Privacy Policy
Last updated:
This translation is provided for convenience. If it differs from the Indonesian version, the Indonesian version prevails.
1. Who we are
This policy explains how BizCore ("we"), which operates BizCore Suite, processes personal data under Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "PDP Law").
2. Data we process
(a) Sign-up and account data: name, email, phone number, business name, and your password (stored only as a hash). (b) Data you and your team put into BizCore, including data about your business's employees, patients, customers or suppliers. (c) Usage and technical data: IP address, device and browser type, activity and sign-in logs. (d) Payment data: invoices, transfer proofs and payment status — we do not store card numbers. (e) Messages you send us through the contact form, email or WhatsApp.
3. Why we process it
To create and secure accounts (including sending verification codes); to provide the features you use; to bill and verify payments; to send service notifications; to give support; to prevent abuse; and to meet legal obligations. We do not sell personal data.
4. Legal basis
Performing our agreement with you (the Terms of Service); the consent you give when signing up, which you may withdraw; legal obligations; and our legitimate interest in keeping the service secure.
5. Data your business keeps about others
For data your business keeps about other people (employees, patients, customers), your business is the controller and we process it on its instructions. Requests from those people are passed on to your business.
6. Where data is stored
BizCore's SaaS service runs on servers in Indonesia; its database and the files you upload are stored there. Self-hosted customers keep their data on their own servers. Some providers listed below may process data outside Indonesia; when they do, we send only what is needed and ensure protection at least equal to what the PDP Law requires. We will update this policy before moving primary storage outside Indonesia.
7. Who we share it with
Only with: email and messaging providers (including Meta's WhatsApp Business Platform) to send codes and notifications; payment providers to process invoices; artificial-intelligence providers (such as Anthropic and Google) only when you use an AI feature, limited to that request; a website analytics service (Google Analytics) for visit statistics; and authorities when the law requires it. Every provider is bound to confidentiality.
8. How long we keep it
Account data is kept while the account is active. Business data is not deleted because of a plan change. After an account is closed, data is kept for at least 30 days for export and then deleted on written request, unless the law requires longer retention (for example financial and tax records). Sign-ups that are never verified expire on their own. Messages sent through the contact form are kept as long as needed to answer and follow them up, and are deleted on request.
9. Security
Connections use HTTPS, passwords are stored only as hashes, and access is limited by business and by role. No system is perfectly secure; if a personal data protection failure occurs, we notify you and the authorities as the PDP Law requires.
10. Browser storage and cookies
The site and the app use your browser's local storage for your sign-in session and preferences such as language and theme, and Google Analytics cookies for visit statistics. You can clear them in your browser settings; without the session storage you cannot stay signed in.
11. Your rights
Under the PDP Law you have the right to be informed; to access and obtain a copy of your data; to correct it; to ask for it to be deleted or for its processing to be limited; to withdraw consent; and to object. Send requests to Contact; we respond within the time the PDP Law sets.
12. WhatsApp data
If you contact us over WhatsApp, we process your phone number, WhatsApp profile name, message content and delivery status. We use this to answer your requests, send transaction notifications you agreed to, and keep support records. We do not use it for advertising and do not sell it. Messages are sent through Meta's WhatsApp Business Cloud API, so Meta also processes this data under its own privacy policy. How to delete it is explained on the Data Deletion page.
13. Changes to this policy
We may update this policy. Material changes are announced by email or in the app before they take effect.
14. Contact
Privacy questions: BizCore, Contact. Our address is shown at the bottom of this page.