Privacy notice
What we hold
When you send a Booking Request we hold the Renter label and contact you type (class C2 personal data) and the requested dates. No account is required. Everything you send us, a Booking Request included, passes through Cloudflare, the network in front of rodaku.co, which can process it outside Indonesia.
Lawful basis
The lawful basis for routing your Request to the rental is the performance of a contract at your own request (contract), not consent. The full records of processing are in the subscription contract.
Retention
The Renter label and contact are deleted 90 days after the Request is resolved (accepted, declined, dismissed, or expired). Once deleted, your /r/{token} status page is no longer available.
If you run a rental (Operator account)
For an Operator account we hold your seat's name and WhatsApp number (class C2 personal data). The lawful basis is contract. That WhatsApp number is not merely a contact detail — it is how you sign in: you send us a code from your own number and we never send one to you, which is what proves the number is yours. The name and number are removed from the live system within 72 hours of an account-deletion request.
Your shop's location
You place your shop by standing in front of it and pressing one button. The app asks for a device-location permission at that moment — only then, never in the background — and stores your shop's coordinates. We send those coordinates to Google's mapping service to get the address: the street, the desa and the kecamatan. Google processes them outside Indonesia. We do this so that your shop's address comes from WHERE IT IS rather than from a typed spelling: that address is what fixes your Shop Page's web address, and a different spelling means a different page. The coordinates and the address are shop data, not any Renter's personal data — and we never hold a Renter's location: distance is computed on their own device and never sent to us. The coordinates, street, desa and kecamatan appear on your public Shop Page, because that is how a Renter finds you.
Photographs of your bikes
When you list a bike the app takes three photographs, and the three have different fates. The FRONT frame carries the licence plate: it is read to lift the number, and it may be shown back on the confirm screen inside your shop — so that a person confirms the number rather than a machine. It never appears on a public page, no Renter ever sees it, and no other shop ever sees it; we destroy it within 24 hours by destroying its own key. The STNK photograph is read for the bike's plate number, model, year of manufacture and colour — so the confirm screen can tell you whether the STNK matches your photographs — and never for the owner's name, address or NIK. What is read from it is kept only until you confirm the bike, and never longer than the photograph itself, which is destroyed within 24 hours and is never displayed back on any screen. The SIDE frame is read once as well — that is where your bike's model, colour and accessories are recognised — and the side frame is the one we keep: it is the picture a Renter sees on your Shop Page. Before it is stored, the details the camera records about the photograph — where and when it was taken, and which phone took it — are removed; what stays is only what the picture needs to display correctly: which way up the phone was held, and its colour profile. A side view carries no legible plate, and we never show a plate on a public page. We keep it while the bike is in your fleet, listed or hidden, and delete it 90 days after you retire the bike or after the shop closes, whichever comes first. A side photo you retake replaces the old one, which is deleted. The lawful basis is performance of the contract: a Shop Page with photographs of your bikes is the thing you are paying for.
STNK and NIB photographs
To establish that a bike may legally be rented out and that a shop holds business licensing, we ask for a photograph of the STNK and a photograph of the NIB document. The lawful basis is a legal obligation. Each image is encrypted under its own key — one key per document — and destroyed by destroying that key. There is no screen anywhere that displays it again. THE TWO DOCUMENTS ARE HELD FOR DIFFERENT PERIODS. The STNK photograph is destroyed within 24 hours of upload. The NIB photograph is destroyed 30 days after the register SETTLES the number — not after the upload — because it is the evidence for a legality verdict and we have to be able to account for that verdict afterwards. If you appeal that answer, we hold the photograph while there is still something for a person to rule on. If the register answers your number in the meantime, or your shop closes, there is nothing left to rule on and the ordinary window applies. What survives is the reading (the NIB number and a hash), never the image.
The audit trail
What you do in the app — accepting or declining a Request, recording a handover — is written to a per-seat audit trail. That trail is append-only and cannot be deleted by anyone, ourselves included: that is precisely its purpose, so that evidence cannot be quietly altered. It is retained for at least 24 months. The full list of what is deleted and what is kept is on the /hapus-akun page.
Controller
The controller is Raya Arthatech Global, Jl. Pulagan, Kec. Nusa Penida, Kab. Klungkung, Provinsi Bali (NIB 2509260079473) — we built the form, chose the fields, and set the retention window. The Android app is distributed on Google Play by RNT Developer Projects (KvK 80781047); the controller of this service remains Raya Arthatech Global.
Processors
Meta (WhatsApp) is a processor for notification messages, with storage in the Indonesia region; the processor agreement and cross-border instrument are recorded separately. Google Cloud is a processor for reading the STNK photograph, the plate photograph, the SIDE photograph of the bike and the NIB document photograph: an image is sent to the Singapore region to be read only, is not stored there, and is not used to train models. An STNK image is encrypted under its own per-document key and permanently erased within 24 hours (WITA) by destroying that key; a NIB image follows the same rule but is erased 30 days after the register's answer. There is no screen anywhere that displays either of them again. For the NIB we also ASK THE PUBLIC OSS REGISTER about the number you gave us, at the moment you confirm it — to check that it is registered, still active, and that the name matches. If the register does not answer we try again a bounded number of times and then stop; your number is not asked about indefinitely. The KBLI is recorded and shown to you, and is never used to refuse anyone. We never harvest that register, never on a cron, and we never submit anything to OSS for you. Cloudflare runs the network in front of rodaku.co: every page you open and everything you type or upload passes through it on the way to our servers, so Cloudflare sees what passes through. It also keeps copies of public pages and public photographs for a limited time — a public photograph for a few minutes — and it can do all of this outside Indonesia. Discord is where our team receives alerts from our servers: an alert can carry an internal record number or an error message, and by design it never carries your contact details. Discord is outside Indonesia.
Your rights
You can exercise your data-subject rights without an account via /bantuan or /help.