Gateway Pesanggrahan — Privacy Policy

1. Introduction

This Privacy Policy describes how [[COMPANY]], operator of the Gateway Pesanggrahan apartment ("Gateway", "we", "us", "our"), collects, uses, stores, and protects personal information through the Gateway Pesanggrahan mobile app ("the App").

The App is a closed application for residents and staff of the Gateway Pesanggrahan apartment. There is no public sign-up: your account is created for you by building management when you become a resident or join the staff, and access ends when that relationship ends. Residents use the App to register their vehicles, view valet and parking records, file complaints, and reach security in an emergency; staff use it to operate valet sessions, log parking photos, and respond to alerts.

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App and contact building management.

2. Information We Collect

2.1 Account Information (provided by building management)

• Name, email address, and role (resident or staff), recorded when building management creates your account, together with your unit or assignment within the building
• Password, stored only in hashed form (bcrypt); we cannot view it

2.2 Vehicle Information You Provide

• Vehicle details: licence plate number, vehicle type (car or motorcycle), and related details you register in the App
• Vehicle registration document (STNK) photo: a photo of the vehicle's STNK is required when registering a vehicle, and is reviewed by building management to approve the registration

2.3 Parking, Complaint, and Emergency Records

• Valet session records: when staff open and close a valet session for your car, the session's times and status are recorded against your vehicle
• Parking photos: photos of parked vehicles and their location, taken by staff as part of the building's parking record
• Complaints: the complaints you file, the reply thread with building staff, and the rating you choose to give when a complaint is closed
• Emergency (panic) alerts: when you press the panic button, we record the alert, its time, its handling status, and the location note you type yourself. The App does not read your device's GPS — the location is only what you write.

2.4 Camera and Photos

The App asks for camera and photo-library permission only when you attach a photo — for example the STNK photo during vehicle registration, or parking photos taken by staff. Photos are uploaded to the building's server only when you submit them. The App never scans your photo library or uses the camera in the background.

2.5 Information Collected Automatically

• Authentication tokens: session tokens (JWT) that keep you signed in, stored in the App's private storage on your device. On our server we store refresh tokens only in protected form.
• Server logs: like most online services, our server records basic technical request information (such as IP address, time, and requested address) to operate and secure the service.

2.6 Information We Do NOT Collect

• GPS or any other device location (the panic feature uses only the note you type)
• Contacts, microphone, or files beyond the photos you choose to attach
• Payment card or bank details — the App has no payments
• Advertising identifiers. The App contains no advertising.
• Analytics or behavioural tracking. The App contains no third-party analytics or tracking SDKs.

3. How We Use Your Information

We do not use your information for advertising, sell it, build marketing profiles from it, or use it for automated decisions that affect you.

4. Data Sharing and Disclosure

4.1 Within Building Operations

Your records are visible to the building staff who need them to do their job: security and valet staff see vehicle, parking, and panic records; management staff see complaints and vehicle approvals. Staff access is limited by role in the App.

4.2 Service Providers

The App's server and database are operated on infrastructure managed by or for [[COMPANY]]. Where hosting is provided by a third party, that provider stores data on our behalf under this policy and does not use it for its own purposes.

4.3 No Sale of Data

We do not sell, rent, or trade your personal information, and we do not share it with third parties for their own marketing.

4.4 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or an enforceable request from a government authority — for example, sharing parking or security records with the police in connection with an incident at the building.

5. Data Storage and Security

• Encryption in transit: all communication between the App and our servers uses HTTPS/TLS.
• Password hashing: passwords are hashed with bcrypt and never stored in plain text.
• Token-based sessions: access tokens are short-lived; refresh tokens expire and are revoked when you log out.
• Access control: residents can only see their own vehicles, complaints, and alerts. Staff access is limited by role, and administrative access to our systems is limited to authorized personnel.

In the event of a data breach affecting your personal information, we will notify affected users and the relevant authorities as required by applicable law.

6. Data Retention

• Account, vehicles, complaints, and alerts: kept while your account is active. When building management deactivates your account (for example when you move out or leave the staff), your data is removed from active use and may be retained for a reasonable period for the building's record-keeping before deletion.
• Parking and security records: valet sessions, parking photos, and panic-alert records are part of the building's operational record and may be retained for the period required by building policy and applicable law, even after an account is deactivated.
• Session tokens: expire automatically and are revoked when you log out.
• Server logs: kept for a limited period for security and troubleshooting, then deleted.

7. Your Rights and Choices

• Access: you can see your vehicles, parking history, complaints, and alerts in the App at any time.
• Correction: request corrections to your account or vehicle details through building management.
• Deletion: request deactivation and deletion of your account and data through building management or using the contact details in Section 11. Certain operational and security records may need to be retained as described in Section 6.
• Withdraw consent: you may stop using the App at any time and ask building management to deactivate your account.

These rights are provided in line with applicable law, including Indonesia's Personal Data Protection Law (Law No. 27 of 2022). To exercise them, contact us using the details in Section 11.

8. Children's Privacy

Accounts are issued by building management to residents and staff, and the App is not directed at children. We do not knowingly collect personal information from children. If you believe a child has been given an account in error, please contact building management and we will deactivate it.

9. International Data Transfers

The App is operated from Indonesia and its data is processed in Indonesia or wherever our service providers operate, under the safeguards described in this policy.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the dates at the top of this page. For significant changes, we will also let you know in the App or through building management. Continued use of the App after an update means you accept the revised policy.

11. Contact Us

For questions or requests about this Privacy Policy or your data, contact us:

• Company: [[COMPANY]]
• Email: [[PRIVACY_EMAIL]]
• Support: Gateway Pesanggrahan Support
• Management office: the Gateway Pesanggrahan building management office