Privacy policy
The personal data we collect, why, and your rights over it.
In short
- We collect the data needed to run accounts, bookings, and payments.
- Identity documents, bank accounts, addresses, and messages are stored encrypted.
- We do not sell personal data and do not use advertising cookies.
- You can download a copy of your data and request account closure from the Account page.
This summary only helps you read. The full text below is what applies.
1.Who manages your data
PT Spesialis Talenta Nusantara operates Spesialis from Sukmajaya, Depok and determines why and how personal data is processed on the platform as the data controller.
2.Data we collect
Account data: name, email address (received from Google when you sign in with your Google account), gender, language choice, and the addresses you save. Booking data: service, schedule, service address and its map point, booking notes, payments, balance, the bank account you pay out to, and where your refunds go (a wallet phone number or a bank account with its holder name). To prevent mass account creation, we keep a hash of the network a new account signs up from for one day. If you turn on browser notifications, we store that device's subscription address and notification keys until you turn them off, sign out on that device, or close your account.
Delivery data: photos or location as start and completion evidence, messages and their photo and video attachments, complaints, and reviews with their photos. Professional and business data: profile, photos, schedule, service area, and agreements. Professionals and their businesses can also record the name, phone number, and email of customers who book with them directly; that email is used for payment-link receipts and payment history, and to send receipts and updates about that booking, including schedule changes or refunds when applicable. Identity verification data, if you submit it: your name, NIK, and a photo of your KTP; the NIK and photo are stored encrypted, the name on your KTP is used as the holder name of your payout bank account, and a professional's verification status decides whether their home visits are shown to customers.
For identity verification, we ask for your consent before the camera captures a series of face images to check that you are present. We analyze the images, may store one image per attempt in encrypted form, and record the result. Images unused in an application are deleted after their result expires. Authorized staff can review the image used in an application. It is deleted if the application is rejected, verification is revoked, or the account is closed.
Spesialis does not ask for your medical history. Avoid including health data in notes, messages, complaints, or reviews.
To prevent fraud and abuse, every significant action on your account (signing in, booking, paying, sending messages and attachments, reporting, changing your bank account or refund destination, withdrawing balance, and actions by the Spesialis team) is recorded with its time, session, device (a random id in a device cookie, the device type and model, and the browser), your IP address together with its country, and any location you send with that action; all of that device, network, and location data is stored encrypted. These records are for internal use only, are protected by integrity checks, and are opened only by the Spesialis team to investigate abuse; every opening is itself recorded. A session that is suddenly used from another device is ended to keep your account safe. Sealed records are deleted periodically after their retention period ends.
For QRIS payments, the payment provider sends the payer's name. It is stored encrypted only to check refund destinations, and deleted when the account is closed.
3.Purposes and legal basis
To perform our agreement with you: creating your account, showing and running bookings, processing payments, refunds, and payouts, and sending account and booking updates.
To meet legal obligations, such as keeping transaction records. For legitimate interests: keeping accounts secure, preventing misuse, and handling complaints and disputes.
Where processing needs your consent, we ask for it first, and you can withdraw it at any time.
5.Retention and location
We keep active account data to provide the service. After closure, some data is retained for legal obligations, transaction records, dispute resolution, and security. Message text, attachments, and evidence photos are scheduled for deletion no earlier than one day after the booking is settled. An ongoing review may delay deletion.
We retain the email address and any verified NIK of a closed account in encrypted form with keyed hashes and no expiry date. We use these records to prevent reuse of the email address and NIK. You can submit requests about those records through the Contact page.
Browser notifications you enable are delivered through browser push services that may operate outside Indonesia. Push notification contents are encrypted.
6.Your rights
You have the right to be informed about how your data is processed, to access it and get a copy, to correct inaccurate data, to ask for processing to stop or data to be deleted, to withdraw consent, and to object.
On the Account page, you can correct some information, download a copy of your personal data, and request account closure. Closure waits for outstanding agreements, bookings, balances, and refunds to be resolved. Use the Contact page to request additional access, correction, withdrawal of consent, restriction, or deletion. We handle requests within legal deadlines and may ask you to verify your identity to protect your data.
7.Security and incidents
Access to data is limited by role, and booking evidence is only opened through time-limited links.
If a personal data protection failure involves your data, we will notify you in writing within the time limit set by law, with the data affected, when and how it happened, and the steps taken.
9.Changes to this policy
Changes to this policy are announced on this page before they take effect.