Privacy Policy

We collect the following categories of information:

1.1 Information you provide directly. When you register an account, we collect your name, email address, and a hashed representation of your password. We do not store passwords in plain text.

1.2 Business information. When you operate a restaurant on the Service, we collect business profile data including outlet name, address, contact details, branding assets, menus, pricing, operating hours, and other content you choose to upload or configure.

1.3 Transactional information. We process records of orders placed through your digital menus, payment events handled via Makan Pay, subscription invoices, refunds, and supporting metadata required for accounting and audit purposes.

1.4 Technical and usage information. We automatically collect device identifiers, IP address, browser type and version, operating system, referring URLs, pages viewed, timestamps, and feature interactions. This information is used to operate, secure, and improve the Service.

1.5 Marketing attribution. We remember how you first reached our site: the website you came from, the page you landed on, and any campaign tags in the link (UTM values, the Google Click Identifier (gclid) and Facebook’s click identifier (fbclid)). We keep this in a first-party cookie for up to 30 days and, when you create an account, store it with your account for the limited purpose of learning which channels bring customers and measuring campaign performance. We do not do this if you decline analytics or your browser sends a Do-Not-Track or Global Privacy Control signal. Deleting your account deletes this record, and you can clear the cookie at any time in your browser. If you answer the optional setup question “Where did you hear about Makan?”, or tell us during setup that you work at a restaurant that already uses Makan, we keep your answers with your account to learn how restaurant owners find Makan; our team sees where you heard about Makan when you create a restaurant. We delete these answers when you delete your account; the message our team already received about a restaurant you created is not recalled.

1.6 Owner summaries and the WhatsApp assistant. If you own a restaurant or an organisation on Makan, our team can send you an AI-written summary of your business by email, in the app and on WhatsApp, and you can link your own WhatsApp number to ask questions about your business there. For this we process the figures of your own business for the period summarised (sales, number of transactions, best-selling and low-stock items by name, branch names and rankings), your name, email and preferred language, and, if you link WhatsApp, your WhatsApp number and account identifier, the time of your last message, the consent you gave, and the questions you send and the answers you receive. We link a number only after you agree in Settings and send a one-time code from that number. You can stop at any time by sending STOP in the chat or by unlinking in Settings.

We use the information described above for the following purposes:

• To provide, maintain, and improve the Service and its features;
• To create and manage your account and authenticate sessions;
• To process subscription payments, issue invoices, and prevent payment fraud;
• To send service-related communications such as security alerts, password resets, and order confirmations;
• To send a few onboarding emails that help you finish setting up your restaurant (at most two per step, each with an unsubscribe link);
• To respond to inquiries and provide customer support;
• To detect, investigate, and prevent fraudulent, unauthorised, or abusive activity;
• To measure the effectiveness of our marketing and product initiatives in aggregate;
• To write and deliver the business summaries and answers that owners receive by email, in the app and on WhatsApp, and to keep a record of who sent or linked what (without message content);
• To comply with applicable legal, regulatory, and tax obligations.

We do not sell your personal data, and we do not disclose your personal data to third parties for their independent marketing purposes.

We process personal data on one or more of the following legal bases recognised under Law No. 27 of 2022 on Personal Data Protection (UU PDP) and applicable regulations:

• Performance of the contract under which we provide the Service to you;
• Compliance with legal obligations to which we are subject;
• Our legitimate interests in operating, securing, and improving the Service, and in offering Makan to businesses that publish their contact details (see section 6), where such interests are not overridden by your rights and freedoms;
• Your consent, where required and obtained.

To deliver the Service, we engage trusted third-party providers under written agreements or standard written terms that include appropriate confidentiality, security, and data protection commitments, except for Telegram, which has no written agreement with us. These providers process personal data only on our instructions and for the purposes set out below:

• Cloudinary — image and asset hosting for menu and brand content;
• Pusher — real-time delivery of order and kitchen notifications;
• Resend — delivery of transactional email, including owner summaries;
• Amazon Web Services — cloud hosting, object storage, and backups (the copies kept in cloud storage are encrypted by AWS);
• Google Analytics 4 and Google Ads — analytics and conversion measurement, limited to our marketing pages;
• Apify — collection of public business listings (see section 6);
• Anthropic and OpenAI — AI models used to score how well Makan may suit a business and to write the first line of the outreach messages described in section 6 and, for owners who use summaries or the WhatsApp assistant, to write the summaries and answers (the business figures and your questions are processed by Anthropic, in the United States and possibly other countries);
• Meta Platforms (WhatsApp) — delivery of WhatsApp messages in both directions, including the text of your questions and our answers;
• Telegram — delivery of the daily list of outreach messages to our team (see section 6).

