Privacy Policy
This Privacy Policy explains how TODO-FILL: legal operating entity, e.g. "PT Skeddo Indonesia" (“Skeddo”, “we”, “us”) collects, uses, shares, and protects your personal data when you use the Skeddo mobile application and this website (together, the “Service”). We act as the data controller and process personal data in accordance with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”) and applicable platform requirements.
1. Who we are
The data controller is TODO-FILL: legal operating entity + registered address.
We have appointed a Data Protection Officer (DPO) you can contact about anything in this policy: privacy@skeddo.com.
2. Data we collect
| Category | Examples | Why |
|---|---|---|
| Account & profile | Name or alias, email address, profile photo, the groups you belong to, your role and “about” notes | To create your account and let your group recognise you |
| Content you create | Events, announcements, polls, documents, forum posts, chat messages, RSVPs | To provide the core features of the Service |
| Payment information | Amount, status, and a payment reference for dues, event fees, or donations | To process payments you choose to make. Card/e-wallet details are handled by our payment processor, not stored by Skeddo |
| Technical data | Device type, app version, log and diagnostic data, IP address | To keep the Service secure, reliable, and to fix problems |
You can use Skeddo without providing a profile photo or “about” notes — these are optional.
3. How we use your data
- To operate, maintain, and improve the Service;
- To show your group its members, events, announcements, and activity;
- To process payments you initiate (dues, event fees, donations);
- To send service-related notifications (e.g. a new announcement or join request);
- To keep an audit record of administrative actions (such as removing a member or deleting content) so group owners can see who did what;
- To protect against fraud, abuse, and security incidents, and to comply with the law.
4. Legal basis
Under UU PDP we process your personal data on one or more of these bases: your consent (given when you create an account and agree to this policy); the performance of our agreement with you (the Terms of Service); our legitimate interests in operating a secure Service; and compliance with legal obligations. You may withdraw your consent at any time (see Section 9).
5. Specific (sensitive) personal data
UU PDP gives stronger protection to “specific personal data”. The Service may process financial/transaction data (when you make a payment) and, where a group’s members include minors, children’s data. We process such data only as needed to deliver the feature you requested, apply additional safeguards, and do not use it for unrelated purposes. We do not ask for health, biometric, genetic, religious, or political data, and ask that you do not post it.
6. How we share your data
We do not sell your personal data. We share it only as needed to run the Service:
- With your group. Content you post and your profile are visible to other members of the groups you join, according to that group’s settings and your role.
- Service providers (data processors):
- Supabase — our database, authentication, file storage, and backend hosting.
- Xendit — our payment processor (a Bank Indonesia–licensed provider) for dues, event fees, and donations.
- Legal & safety. Where required by law, or to protect the rights, safety, and property of Skeddo, our users, or the public.
7. International data transfers
Some of our processors (such as Supabase) may store or process data on servers outside Indonesia. When we transfer your personal data abroad, we do so consistent with UU PDP Article 56 — i.e. to a jurisdiction with a comparable level of protection, under adequate binding safeguards, or with your consent.
8. Data retention
We keep your personal data for as long as your account is active. When you delete your account, we delete your personal data and personal content (see Section 10). Content you contributed to a group (such as an event or announcement) may remain in that group with your authorship removed (anonymised), and we may retain limited transaction records where required for accounting, tax, or legal purposes.
9. Your rights
Subject to UU PDP, you have the right to:
- be informed about, and access, the personal data we hold about you;
- correct or update inaccurate or incomplete data;
- delete or erase your data (the “right to be forgotten”);
- withdraw consent you previously gave;
- object to or restrict certain processing, including automated decision-making;
- data portability — obtain your data in a usable format;
- lodge a complaint with the relevant Indonesian data-protection authority; and
- seek compensation for a violation of your rights under UU PDP.
You can exercise most of these directly in the app (edit your profile, leave a group, or delete your account). For anything else, contact our DPO at privacy@skeddo.com. We respond within 14 days.
10. Deleting your account
You can permanently delete your account at any time: in the app, go to Settings → Account → Delete account. This removes your profile and personal data and signs you out. If you are the sole owner of a group, you will be asked to transfer ownership or delete that group first. You can also request deletion via our account deletion page.
11. Data breach notification
If a personal-data breach occurs that affects you, we will notify you and the relevant Indonesian authority without undue delay and, where required by UU PDP, within 3×24 hours (72 hours) of becoming aware of it, describing the affected data and the steps we are taking.
12. Security
We use industry-standard measures — encryption in transit, access controls, and row-level security on our database — to protect your data. No method of transmission or storage is 100% secure, but we work to protect your information and to address vulnerabilities promptly.
13. Children
Skeddo is not directed to children under 13. Where a user is a minor under Indonesian law, processing requires verifiable parental or guardian consent, and we will obtain or rely on it as required. We do not knowingly collect children’s data without such consent; if you believe a child has provided us personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the “Last updated” date. Significant changes may also be notified in the app.
15. Contact
Questions about this policy or your data? Email our DPO at privacy@skeddo.com or our general contact privacy@skeddo.com.