withdraw your consent for data processing at any time; withdrawal does not affect the lawfulness of processing prior to withdrawal
  • Right to Data Portability (Hak Portabilitas) — Request a copy of your data in a structured, commonly used format
  • Right to Object (Hak Keberatan) — Object to certain types of data processing
  • Right to Restrict (Hak Pembatasan) — Request restriction of processing in certain circumstances

To exercise any of these rights, contact us at: admin@mybestieindonesia.com

We will acknowledge your request within 1 x 24 hours and fulfill valid requests within 3 x 24 hours of receipt, in accordance with UU PDP.

8. Data Security

We implement reasonable and appropriate technical and organizational measures to protect your data, including:

  • Encryption in transit using TLS/SSL protocols
  • Access control — data access restricted to authorized personnel on a need-to-know basis
  • Secure infrastructure using modern cloud security practices with reputable providers
  • Monitoring and logging to detect unauthorized access or anomalous activity
  • Regular security reviews of systems, processes, and access permissions
  • Employee and Bestie confidentiality obligations

We are actively working toward implementing end-to-end encryption for conversation data. Updates to our encryption capabilities will be reflected in future revisions of this policy.

While we strive to use commercially acceptable means to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Data Breach Notification

In the event of a failure in the protection of personal data (kegagalan pelindungan data pribadi) that may impact your rights, we will:

  • Notify affected users in writing within 3 x 24 hours of becoming aware of the breach, as required by Pasal 46 UU PDP
  • Provide details including: the nature of the breach, the categories and approximate number of data subjects affected, the personal data affected, the measures taken and proposed to address the breach
  • Report the breach to the relevant supervisory authority (lembaga pelindungan data pribadi) as required by law
  • Take immediate steps to contain, investigate, and remediate the breach
  • Document the breach and our response for accountability purposes

10. Children's Privacy

HaloBestie is intended for individuals aged 13 years or older.

Users aged 13 to 17 must have verifiable consent from a parent or legal guardian. In accordance with UU PDP, the processing of personal data of minors is conducted with special care and additional safeguards.

We do not knowingly collect personal information from children under the age of 13. If we become aware that a child under 13 has created an account or provided personal data, we will take prompt steps to delete such data and terminate the account.

Parents or guardians who believe their child under 13 has used HaloBestie may contact us at admin@mybestieindonesia.com to request immediate deletion.

11. Third-Party Links and Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of any third-party sites. We encourage you to review the privacy policies of any third-party services before providing your information.

12. Changes to This Privacy Policy

This Privacy Policy may be updated periodically to reflect changes to our practices, legal requirements, or operational improvements.

When material changes occur:

  • The revised version will be published with an updated effective date
  • Users will be notified through the application and/or email (if provided)
  • Where required by UU PDP, we will seek renewed consent for material changes to data processing practices

Continued use of the Service after the updated effective date constitutes acceptance of the revised Privacy Policy. If you do not agree, you should discontinue use of the Service and may request account deletion.

13. Contact Us

If you have questions, concerns, complaints, or requests regarding this Privacy Policy or our data practices, please contact:

PT Aksara Sahabat Cakrawala
Email: admin@mybestieindonesia.com

We are committed to resolving any concerns about your privacy in a fair and timely manner. If you are unsatisfied with our response, you have the right to file a complaint with the relevant data protection authority in Indonesia.

By using HaloBestie, you acknowledge and agree to this Privacy Policy.