Privacy Policy

iDPi Property Intelligence (“iDPi,” “we,” “us,” or “our”) operates a map-first property search platform for the Jakarta and broader Indonesian real estate market. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have over it under Indonesian law — in particular Law No. 27 of 2022 on Personal Data Protection (“UU PDP”).

This Policy applies to:

• Visitors browsing property listings and using the map search;
• Registered users with a saved-homes account (saved searches, favorites);
• Real estate agents, brokers, mortgage bankers, and other professional partners who list or manage properties through iDPi; and
• Anyone who submits a building request, agent review, or partner inquiry through the site.

It does not apply to:

• The separate privacy practices of an agent, bank, developer, or other party you choose to contact directly (for example, by email) through the platform; or
• Third-party websites we link to, or that supply data we display (see “Third-Party Websites and Services” below).

iDPi is domiciled in DKI Jakarta, Indonesia, and is the data controller (pengendali data pribadi) responsible for the personal data described in this Policy. You can reach us using the details in “Contact Us” below.

Under the UU PDP, “personal data” means any data about an identified or identifiable individual, whether alone or combined with other information, obtained through electronic or non-electronic means. Some personal data is classified as “specific personal data” (data pribadi yang bersifat spesifik) under Article 4 of the UU PDP — such as health, biometric, genetic, criminal, financial, and child data — and requires stricter protection. iDPi does not intentionally collect specific personal data about you; the personal data we process is limited to what is described in this Policy.

Information you give us

• Account registration (visitors): name, email address, password (never stored in plain text — see “Data Security”).
• Account registration (agents & partners): name, username, email, phone/WhatsApp number, agency affiliation, and any professional profile details you choose to add (photo, bio, languages, specialties, service areas, credentials).
• Content you submit: property listings and photos, building requests, agent reviews, and partner inquiry forms — including any contact details and messages you include in them.
• Saved activity: saved homes, saved searches, and search filters you choose to store on your account.
• Contacting an agent: the “Contact Agent” button on a listing opens an email draft in your own email application, addressed directly to the agent. iDPi’s servers do not receive, transmit, or store the content of that message — it is a direct email between you and the agent, exactly like copying an address off a business card.

Information we collect automatically

• Usage and log data: pages and listings you view, search filters used, referring page, approximate access time, IP address, and browser/device type, generated as you use the site (kept as described in “Data Retention”).
• Security signals: information used solely to detect and prevent fraudulent account registrations and sign-ins — including a device identifier stored in your browser, form-submission timing, and failed sign-in attempts. We use this to protect every user’s account, never for advertising.
• Location you provide: if you use map search, the map area and any location you search or filter by. iDPi does not access your device’s GPS location without your browser’s own permission prompt, and does not currently request it.

Information from other sources

• Public government and open data: to work out features like flood risk or a building’s location, iDPi looks up publicly available Indonesian government and open-data sources (for example BNPB/InaRISK, ThinkHazard/GFDRR, PetaBencana.id, and OpenStreetMap) using a property’s coordinates — not your identity. These lookups are about places, not about you: no personal data about you is sent to, or received from, these sources.
• Currency and exchange-rate data: sourced from a public exchange-rate API to display prices in different currencies; this does not involve your personal data.

We use a small number of cookies and one piece of browser storage — all needed to run the site, none used for advertising or cross-site tracking. iDPi does not use third-party advertising cookies, ad networks, or interest-based advertising of any kind.

• NEXT_LOCALE — remembers your chosen display language (English/Bahasa Indonesia) — 1 year.
• idpi_currency — remembers your chosen display currency — 1 year.
• idpi_session — keeps agents and staff signed in to the partner dashboard (HTTP-only, unreadable by page scripts) — session-length.
• idpi_user_session — keeps a registered visitor signed in to their account (HTTP-only; the token itself is stored hashed in our database, not in readable form) — until sign-out or expiry.
• idpi_did — a random identifier used only to detect abusive, automated account registrations; not linked to advertising and never shared with an advertiser — persists until cleared.

Your saved-homes list is stored in your browser’s local storage so it works even before you create an account; if you sign in, it is merged into your account so it follows you across devices.

You can block or delete cookies in your browser settings at any time. Doing so may sign you out or reset your language/currency preference, but the site will keep working.

• To create and secure your account, and let you sign in — performance of a contract with you (Art. 20(1)(b) UU PDP).
• To operate map search, listings, favorites, and saved searches — performance of a contract with you.
• To display a listing's agent, verification badges, and price history — performance of a contract; legitimate interest in a transparent marketplace.
• To detect and prevent fraudulent registrations, sign-ins, and duplicate building requests — legitimate interest in platform security (Art. 20(1)(f)), balanced against your rights.
• To keep audit and security logs of privileged actions (e.g., listing edits, staff sign-ins) — legal obligation and legitimate interest in accountability.
• To measure site usage in aggregate (e.g., page visits, listing views) — legitimate interest in improving the service.
• To respond to a partner inquiry or building request you submit — performance of pre-contractual steps taken at your request (Art. 20(1)(b)).
• To comply with a legal obligation, such as a lawful request from an Indonesian authority — legal obligation (Art. 20(1)(c)).

