Privacy Policy

The data controller is CV Mapogu Jaya Sejahtera (Mapogu Coffee & Eatery), Jl. Goa Gong No.88x, Jimbaran, Kec. Kuta Selatan, Kabupaten Badung, Bali 80361.

For any privacy question or request, contact us via WhatsApp +62 878-7694-6888.

• Order and contact data: your name, WhatsApp or phone number, optional e-mail address, the items and notes in your order, and your order code.
• Delivery data: the address you choose, the map pin (coordinates), building, villa or room details and notes for the driver.
• Payment data: payment method, amount, status and reference numbers from the payment provider. We do not receive full card numbers or e-wallet PINs.
• Refund bank details: only when a refund has to be paid by bank transfer, the bank name, account number and account holder name you send us on WhatsApp, and the transfer reference.
• WhatsApp data: messages you send to our WhatsApp number and the delivery status of the messages we send you.
• Technical data: IP address, device and browser information, pages visited, page loading times and security signals used to block automated abuse.
• Advertising and analytics data: the ad click identifier and campaign parameters of the link you followed, Google Analytics and Google Ads cookie identifiers (see section 7 for when they are set), and the purchase details we report to Google (order code, food value, items).
• Marketing choices: whether you asked for promotions on WhatsApp, when you confirmed or withdrew that request, and from which WhatsApp message.

We do not ask for sensitive personal data such as health or religious information. If you mention an allergy in an order note, we use it only to prepare your order.

• To take, prepare, deliver and support your order, including WhatsApp status updates (performance of a contract with you).
• To process payments and refunds — including, when a refund must be paid by bank transfer, the bank account details you send us on WhatsApp — and to prevent fraud and misuse (contract, legitimate interest and legal obligations).
• To keep accounting and tax records (legal obligation).
• To send you promotions on WhatsApp — only if you tick the separate, unticked box at checkout AND then confirm your order from that same WhatsApp number, so nobody can sign up someone else’s number (consent). You can withdraw at any time by replying STOP (or BERHENTI) to our WhatsApp number or by contacting us; we confirm it on WhatsApp. Order updates are not promotions and continue.
• To measure visits to our website and the results of our advertising with Google Analytics and Google Ads. When our kitchen accepts your order, your browser reports the purchase (order code, food value and items — never your name, address or phone number to Google Analytics). For Google Ads “enhanced conversions”, your phone number (and e-mail, if you gave one) is sent to Google Ads in coded form (SHA-256 hashed), together with the ad click identifier, so that Google can match the order to an ad click. If the Google tag in your browser is blocked, our server sends the same purchase report to Google Analytics and Google Ads directly; if an order is refunded, we send Google the corrected order value.
• Legal basis for this measurement: if you are in the EEA, the United Kingdom or Switzerland, your consent — nothing of the above is used until you accept, and Google tags run in a restricted mode without cookies. Everywhere else (including Indonesia), our legitimate interest in measuring our advertising: it is switched on by default and you can object at any time with “Cookie settings” (choose Reject). A rejection stops the analytics and advertising cookies and deletes the stored ad click identifier. From that moment it also stops the hashed phone number, our server-side purchase reports and refund corrections for orders placed from that browser — later orders, and recent ones not yet reported.
• To keep the website secure and working well, including cookieless, aggregated visitor statistics and page-speed measurements with Vercel Web Analytics and Speed Insights (legitimate interest).

We share personal data only with service providers that process it for us (data processors), and only as far as needed:

• Supabase — database hosting (Singapore).
• Vercel — website hosting and delivery, and cookieless, aggregated visitor and page-speed statistics (Vercel Web Analytics and Speed Insights) (Singapore and a global network).
• Google — Google Analytics, Google Ads (including the hashed phone number or e-mail used for conversion measurement) and Maps address search (global, including the United States).
• Our payment provider: DOKU (PT Nusa Satu Inti Artha) — Indonesia.
• Couriers: Biteship (booking platform), GoTo (GoSend) and Grab (GrabExpress) — Indonesia. The driver receives your name, phone number, address and delivery notes so that the order can be delivered.
• Meta Platforms — WhatsApp Business Platform for order messages and your replies, including bank details you send us for a refund (global).
• Our bank — the account details needed to pay a refund by bank transfer (Indonesia).

