Privacy Policy

Last updated: September 1, 2026

1. Introduction & Privacy Commitment

KIEMONO ("We") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, protect, and disclose your personal information when you use the KIEMONO Platform, including the website, application, and all services available therein.

This Privacy Policy has been established in accordance with the provisions of the Personal Data Protection Law (Law No. 27 of 2022) and its implementing regulations, as well as applicable international data privacy standards. By using the Platform, you consent to the privacy practices described in this Policy. If you do not agree to this Policy, please refrain from using the Platform.

2. Data Collected

We collect and process the following categories of data:

• Account Data: name, username, email address, and password encrypted using bcrypt when you create an Account.
• Profile Data: public profile information that you choose to display, including profile picture, bio, and collection preferences.
• Uploaded Content: photos, videos, descriptions, valuations, and other materials that you upload or post through the Platform.
• Metadata: information associated with Uploaded Content, including EXIF data from photographs, file size, format, and upload timestamps.
• Activity Logs: IP address, browser type and version, operating system, pages visited, access times, and interaction data (likes, comments, bookmarks).
• Cookies and Tracking Technologies: session cookies, functional cookies, and analytics cookies necessary for the operation of the Platform and improvement of services.
• Technical Data: device information, screen resolution, selected language, and user interface preferences.

3. How Data Is Used

We use the collected data for the following purposes:

• To provide, operate, and maintain the Platform and its features.
• To manage your Account, verify your identity, and authenticate your access.
• To display your collections, content, and valuations to other users in accordance with your privacy preferences.
• To communicate with you regarding service updates, policy changes, and other important information.
• To enhance user experience through personalization, content recommendations, and analytics features.
• To detect, prevent, and address fraud, abuse, and other unlawful activities.
• To comply with legal obligations, regulations, and lawful processes.
• To provide customer support and respond to your inquiries or complaints.
• To conduct statistical analysis and research for service development and improvement.

4. Legal Basis for Data Processing

In accordance with the Indonesian Personal Data Protection Law, we process your personal data based on one or more of the following legal bases:

• Consent: when you voluntarily provide your personal data for a specific purpose, such as when creating an Account or subscribing to a newsletter.
• Performance of a Contract: data processing necessary for the performance of our obligations under the Terms of Service that you have accepted, including the provision of Platform services.
• Legitimate Interest: data processing for our legitimate interests, such as fraud prevention, network security, and service improvement, provided that your rights and freedoms are not overridden.
• Legal Obligation: data processing necessary to comply with legal obligations or regulations applicable in Indonesia, including requests from competent authorities.

You have the right to withdraw your consent at any time by contacting us, without affecting the validity of data processing carried out based on prior consent.

5. Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies to enhance your experience. Cookies are small files stored on your device when you visit the Platform. We use the following types of cookies:

• Session Cookies: necessary for the operation of the Platform, including authentication and management of your login session. These cookies are deleted when you close your browser.
• Functional Cookies: remember your preferences (language, theme, display settings) to provide a more personalized experience.
• Analytics Cookies: help us understand how Users interact with the Platform through aggregated data, which assists us in improving service features and performance.

You may manage or disable cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Platform.

6. Data Sharing & Disclosure

KIEMONO does not sell your personal data to any third party for marketing or advertising purposes. We only share data in the following situations:

• Third-Party Service Providers: we share data with third parties that provide supporting operational services for the Platform, including but not limited to hosting services (cloud infrastructure), payment services, email services, and analytics services. These third parties are bound by confidentiality agreements and process data solely in accordance with our instructions.
• Legal Compliance: we may disclose data where required by law, court order, lawful government request, or to protect the rights, property, or safety of KIEMONO, our users, or the general public.
• Business Transfer: in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the receiving entity, which will be subject to this Privacy Policy or an equivalent policy.
• Public Data: information that you choose to display publicly on the Platform (profile, collections, posts) may be accessed by other users and does not constitute disclosure of personal data under this Policy.

7. Data Storage & Security

Your personal data is stored on server infrastructure managed by leading cloud service providers with industry-standard security measures (including encryption in transit and at rest). We implement appropriate technical and organizational measures to protect your data from unauthorized access, alteration, disclosure, or destruction.

Some of the security measures we implement include:

• Password encryption using the bcrypt algorithm and irreversible hash-based password storage.
• Data encryption in transit using TLS (Transport Layer Security).
• Internal access restrictions — only authorized personnel may access user data on a least-privilege basis.
• System access monitoring and logging for the detection of suspicious activity.
• Periodic security assessments and security system updates in response to current threat developments.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes of data collection as described in this Policy, or as required by applicable law. Specifically:

• Account Data: retained for as long as your Account is active and for up to three (3) years after Account deletion for audit, dispute resolution, and legal compliance purposes.
• Content: uploaded content may remain stored on our servers after Account deletion for up to thirty (30) days for data recovery processes, unless previously deleted by you.
• Log Data: activity log data is retained for two (2) years from the last activity for security and analytics purposes.
• Transaction Data: transaction-related data is retained for five (5) years in accordance with applicable accounting and tax record-keeping obligations in Indonesia.

9. User Rights

Under the Personal Data Protection Law, you have the following rights with respect to your personal data:

• Right of Access: you have the right to request a copy of the personal data we hold about you.
• Right to Rectification: you have the right to request the correction of inaccurate or incomplete personal data.
• Right to Erasure: you have the right to request the deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purpose for which it was collected.
• Right to Data Portability: you have the right to request your personal data in a structured, commonly used, and machine-readable format for transfer to another data controller.
• Right to Withdraw Consent: you have the right to withdraw previously given consent at any time, without affecting the validity of processing carried out prior to withdrawal.
• Right to Restrict Processing: you have the right to request the restriction of processing of your personal data in certain circumstances.
• Right to Object to Processing: you have the right to object to the processing of your data based on our legitimate interests, including for direct marketing purposes.

To exercise any of these rights, please contact us via email at kiemono@example.com. We will process your request within no more than thirty (30) business days of receipt of a complete request.

10. Children's Privacy

This Platform is not intended for children under the age of thirteen (13). We do not knowingly collect or process personal data from children under the age of 13 without verifiable consent from a parent or legal guardian in accordance with applicable laws and regulations.

If we become aware that we have collected personal data from a child under the age of 13 without adequate consent, we will take the necessary steps to delete such information from our systems. If you become aware that a child under the age of 13 has provided personal data to us, please contact us immediately.

11. International Data Transfer

Your personal data may be processed or transferred to servers located outside of Indonesia, including but not limited to servers of international cloud service providers. In such cases, we ensure that any international data transfer meets data security and protection standards that are at least equivalent to those required by Indonesian law, including through the implementation of standard contractual clauses or other protective mechanisms.

By using the Platform and providing your personal data, you consent to such data transfers in accordance with this Privacy Policy.

12. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The latest version will always be available on the Platform along with the date of the last update.

For material changes, we will notify you via email registered on your Account or through a prominent notice on the Platform at least seven (7) days before the changes take effect. Your continued use of the Platform after the changes take effect constitutes your acceptance of the updated Privacy Policy.

13. DPO / Privacy Contact

If you have any questions, requests, or complaints regarding the processing of your personal data, or wish to exercise your rights as described in this Privacy Policy, please contact us via:

Privacy Email: kiemono@example.com

We will respond to your request within no more than fourteen (14) business days. If you believe that the processing of your personal data has violated applicable laws and regulations, you have the right to file a complaint with the competent personal data protection authority in Indonesia.

KIEMONO is committed to responding to every request and complaint in a transparent, timely manner, and in accordance with applicable laws and regulations.