Privacy Policy

1. What we collect

We only collect what the service needs to work:

• Account: your email address and, if you sign in with Google, the name and email that Google shares with us. We never see your Google password.
• Profile: your name, country, phone number (optional), preferred language and currency.
• Guides: profile text, languages, service areas, packages and prices, weekly schedule, and verification documents (ID card, selfie, and licence or certificates if you upload them).
• Bookings: the tour, date and time, number of guests, meeting point, notes you write, and the names shown to the other party.
• Payments: the order reference, payment method type, amount and status. Cards, e-wallets and bank transfers are handled by our payment provider Midtrans; we never receive or store your full card number.
• Messages and reviews: the chat messages you send about a booking, and the reviews you write.
• Notifications: your notification history and, if you turn on alerts, your browser's push subscription (an address and keys issued by your browser's push service).
• Technical: your IP address and email are used briefly to limit repeated sign-in attempts, and our servers keep standard logs for security and fixing errors.

2. How we use it

• To create your account, sign you in and keep your session secure.
• To show guides to travellers, take and manage bookings, process payments and refunds, and let you chat.
• To verify that guides are who they say they are before they are listed.
• To send service notifications about your bookings (in the app, and by browser push if you enable it).
• To prevent fraud and abuse, enforce our Terms, and handle support requests and disputes.
• To meet legal, accounting and tax obligations.

We do not sell your personal data and we do not show advertising.

3. Chat messages

Before a booking is confirmed, and outside the days around the tour, our system automatically hides phone numbers, email addresses, links and social handles in chat so that bookings and payments stay on Guidelo. Our team may read messages when needed to investigate a report, a dispute or abuse.

4. Who we share it with

• The other person in a booking: a guide sees the traveller's first name, country, group size, meeting point and notes; a traveller sees the guide's public profile.
• Everyone: a guide's public profile (name, photo, headline, bio, languages, areas, prices, ratings and reviews). Reviews show only the reviewer's first name and country.
• Service providers who process data for us: Supabase (database, sign-in and file storage, Seoul, South Korea), Vercel (website hosting, Seoul, South Korea), Midtrans (payments, Indonesia), Brevo (delivery of the sign-in link emails we send you), Upstash (temporary rate-limit counters, Singapore), Google (only if you choose Google sign-in), and your browser's push service (only if you enable alerts).
• Public services your browser contacts directly: OpenStreetMap (map tiles; they see your IP address when a map loads).
• Authorities, when the law requires it.

5. Where your data is processed

Your data is stored mainly in South Korea and Singapore, and handled by providers that may process it in other countries. Where required, we rely on contractual safeguards from those providers.

6. Cookies and similar storage

We use only strictly necessary cookies: a sign-in session cookie, and small preferences for your language and display currency, plus a flag that remembers you have already seen the welcome animation (it is deleted when you close the browser). We do not use advertising or analytics cookies. A small service worker is registered on the Notifications page so that push alerts can work; it only runs if you turn alerts on.

7. How long we keep it

• Account and profile data: while your account is active.
• Bookings, payments, refunds and the chat and reviews linked to them: as long as needed for accounting, tax, legal and dispute purposes.
• Guide verification documents: while the guide account is active, and for a limited period afterwards unless the law requires longer. They are kept in a private store and opened only through short-lived links by our verification team.
• Sign-in rate-limit data: minutes to hours.

8. Your rights

Depending on where you live (for example under Indonesia's Personal Data Protection Law, Law No. 27 of 2022, or the EU GDPR) you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent you gave. You can turn off push alerts at any time in your browser settings or on the Notifications page. Email us at guidelolombok@gmail.com. We may need to keep some records (for example payments) where the law requires it.

9. Security

We use encrypted connections, access rules that limit each account to its own data, a private store for verification documents, and mandatory two-factor authentication for guides and administrators. No system is perfectly secure; please use a strong email password and keep your devices safe.

10. Children

Guidelo is not directed to children under 16 and we do not knowingly collect their data. Parents or guardians should make bookings for minors.

11. Changes and contact

We may update this policy and will change the date above when we do; for material changes we will tell you in the app. Questions or requests: Email us at guidelolombok@gmail.com.