Some of these providers operate servers outside of Indonesia, and our servers and backups are in Singapore. The data protection agency that will approve ways to send personal data abroad has not yet been set up. A copy that a provider holds is subject to the law of its country.

We use a limited set of cookies and browser storage mechanisms:

• Strictly necessary — session cookies required to authenticate users and operate core features;
• Functional — preferences such as language and interface settings;
• Marketing attribution — a first-party cookie that remembers how you first reached our site, for up to 30 days (see section 1.5);
• Outreach link — a first-party cookie that is set only when you open a link in a message we sent you, and only if you have not declined analytics and your browser does not send a Do-Not-Track or Global Privacy Control signal. It holds only a random identifier, lasts 30 days, and is used to tell us you came from our message when you sign up (see section 6);
• Analytics — Google Analytics 4 may set cookies, and only on our public marketing pages.

We do not use third-party advertising cookies inside the authenticated dashboard. You can control cookies through your browser settings; disabling strictly necessary cookies may impair functionality.

This section is for people who do not use Makan. If your business lists a phone number in a public business listing on an online map, we may contact you to offer Makan. The retention periods in section 7 are for Makan accounts; the periods for business contacts are set out below.

6.1 Where the data comes from. We find businesses in public business listings on maps, and we collect the listing data through a scraping provider, Apify. Apify runs the collection for us and keeps the listing data until we have imported it, or until its own retention period ends.

6.2 Data we keep. For each business we keep:

• The business name and category, and the city or neighbourhood of the listing (we do not keep the street address);
• The phone number and website;
• The rating and the number of reviews;
• The place identifier of the listing;
• The message we prepared for you and the date it was sent; and
• If you reply to us, a lead record with your business name, phone number, and our conversation (see 6.5 below).

6.3 Why we use it. We use this data for the following purposes:

• To offer Makan to your business by WhatsApp, in a message sent by a person on our team;
• To calculate an automated fit score that estimates how well Makan may suit your business;
• To have an AI model write the first line of the message from the listing data;
• To record whether the link in our message was opened and, if you later sign up for Makan in the same browser, to match the sign-up to your business;
• If you reply, to keep a lead record so that our team can answer you.

6.4 Legal basis. Our legal basis under UU PDP is legitimate interest: our interest in offering Makan to businesses that publish their contact details, where that interest is not overridden by your rights and freedoms. We have written down our reasons for this, as Government Regulation No. 33 of 2026 (PP 33/2026) asks. You can ask us to explain them (see 6.7).

6.5 How long we keep it. These periods are counted in whole days and our cleanup runs once a day, so an erase can come up to a day later than the period shown. We often erase sooner.

• A business we never put on our list of messages to send is deleted no later than 30 days after we found it;
• For a business we put on that list but have not messaged, we erase the details we hold about it (such as name, phone number, website, and message) no later than 90 days after it was put on the list;
• For a business we have messaged, we erase those details no later than 180 days after the message was sent (or, if we have no send date, 180 days after we put it on the list or found it);
• When you ask us to stop, we remove your details at once from our list of businesses, from any lead record (see below) unless the lead record is linked to a Makan account, which is handled with account deletion (section 7), and from any stored copy of the daily list.

After the details are erased we keep the place identifier of the listing, the automated fit score and segment we gave it, the search we found it by, the link to any account or lead record that came from it, the reason we set it aside if we did, and the counts and dates of each step (for example when a message was sent), so that we do not collect the same listing again and can measure how the outreach performs. If you ask us to delete your data, we delete that record entirely instead. A do-not-contact record of your phone number and place is kept so that we do not contact you again.