We do not use your personal data for automated decision-making or profiling that produces a legal or similarly significant effect on you, and we do not sell or rent your personal data to anyone.

iDPi does not sell your personal data. We share it only in the following limited circumstances:

• With the agent or partner you contact: when you use an inquiry or contact form (not the email-based “Contact Agent” button, which never touches our servers), we share the details you submitted so they can respond to you.
• With service providers who run our infrastructure: the servers, database, and email-verification service that operate iDPi are engaged strictly to provide those services to us, under confidentiality obligations, and are not permitted to use your data for their own purposes.
• With public authorities: if required by Indonesian law, a court order, or a lawful request from an authority such as the police or the Personal Data Protection Authority (Lembaga PDP).
• In a business transfer: if iDPi is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to this Policy or a policy offering at least equivalent protection.
• At your direction: content you choose to make public, such as an approved agent review, is visible to other visitors as intended.

We do not share personal data with the map-tile, exchange-rate, or government hazard-data providers described above — those requests concern locations and public reference data, not your identity.

Where any service provider or infrastructure iDPi relies on is located outside Indonesia, we only transfer personal data to that country if it has a data protection level at least equivalent to the UU PDP, if we have put in place a binding and enforceable agreement, or if you have given specific consent to the transfer — in accordance with Article 56 of the UU PDP.

We keep personal data only as long as necessary for the purposes described in this Policy, or as long as Indonesian law requires. Different categories of data have different retention periods because they serve different purposes:

• Account profile, saved homes, and saved searches — for as long as your account remains active, or until you request deletion.
• Staff/agent authentication logs and privileged-action audit logs — 365 days.
• Security event logs (e.g., failed sign-ins, lockouts) — 365 days.
• Listing edit history — 365 days.
• General site-activity logs (e.g., searches performed, listings viewed) — 180 days.
• Website visit logs (page/referrer/browser, aggregated afterwards) — 180 days.
• API request logs — 30 days.
• System health metrics — 90 days.

After these periods, the underlying detailed records are deleted; where useful for understanding overall trends, we may keep an aggregated summary that no longer identifies you.

• Passwords are never stored in plain text: visitor passwords are hashed with Argon2id and agent/partner passwords with scrypt, both one-way, industry-standard hashing algorithms.
• Session cookies are signed and HTTP-only, so they cannot be read or forged by a script running on the page.
• Repeated failed sign-in attempts trigger an account lock and, at a higher threshold, a temporary block on the originating network address, to deter automated attacks.
• Data in transit between your browser and iDPi is encrypted (HTTPS).
• Access to personal data within iDPi is limited to what each role (agent, editor, master administrator) needs to do its job, and privileged actions are logged.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security — but we work to protect your personal data using technical and organizational measures appropriate under the UU PDP and Government Regulation No. 71 of 2019.

As a data subject under the UU PDP, you have the right to:

• Access — request confirmation of, and access to, the personal data we hold about you (Art. 5).
• Correction — request that we correct inaccurate or outdated personal data (Art. 7).
• Deletion / withdrawal — request that we delete your personal data or withdraw your consent to its processing, subject to any legal retention obligation (Art. 8).
• Restriction & objection — object to certain processing and request that we restrict it, in the circumstances provided by law (Art. 9).
• Portability — request a copy of certain personal data you provided to us in a structured, commonly used format (Art. 9).
• Withdraw consent — where processing is based on your consent, withdraw it at any time, without affecting processing already carried out.
• Complain — lodge a complaint with Indonesia’s Personal Data Protection Authority (Lembaga Pelindungan Data Pribadi, “Lembaga PDP”) if you believe we have processed your personal data unlawfully.

Many of these rights are already available directly in your account:

• Update your profile name, email, or password — Account Settings.
• Review and revoke devices signed in to your account — Account Settings.
• Remove a saved home or saved search — your Account page.

For any other request — including access to, correction of, or deletion of personal data not covered above — contact us using the details in “Contact Us” below. We may ask you to verify your identity (for example, by confirming account details) before acting on a request, to make sure we don’t hand over or change someone else’s data. We aim to respond within a reasonable time and, in any event, within the timeframes required by the UU PDP.

iDPi’s services are intended for adults searching for or listing property, and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Listings, map tiles, and hazard/flood information on iDPi may be provided by, or link to, third parties — including our map tile providers, government agencies such as BNPB, and organizations such as ThinkHazard/GFDRR and PetaBencana.id. These are separate organizations with their own privacy practices; this Policy does not cover them, and we encourage you to review their own policies if you interact with them directly. Loading map tiles in your browser causes a direct request from your browser to our map tile provider, which may see your IP address as an ordinary part of serving that image, independent of iDPi.

We may update this Policy from time to time — for example, as our services grow or Indonesian law changes. We will update the effective date below when we do, and where a change is material, we will provide a more prominent notice (such as a banner on the site) before it takes effect.

This Policy, and any dispute relating to your personal data, is governed by the laws of the Republic of Indonesia, including the UU PDP, Law No. 11 of 2008 on Electronic Information and Transactions as amended by Law No. 19 of 2016 (“UU ITE”), and Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (“PP 71/2019”). As iDPi is domiciled in DKI Jakarta, any dispute that cannot be resolved amicably or through Lembaga PDP falls under the jurisdiction of the District Court of Central Jakarta (Pengadilan Negeri Jakarta Pusat), without prejudice to any other venue required by mandatory law.

If you have a question, concern, or request relating to this Policy or your personal data, contact us at:
iDPi Property Intelligence
Email: privacy@ayokaji.com
Jakarta, Indonesia
We aim to acknowledge privacy-related requests promptly.