Privacy Policy

1. Who we are

Manabisa is a product studio in Indonesia. The data controller for our products — including Pintar, janji, lumen, and Manabisa Tools — is PT MANABISA HARAPAN TEKNOLOGI (MANABISA HARAPAN TEKNOLOGI), Batujajar Regency AH 16, RT 006 RW 015, Desa Laksanamekar, Kec. Padalarang, Kabupaten Bandung Barat, Jawa Barat 40553, Indonesia. You can reach us about privacy at support@manabisa.com.

An app may describe the data it handles in more detail on its own site, such as lumen's privacy page. That page adds to this policy.

2. Data we collect

Information you give us

• Account details — such as your name (or display name) and email address when you register for Pintar.
• Payment information — when you buy a paid product. Products sold through Paddle (such as lumen Pro) are paid to Paddle, our merchant of record; products we sell directly (such as Pintar Pro) are paid through our payment provider. Either way we receive confirmation and a transaction reference, but not your full card, bank, or e-wallet credentials.
• Support messages — the content of emails or messages you send us.

Information collected automatically

• Usage and learning data — for Pintar, things like quizzes taken, scores, and progress, which power the leaderboard and your account.
• Basic technical data — aggregate, privacy-friendly analytics about page views and device type (see section 6).

janji

janji (janji.manabisa.com) is appointment booking with video and audio calls. It handles data about the people who take bookings (hosts) and the people who book them (guests):

• Host accounts — name, email address, password (stored only as a salted hash, never in readable form), organisation name and booking link, the services offered, availability, and a log of changes members make in the organisation.
• Bookings — a guest's name, email address, time zone, and the service and time booked. Guests do not need an account; each booking has a private link.
• Calls — audio and video pass through our call provider while a call is running. A call is recorded only if the host's service records calls and the guest agrees when booking. A call's text chat is saved only if the service saves chat and the guest agrees. Recordings and saved chat are kept in private storage and are available only to the host side and the guest of that booking.

Recordings and chat can contain sensitive information, such as health matters discussed with a doctor or psychologist. They are deleted on the schedule in section 8.

When a host takes bookings with janji, the host decides whom to book and for what, and is responsible for their relationship with their guests, including any consent their profession requires. For guests' data we act on the host's behalf. A guest may contact the host, or us at support@manabisa.com, about their data.

Manabisa Tools

Our browser tools run entirely on your device. Files you process with them are not uploaded to us and we do not receive their contents.

3. How we use your data

• to provide, operate, and improve our products;
• to create and manage your account and run competitions and leaderboards;
• in janji, to arrange bookings, connect calls, keep recordings and chat where the guest agreed, and email booking confirmations, changes, and cancellations;
• to process payments and provide the paid features you buy;
• to respond to your questions and provide support;
• to keep our services secure and prevent abuse or fraud;
• to comply with our legal obligations.

4. Children's privacy

Pintar is intended for students in grades 5–9, some of whom are children under the applicable age of consent. We ask that a parent or legal guardian provides consent and supervises a child's use of Pintar, including any purchase. We collect only the data needed to run the service for the student, and we do not knowingly use children's data for advertising or sell it. A parent or guardian may contact us at support@manabisa.com to review, correct, or delete a child's data.

5. Legal basis

We process personal data where we have your (or a guardian's) consent, where processing is necessary to provide a service or contract you have entered into, to meet a legal obligation, or for our legitimate interests in operating and securing our products — consistent with Indonesia's Personal Data Protection Law (UU No. 27 of 2022).

6. Analytics and cookies

We use privacy-friendly, aggregate analytics (Cloudflare Web Analytics) to understand traffic. It does not use cookies to track you across sites and does not build an advertising profile of you. Our products aim to use only the cookies or local storage needed to keep you signed in and make the service work.

7. Sharing your data

We do not sell your personal data. We share it only with service providers who help us run our products, under agreements that limit their use of it, including:

• Paddle (Paddle.com), our merchant of record for products sold through it, such as lumen Pro — it processes the payment, tax, and receipts under its own privacy notice;
• Our payment provider (Midtrans) — to process purchases we sell directly in Indonesian Rupiah, such as Pintar Pro;
• Cloud hosting and infrastructure — to run and deliver our services;
• Email delivery — to send account and transactional emails;
• Video and audio calls — for janji, to connect calls and, where the guest agrees, record them;
• Error monitoring — to receive reports when something breaks. We set these reports to leave out IP addresses, the contents of requests, and the private links guests and hosts use.

In janji, a guest's booking details are shared with the host they book, and with the members of the host's organisation who handle that booking.

We may also disclose data where required by law or to protect the rights, safety, and security of our users and our services.

8. Data retention

We keep personal data only as long as needed for the purposes above — for example, for the life of your account — and then delete or anonymise it, unless a longer period is required by law (such as for financial or tax records).

For janji specifically:

• Call recordings and saved chat are deleted 90 days after the call. Our call provider keeps its own copy of a call's chat for up to 7 days.
• The activity log of changes in an organisation is kept for 365 days.
• Accounts and bookings are kept until the organisation is deleted, which its owner can do from the dashboard, or until you ask us to delete them.
• Records of failed sign-in attempts are kept for one day; sign-in sessions last up to 30 days.

9. Your rights

Subject to applicable law, you may request to access, correct, update, or delete your personal data, withdraw consent, or object to or restrict certain processing. To exercise these rights, email support@manabisa.com. We may need to verify your identity before acting on a request.

10. Security

We use reasonable technical and organisational measures to protect personal data, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to respond appropriately if an incident occurs.

11. International transfers

Some of our service providers may process data outside Indonesia. Where that happens, we take steps to ensure your data continues to be protected in line with this policy and applicable law.

12. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, provide a more prominent notice where appropriate.

13. Contact

For any privacy question or request, contact us at support@manabisa.com or through our Contact page.