If a business replies to us, we also keep a lead record with its business name, phone number, and the conversation, so that our team can answer it. We handle it with the rest of our sales leads, so the periods above do not erase it. We keep it for 12 months after the last contact. After that we remove its name, business name, phone number, and email, and we delete the conversation and its summary. This does not apply to a lead record linked to a Makan account, which is handled with account deletion (section 7). When you ask us to stop, we remove the name, business name, phone number, and email from it and close it, unless the lead record is linked to a Makan account, which is handled with account deletion (section 7). When you ask us to delete your data, we also remove its identifiers and the conversation recorded in it. If a lead becomes a deal with us, the deal record is kept as part of our sales records and is not removed by this period.

The daily list of messages for our team is stored in a queue until it is delivered. When you ask us to stop or to delete your data, we blank your details in any stored copy of that list; otherwise a stored copy is blanked after 7 days, whether or not it was delivered. A message already delivered to our team's Telegram chat stays there until our team deletes it, which we do by hand when you ask us to delete your data. Copies in our logs expire within 14 days. Older backups can also still hold details we have erased (see section 7).

6.6 Who receives it. To score listings and write the first line, we send limited listing data (never your phone number) to AI providers, Anthropic and OpenAI, in the United States and possibly other countries. Apify, which collects the listings for us, says it processes data mainly in the European Union and the United States. The daily list of messages for our team to send, which includes your phone number, is delivered through Telegram. When a person on our team sends a message, it goes through WhatsApp, which Meta runs. We do this so that we can offer Makan to you. Our servers and backups are in Singapore. We limit what we send, and we keep the daily list in a private chat for named staff. The data protection agency that will approve ways to send personal data abroad has not yet been set up. A copy that a provider holds is also subject to the law of its country. That is the risk. Section 4 lists the providers too.

6.7 Stopping, and seeing or deleting your data. Every message names PT. Biissa Maju Bersama, tells you where we found your number, and ends with a line that lets you reply STOP or BERHENTI. If you do, we will not contact you again. You can also email admin@biissa.com to see or delete the data we hold about you, to tell us that something is wrong (we then remove the record), or to ask us to stop. You may also ask us to explain why we rely on legitimate interest as the legal basis for processing your data, and we will answer in writing.

We retain personal data for as long as your account remains active and for such additional period as is reasonably necessary to fulfil the purposes set out in this Policy or as required by applicable law. Upon account deletion, we will delete or irreversibly anonymise your personal data within thirty (30) days, except where:

• Retention is required by Indonesian tax, accounting, or anti-money laundering legislation (typically up to ten (10) years for financial records); or
• Retention is necessary for the establishment, exercise, or defence of legal claims.

Backups: data we delete, whether because you asked us to or because a retention period ended, can still appear in older backups. We keep old backups in cloud storage and they have no fixed end date.

Owner summaries: a draft or discarded summary is deleted after 7 days and a sent summary after 400 days. WhatsApp conversation text is deleted after 7 days, and the record of each question (which holds no message text) after 30 days. When you send STOP, unlink, or stop being an owner, the conversation and those records are deleted at once and your number is replaced by a one-way code that cannot be turned back into the number.

Subject to and in accordance with UU PDP, you have the right to:

• Obtain confirmation as to whether we process your personal data and access a copy of such data;
• Request correction or completion of inaccurate or incomplete data;
• Request deletion of your personal data;
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal;
• Object to or request restriction of certain processing activities;
• Receive your personal data in a structured, commonly used format (data portability);
• Lodge a complaint with the competent supervisory authority.

To exercise these rights, please contact us at admin@biissa.com. We will respond within the period required by applicable law.

We implement administrative, technical, and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These safeguards include encryption of data in transit using TLS, encryption at rest of the backups we copy to cloud storage (done by our cloud provider), password hashing, role-based access controls, audit logging, and regular review of our security posture. While we work to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is intended for use by businesses and the adults operating them. It is not directed to children under the age of 13, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at admin@biissa.com and we will take appropriate steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes to our practices, the Service, or applicable law. Where changes are material, we will provide reasonable advance notice through the Service or by email. The “Effective date” at the top of this Policy indicates when the current version took effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For questions, requests, or complaints regarding this Privacy Policy or our processing of your personal data, please contact:

PT. Biissa Maju Bersama
Email: admin@biissa.com
Website: makan.biissa.com