Privacy Policy

1. Who We Are

Bajo Rental is a curated rental platform operating across Indonesia, owned and operated by PT Indahnesia Holding Group, headquartered in Labuan Bajo, Flores, Indonesia. We provide car, motorbike, boat, and equipment rentals, managing the customer relationship end-to-end on behalf of our fulfilment partners.

For any privacy-related questions, contact us at info@bajorental.com or via WhatsApp at +62 812 2202 8945.

2. Information We Collect

We collect the following categories of information:

• Identity information: your full name, as provided during a booking inquiry.
• Contact information: WhatsApp number and email address used to confirm bookings and send updates.
• Booking details: rental dates, selected listings, number of passengers or guests, and any special requests.
• Payment information: transaction references processed through Xendit. We do not store full card or bank account numbers on our servers.
• Usage data: IP address, browser type, pages visited, referral source, and session duration, collected via Google Analytics 4 and Meta Pixel.
• Communication records: messages sent through our live chat (Tawk.to) or WhatsApp, for service quality purposes.

3. How We Use Your Information

We use the information we collect to:

• Process and confirm your rental bookings.
• Send booking confirmations, updates, and support messages via WhatsApp and email.
• Coordinate with our fulfilment partners to deliver your rental.
• Process payments and issue receipts through Xendit.
• Improve our platform, listings, and customer experience based on aggregated usage data.
• Send marketing communications (promotions, seasonal offers, cross-sell suggestions) where you have provided consent or where permitted under applicable law. You may opt out at any time.
• Comply with legal obligations under Indonesian law.

4. Cookies

We use cookies and local storage to maintain your preferences and support our analytics tools. The cookies we set include:

You can disable cookies through your browser settings. Disabling analytics or marketing cookies will not affect your ability to make a booking.

5. Third-Party Services

We use the following third-party services, each operating under their own privacy policies:

• Supabase — database and authentication infrastructure. Data stored in the Singapore (ap-southeast-1) region.
• Vercel — website hosting and serverless functions. Processes request headers including IP addresses.
• Google Analytics 4 — website usage analytics. Data is anonymised and aggregated.
• Meta Pixel (Facebook) — advertising measurement and retargeting.
• Fonnte — WhatsApp messaging service used to send booking confirmations and alerts to our team.
• Xendit — payment gateway for processing transactions in IDR, USD, SGD, and AUD. PCI DSS compliant.
• Tawk.to — live chat widget. Messages and contact details provided in chat may be stored by Tawk.to.

We do not sell your personal data to any third party.

6. Data Retention

Booking records, customer contact details, and transaction data are retained indefinitely for business continuity, financial record-keeping, and legal compliance purposes. Usage analytics (GA4, Meta Pixel) are retained according to the default retention settings of those platforms.

If you request deletion of your personal data, we will remove or anonymise your information from our active systems within 30 days, subject to any legal retention obligations. Note that anonymised aggregate data (such as analytics summaries) may be retained after deletion.

7. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request that inaccurate data be corrected.
• Deletion — request that your personal data be deleted, subject to legal retention obligations.
• Data portability — request an export of your data in a machine-readable format.
• Opt out of marketing — unsubscribe from promotional communications at any time by replying "STOP" to any WhatsApp message or contacting us directly.

To exercise any of these rights, contact us at info@bajorental.com. We will respond within 14 business days.

8. Data Security

We take reasonable technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data transmitted between your browser and our servers.
• Row-level security (RLS) policies on our database to restrict data access by role.
• Payment data processed exclusively through Xendit's PCI DSS-compliant infrastructure — full card details are never transmitted to or stored on our servers.
• Access to production systems restricted to authorised team members only.

No method of transmission over the internet is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

9. Children's Privacy

Our platform is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal information without parental consent, please contact us and we will delete that data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our platform after any changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please reach out: