Sign in with Google (Google User Data)

You can create a Livuma account or sign in with your Google account. This section explains exactly which Google user data Livuma receives, how we use, store and share it, and how you can have it deleted.

Data We Receive from Google

We request only the basic sign-in permissions (openid, email and profile). With your permission, Google shares with us:

We do not request access to your Gmail, Google Drive, Calendar, contacts or any other Google service, and we do not store Google access or refresh tokens. We never receive your Google password.

How We Use Google User Data

We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models.

Storage, Sharing and Deletion

Your name, email address and Google account identifier are stored as part of your Livuma account profile on our servers (Hetzner, Singapore) and protected as described in Section 10. We do not share Google user data with third parties, except as part of your account information where Section 3 describes it (for example, your name shown to a host when you make a booking) or where required by law. You can disconnect Google from your account at any time in your account security settings, or revoke Livuma's access at myaccount.google.com/permissions. To delete your account together with the Google user data stored with it, contact us at hello@livuma.com (subject to the retention limitation for financial records described in Section 11).

How We Protect Google User Data

Google user data is only ever transmitted over encrypted HTTPS connections (TLS, with HTTP Strict Transport Security enforced on livuma.com), and the sign-in exchange with Google uses the OAuth 2.0 authorization code flow with PKCE, so your Google password never reaches us. The data is stored in our access-controlled database, which is not publicly reachable. Access is limited to authorised Livuma staff who need it to support your account, and staff access to account data is logged.

How Long We Keep Google User Data

We keep your Google account identifier, name and email address for as long as your Livuma account exists. If you remove the Google connection in your account security settings, the Google account identifier is deleted immediately. If you delete your account (Account → Personal data → Delete account), your account and the Google user data stored with it are deleted immediately. If your account has booking or payment history, it cannot be deleted on its own; email hello@livuma.com and we will delete the Google connection and anonymise everything that is not part of those financial records, which we must keep for the legally required period described in Section 11.

Google API Services User Data Policy

Livuma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

1. Information We Collect

Personal Data

When you register for an account, list a property, or make a booking, we may collect:

Usage Data

We automatically collect certain information when you visit, use, or navigate our platform. This information may include:

2. How We Use Your Information

We use your information for various purposes, including:

3. Sharing Your Information

We may share your information with:

We do not sell your personal information to third parties.

4. Matching Notifications

Our platform includes a matching feature that helps connect hosts with potential tenants based on property listings and tenant inquiries.

By using our service, you acknowledge and consent to the following:

We implement appropriate safeguards to ensure this personal information is processed securely and in accordance with applicable data protection laws.

5. AI Features and CRM

We use AI-powered tools to assist with customer relationship management (CRM) and communication features on our platform.

AI Service Provider

We use OpenAI's API to power certain CRM and communication features. Where AI features process your data, we share only the minimum information necessary with OpenAI. OpenAI acts as a data processor on our behalf and is bound by a Data Processing Agreement. OpenAI's own privacy policy governs how they handle data on their infrastructure.

What Data Is Used

AI features may process: messages and inquiries you send via the platform, listing content, and basic account information. We do not use AI for automated decision-making that produces legal or similarly significant effects on individual users without human oversight.

Chat Assistant in Pre-Booking Chats

When a guest and a host chat about a listing before a booking exists, each message, together with the few messages before it, is checked automatically by our AI provider (OpenAI) — normally before it is delivered; if the check is briefly unavailable, the message is delivered and checked shortly after. The purpose is your safety and the protection of bookings made through Livuma: contact details such as phone numbers, email addresses and messaging accounts are removed from the message (they can be shared once a booking is confirmed), attempts to arrange payment outside Livuma trigger a warning, and common questions about how Livuma works are answered. Messages are sent with the roles "guest" and "host" only, without names or account details. Where details are hidden, only the message with those details removed is stored. Messages are never refused because of this check. This applies to both guests and hosts; guests are also shown it when they start a chat. Authorised Livuma staff may read these chats (read-only; every access is logged) to keep the platform safe and to improve the assistant and its help texts. Photos and files are not checked.

CRM Data

We maintain a CRM system to manage communications and relationships with users of the platform. CRM records may include contact details, communication history, and interaction preferences. This data is used solely for the purpose of improving our service to you and is not shared with or sold to third parties for marketing.

6. Payment Processing and Escrow Services

When you make a booking through our platform, we use Xendit as our primary payment service provider to securely handle payments, payouts, and refunds.

Payment Processing

Payment card information (credit/debit card numbers, CVV, expiration dates) is collected and processed directly by our payment processors. We do not store or have access to your full payment card details. Payment processors may store your payment method information (tokenized) for future transactions with your consent.

Escrow and Payment Holding

For direct bookings, Livuma holds guest payments in an escrow-like arrangement until check-in or as otherwise specified in the booking terms. Payment amounts, minus the platform fee, are then released to the host's Indonesian bank account according to our payout schedule. This process requires us to share booking and payment information with both guests and hosts, as well as with Xendit.

Host Payout Data

To process payouts, hosts must provide their Indonesian bank account details (bank name, account holder name, account number). This information is shared with Xendit to facilitate payout transfers. We check the account details for completeness and compare the account holder name with the verified identity of the host or owner; the receiving bank may additionally refuse a payout whose account holder name does not match its records. We retain payout records as described in the Financial Data Retention section below.

Property Owners Receiving Payouts

Agents and agencies who manage a property on behalf of its owner can ask us to pay the rental payouts for that property directly into the owner's bank account. The agent or agency remains our contracting party; the payment to the owner is a payment instruction given by the agent or agency. Owner data reaches us in one of two ways:

We use owner data only to route payouts to the owner, to check that the bank account is held in the owner's name and is not already registered under another name, to prevent fraud and money laundering, and to issue booking and payout documents. Where an agency registered the owner, we send the owner a WhatsApp notice (via Meta, see Section 8) stating which agency registered them, for which properties, and the bank and last four digits of the account their payouts go to. The notice links to a page where the owner can confirm the instruction or report that the registration or account is not theirs; such a report stops all payouts to that account immediately and is reviewed by our team. We pay into an account registered by an agency only after the owner has confirmed it on that page; until then the owner's payouts wait and are never paid to anyone else. Owner bank details are shared with Xendit to make the transfers.

Legal basis (Law No. 27 of 2022, Article 20): payouts to an owner are made on the owner's explicit consent (Article 20(2)(a)), given when the owner onboards themselves or confirms the notice; no payout is made to an agency-registered owner before that confirmation. Before it, we rely on our legitimate interest (Article 20(2)(f)) only to hold the details the agency provided and to send the owner the notice so they can decide. Payout records are also kept to meet our legal obligations under tax, accounting and anti-money-laundering law (Article 20(2)(c)). The agent or agency that provides an owner's details is a separate data controller towards the owner and is responsible for its own lawful basis for sharing them with us.

Retention: owner payout records (name, masked and full bank details, payout amounts and dates) are kept for at least 10 years under Indonesian tax and accounting law; the record of an owner's confirmation or objection is kept for the same period as evidence. An owner registration that never received a payout and was not objected to can be deleted on request.

Owner rights: owners may exercise the rights described in Sections 11 and 13 — including access, correction, objection and withdrawal of consent — by contacting us at hello@livuma.com, whether or not they hold a Livuma account. Objecting to or withdrawing consent for an agency registration stops payouts to the owner's account; the agent or agency then remains responsible for settling with the owner directly.

Data Shared with Payment Processor

When processing payments, we share with Xendit: your name, email address, billing address, payment amount, booking details, and device/IP information for fraud prevention. Xendit collects and processes your payment card information directly; we do not store full card numbers. Xendit's own privacy policy and terms of service govern how they handle your data.

Financial Data Retention

We retain payment and transaction records for a minimum of 10 years as required by applicable tax and accounting laws. This includes booking amounts, service fees, refunds, and payout records. Host payout information is retained for the same period for tax reporting purposes.

7. Identity Verification (KYC)

To ensure the safety and security of our platform, we require identity verification (Know Your Customer - KYC) for users making direct bookings. This verification is conducted through third-party KYC providers.

KYC Provider

We use Didit as our identity verification provider. Didit collects and processes your ID documents and selfie solely for verification purposes. We receive the verification outcome (approved / declined / in review) and, upon successful verification, your verified full legal name as confirmed by the identity document. We store your verified name to display your verified identity on the platform and to satisfy our anti-money-laundering record-keeping obligations. We do not store copies of your identity documents, selfie photos, or raw biometric data — those remain with Didit in accordance with their privacy policy. By completing identity verification, you acknowledge that your data may be processed outside Indonesia with appropriate data protection safeguards in place.

Biometric and Special-Category Data

The KYC process involves collection of biometric data (selfie photographs and/or live video) by Didit for the purpose of identity verification. Biometric data is classified as special-category (sensitive) personal data under applicable data protection law. By proceeding with KYC verification, you provide explicit consent to this processing. You may withdraw consent at any time by contacting us, however this will prevent you from making direct bookings on the platform.

Information Collected for KYC

To complete identity verification, you may be asked to provide:

How KYC Data is Processed

KYC providers analyze your documents and biometric data to verify your identity. This verification result (approved/rejected) is shared with us, along with your verified legal name. KYC providers may store your verification documents and biometric data in accordance with their own privacy policies and legal requirements, including anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.

KYC Data Retention

KYC verification records (outcome, verified name, session reference) are retained for a minimum of 5 years from the date of verification, or as required by applicable AML/CTF regulations in Indonesia and other jurisdictions where we operate. This retention period may be extended if required by law or if your account is involved in any disputes or investigations.

Access to KYC Data

We do not have direct access to your full identity documents or biometric data. We only receive verification status and confirmation of your verified legal name. Full KYC documents are stored securely by Didit. In certain circumstances, such as legal investigations or disputes, we may request access to verification records from Didit.

8. WhatsApp Integration

Our platform uses WhatsApp to send booking notifications, payment reminders, and operational updates to users.

WhatsApp Service Provider

We use Meta's WhatsApp Cloud API to send WhatsApp messages. Meta acts as a data processor on our behalf.

Data Shared via WhatsApp

When messages are sent via WhatsApp, we share:

Message Log Retention

We retain WhatsApp message delivery logs (recipient phone number, template name, delivery status, and message parameters) for 24 months for audit, support, and dispute resolution purposes. After 24 months these logs are deleted or anonymized.

WhatsApp Privacy

Meta (Facebook) has its own privacy policy that governs how it handles data sent through its WhatsApp Cloud API service. By using our messaging features, you acknowledge that your phone number and message content may be processed by Meta in accordance with their privacy policy and terms of service.

Opt-Out

You can opt out of non-essential WhatsApp notifications (news, promotions, matching alerts) in your account notification settings. Critical booking and payment communications — such as payment links, booking confirmations, check-in reminders, and refund notifications — may still be sent via WhatsApp as they are necessary to fulfil the services you have requested and cannot be disabled without cancelling active bookings.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your browsing activities. These technologies help us deliver a better and more personalized service, analyze usage patterns, and target ads.

You can change or withdraw your consent for analytics and advertising cookies at any time using the "Cookie settings" link in the footer of this page, our Cookie Policy and our homepage. Withdrawing is as easy as giving consent and takes effect immediately. You can also set your browser to refuse all or some cookies or to alert you when cookies are being sent, though some parts of the site may not function properly without them.

Where consent is required by law (the EEA, the United Kingdom and Switzerland), analytics and advertising cookies stay switched off until you accept them. Elsewhere they are enabled by default and you may opt out at any time using the same link. Cookies that are strictly necessary — keeping you signed in, remembering your language, protecting forms against forgery, and recording the cookie choice itself — are always active, as the site cannot function without them.

For more information about our cookie practices, please see our Cookie Policy.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have certain rights regarding your personal information, including:

Limitation on Data Deletion

Where you have completed bookings or payment transactions on our platform, we are legally required to retain financial and transaction records for a minimum of 10 years under applicable Indonesian tax and accounting law (and a minimum of 5 years for KYC records under AML/CTF regulations). In such cases, we can anonymize non-essential personal data (such as communications and profile details) but cannot fully erase records linked to financial transactions. You will be informed at the time of any deletion request if this limitation applies.

To exercise these rights, please contact us at hello@livuma.com.

12. GDPR Compliance for European Users

For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (GDPR).

Legal Basis for Processing

We process your personal data on the following legal bases:

Your Enhanced GDPR Rights

As an EEA resident, you have additional rights including:

EU Representative

As a company established outside the EEA that offers services to EEA residents, we are in the process of appointing an EU representative as required by GDPR Article 27. Until our representative is formally designated, EEA residents may direct data protection queries to: hello@livuma.com. We will update this policy once our EU representative is appointed.

Data Transfers

When we transfer your data outside the EEA (to Singapore or Indonesia), we implement appropriate safeguards in accordance with GDPR requirements. These safeguards include Standard Contractual Clauses (SCCs) approved by the European Commission with our data processors. Singapore is not on the EU's adequacy list; accordingly, SCCs form the primary transfer mechanism for all EEA-origin data transferred to our Singapore infrastructure.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Specific retention periods are set out in Section 11 above.

Data Protection Contact

If you have any concerns about how we handle your personal data or wish to exercise your GDPR rights, please contact our Data Protection Contact at hello@livuma.com.

13. Indonesia PDP Law Compliance

For users in Indonesia, we comply with Law No. 27 of 2022 on Personal Data Protection (PDP Law/UU PDP).

Your Rights Under PDP Law

As an Indonesian resident, you have the following rights regarding your personal data:

Data Processing Location

Your personal data is processed on servers operated by Hetzner Online GmbH located in Singapore. We implement appropriate safeguards — including contractual data processing agreements — to ensure adequate protection of your data when transferred or stored across borders in accordance with PDP Law requirements.

Breach Notification

In the event of a data breach that may harm your personal data, we will notify the competent data protection authority under Indonesian PDP Law within 72 hours (3x24 hours) and affected users as soon as practicable, in accordance with PDP Law requirements.

Consent

We obtain your explicit consent before processing your personal data for purposes such as marketing communications. You have the right to withdraw your consent at any time via your account notification settings. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Data Protection Contact

For questions about PDP Law compliance, to exercise your rights, or to report concerns about how we handle your personal data, please contact us at hello@livuma.com.

14. International Data Transfers

Your information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction.

We use service providers that process data outside Indonesia, including our payment processor (Xendit), identity verification provider (Didit), AI services (OpenAI), and analytics services. Our primary server infrastructure is hosted by Hetzner in Singapore. Where such transfers occur, we implement appropriate safeguards — including Standard Contractual Clauses and Data Processing Agreements — to ensure an adequate level of protection for your data in accordance with applicable Indonesian data protection law.

If you are located outside Indonesia and choose to provide information to us, please note that we transfer the data to Singapore for processing. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

15. Children's Privacy

Our service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we learn we have collected or received personal information from a child under 18, we will delete that information.

16. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page, updating the version number and "Last Updated" date at the top, and — where required by applicable law — notifying you directly by email.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

17. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact the data controller:

PT LIVUMA HOME MARKET (PMDN)
Jl. Raya Uluwatu, Gg. Sakhen No. 108 A, Pecatu, Kuta Selatan,
Kabupaten Badung, Bali 80362, Indonesia
Email: hello@livuma.com