We may also disclose data when the law requires it. We never sell your personal data.

Some of these providers store or process data outside Indonesia, for example in Singapore or the United States. We transfer data abroad only where the receiving country or provider ensures a level of protection equal to or higher than UU PDP, or where appropriate binding safeguards are in place, as required by Article 56 UU PDP and its implementing regulation.

• Accounting and tax records (order amounts, items, taxes, payments and refunds): 10 years, as required by tax law.
• Names, phone numbers, e-mail addresses, delivery addresses, order notes, IP addresses, device information and ad identifiers stored with an order: removed (anonymised) 24 months after the order. Customer records without an order for 24 months are deleted, except the phone number and dates we need to respect an active WhatsApp marketing consent or a withdrawal.
• Bank details for a refund: used only to pay that refund. The WhatsApp message containing them is deleted from our servers after 90 days, and staff delete it from the chat in our WhatsApp Business app once the refund has been paid; the transfer record (amount, date, reference) stays with the accounting records.
• WhatsApp: the texts of the messages we send and receive are deleted from our servers after 90 days (the chat itself is also visible in the WhatsApp Business app on our outlet phone, where staff answer you); the WhatsApp identifiers linked to your orders and your customer record are deleted 90 days after your last order or message. The record that a message was sent, its delivery status and Meta’s charge stay with the accounting records.
• Order status links: they stop working after at most 30 days (2 days for the checkout browser’s own link) and are deleted 90 days after that.
• The ad click cookie in your browser: 90 days. Google Analytics data at Google: 14 months.
• Marketing consent records (when and how you agreed or withdrew): while your consent is active, plus the period we need to prove it.

We use strictly necessary storage to run the shop: your cart and language preference in your browser, a cookie that gives you access to your order status page, your cookie choice and bot protection.

Google tags (Google Analytics and Google Ads) set analytics and advertising cookies. In the EEA, the United Kingdom and Switzerland they do so only after you accept in the cookie banner; until then they run in a restricted mode without those cookies. Elsewhere they are on by default (see section 3). When you arrive from one of our ads, we store the ad click identifier in a first-party cookie for up to 90 days to see which ads lead to orders (in the EEA, UK and Switzerland only after you accept).

You can change or withdraw your choice at any time with “Cookie settings” at the bottom of our pages (including your order status page), or with the button below. Choosing Reject switches off the analytics and advertising cookies, deletes the stored ad click identifier and, from that moment, stops the hashed phone number and our server-side purchase reports for orders placed from that browser, including an order you have just placed. Vercel Web Analytics and Speed Insights set no cookies. You can also delete cookies in your browser settings.

Under UU PDP you have the right to:

• be informed about how we process your data;
• access your data and receive a copy;
• correct inaccurate or incomplete data;
• have your data deleted or destroyed, and withdraw consent at any time (WhatsApp promotions: reply STOP; cookies and ad measurement: “Cookie settings”);
• object to decisions based solely on automated processing;
• restrict or suspend processing;
• receive your data in a commonly used format (data portability);
• claim compensation for a breach of the law.

Send your request via WhatsApp +62 878-7694-6888. We may ask you to confirm your identity (for example with your order code and phone number) and will respond within the time limits set by UU PDP.

We protect your data with encrypted connections (HTTPS), access controls, hashed access tokens and by keeping secrets out of the browser. If a personal data breach affects you, we will notify you and the competent authority in writing within 3 × 24 hours, as required by UU PDP.

Our service is intended for adults. If you are under 18, please order with the consent of a parent or guardian.

If you have a concern about how we handle your data, please contact us first via WhatsApp +62 878-7694-6888. You may also complain to the supervisory authority for personal data protection; until the dedicated agency is established, this is the Ministry of Communication and Digital Affairs (Komdigi).

We may update this policy. The version and effective date are shown at the top of this page; if a change is significant, we will tell you on the website before it applies.