Data Collection Policy

This page transparently explains what data menurutlo collects, why we collect it, the legal basis for processing it, and which third-party services are involved.

The menurutlo platform is operated by PT. Kreasi Lintas Cakrawala. This policy is part of our Privacy Policy and should be read together with our Terms & Conditions.

Data We Collect & Why

Account & Profile Data

What: Name, username, email, phone number, date of birth, profile photo, bio, city, gender (optional)

Why: Required to create and maintain your account; age verification to keep the platform safe in compliance with PP TUNAS.

Legal basis: Contract performance; legal obligation (PP TUNAS / Permenkomdigi 9/2026)

Stored at: Supabase database (Singapore region)

Control: You can update your profile data at any time in Settings → Edit Profile

Content Data

What: Posts, videos, photos, stories, loops, testimonials, Ask questions, comments, direct messages (DMs), moods, check-ins

Why: Core platform functionality

Legal basis: Contract performance; consent

Stored at: Supabase (text and metadata); Cloudflare R2 (photos, documents); Cloudflare Stream (video)

Control: You can delete your own content at any time. Account deletion removes all content within 30 days.

Location Data

What: GPS coordinates

When collected: Only when you actively use the Check-in or Nearby feature — never collected in the background

Why:

• Check-in: Displays activity at a location and stores your check-in history. Check-in location data is stored permanently as part of your content.
• Nearby: Shows other users near you (opt-in, 18+ for standard access; ages 16–17 use a separate pool with fuzzy location and a maximum 2km radius). Nearby session data is not retained after the session ends.

Legal basis: Explicit consent

Stored at: PostGIS on Supabase

Control: You can disable location access at any time in your device settings. Nearby can be turned off in Settings → Privacy → Nearby.

Voice Data

What: Audio recordings when you use the Voice-to-Text feature

Why: Transcription to text via Google Speech-to-Text (Indonesian language model)

Legal basis: Consent

Stored at: Forwarded to Google Cloud Speech-to-Text and deleted within 24 hours of transcription. We do not permanently store audio recordings.

Third party: Google LLC (Google Cloud Speech-to-Text) — privacy policy: policies.google.com/privacy

Control: You choose when to use Voice-to-Text. It is never activated automatically.

AI Processing & Moderation

What: Text content you submit (posts, comments, testimonials, Ask questions)

Why: Content moderation (anti-bullying, illegal content detection, child safety); AI Refine feature for improving written content

Legal basis: Legitimate interest (platform safety); contract performance

Third party: Anthropic PBC (Claude Haiku) — used as a moderation API. For information on how Anthropic handles data passed through their API, see Anthropic's privacy policy at anthropic.com/privacy. menurutlo does not control third-party data retention policies.

Note: All content passes through the moderation pipeline before publication.

AI Companion Data (Luna, Ray, Maudy, Lody)

What: Information you share in conversations with AI companion characters, including nicknames, preferences, and conversation context stored as bot memory

Why: To provide a more personal and continuous conversation experience

Legal basis: Consent

Stored at: Supabase (conversation text and context memory)

Control: You can reset your companion bot's memory through the companion chat page. Account deletion removes all bot conversation data.

Analytics Data

What: Feature usage events, screen views, interaction patterns

Why: Understand how users use the app in order to improve it

Legal basis: Legitimate interest; consent

Third party: Mixpanel Inc. — privacy policy: mixpanel.com/legal/privacy-policy

Control: You can opt out in Settings → Privacy → Data & Analytics

Crash & Error Data

What: App crashes, error logs, device information (model, OS, app version)

Why: Fix bugs and improve app stability

Legal basis: Legitimate interest

Third party: Functional Software Inc. (Sentry) — privacy policy: sentry.io/privacy

Push Notifications

What: Expo push token, FCM registration ID

Why: Deliver in-app notifications to your device

Legal basis: Consent

Third party: Expo Inc. (notification delivery) — privacy policy: expo.dev/privacy

Control: Disable at any time in Settings → Notifications or in your device settings

Payment Data

What: Transaction status, payment amount, order reference

Why: Process payments for premium subscriptions and paid features

Legal basis: Contract performance

What we do NOT store: Card numbers, CVV, bank account details, or any other sensitive payment information — all processed directly by the payment gateway

Third parties: PT Midtrans (primary payment gateway) — privacy policy: midtrans.com/en/privacy-policy; PT Xendit Pembayaran Indonesia (backup payment gateway) — privacy policy: xendit.co/id/privasi

Identity Verification Data

Feature status: Identity verification via national ID (KTP) is currently in development and not yet active for all users.

When the feature becomes active:

• KTP photos will be processed for age and identity verification purposes
• KTP photos are deleted immediately after the verification process is complete — not stored on our servers
• Only verification status (verified/not verified) and year of birth are retained

Legal basis: Legal obligation; explicit consent

Data We NEVER Collect

• KTP photos after verification is complete — permanently deleted
• Sensitive payment data (card numbers, CVV, bank account details)
• Anonymous Testimoni sender identity in accessible form — encrypted, never exposed
• Your contact list without explicit permission
• Location data in the background — only when you are actively using Check-in or Nearby
• Browsing data outside the menurutlo app

Third-Party Services Summary

All service providers listed above are bound by data processing agreements with PT. Kreasi Lintas Cakrawala. Data transfers to providers located outside Indonesia are conducted with adequate safeguards in accordance with UU PDP Article 56.

Your Rights Over This Data

You have the right to request access, correction, deletion, or portability of your data at any time. See our Privacy Policy for full details on your rights.