Privacy policy
Last updated: 28 October 2026
Servasi (servasi.id) is a booking page service for rental businesses. This policy explains what data we process, why, how long it is kept, and your rights over it.
Who is responsible
- For business owner accounts, Servasi is the data controller.
- For customer data on a business's booking page, that business owner is the controller, and Servasi processes the data on the owner's behalf.
Data we process
- Business owners: name and email from the Google account used to sign in, business details (name, page address, opening hours, items, prices), payment details (QRIS image, bank name, account number and holder), and the devices and Telegram chats linked for alerts.
- Customers: name, WhatsApp number, email if given, the booking (items, times, price, notes), payment proof photos, and a KTP photo only when the business asks for one.
- Technical data: error reports without form contents or secret booking links (Sentry), a security check when a form is sent (Cloudflare Turnstile), and possibly cookie-free visit statistics (Cloudflare Web Analytics).
Why
- To run bookings: show availability, prevent double bookings and send status.
- To help owners check payments and, when they ask for it, the renter's identity.
- To send booking alerts to owners.
- To keep the service safe, including preventing misuse of pages.
We do not sell data, do not use customer data for advertising, and do not share one business's data with another business.
How long it is kept
- KTP photos: deleted automatically 1, 3 or 7 days after the rental ends or is cancelled, as the owner chooses. Deletion pauses during a dispute.
- Payment proof photos: deleted automatically 30 days after the rental ends.
- Bookings, customers and notes: kept while the business is on Servasi.
- Price requests that did not go ahead: deleted after 30 days.
- When a business is deleted, all its data and files are deleted within 30 days.
Where it is stored and how it is protected
Data is stored with Supabase and Cloudflare, including servers outside Indonesia. Each business can only read its own data. KTP and payment proof photos are kept in private storage, opened only through short-lived links for the business they belong to, and every KTP view is logged.
Your rights
- Customers: to see, correct or delete your booking data, contact the business you booked with. We help the owner when needed.
- Business owners: you can change your business data in the dashboard and ask us to delete your account and all your business data.
Moving data from a spreadsheet
If you ask us to move your old booking records in, we use the file only for that move and delete it no later than 7 days after it is done.
Changes
When this policy changes, the date above changes too. We announce important changes in the dashboard.
Contact
Email info@servasi.id.