Last updated: 23 August 2026
Kiyo respects your privacy. This policy explains how we collect, use, and protect personal information when you use our platform or make a booking through a property that uses our service.
We collect: (a) Account information — name, email, business details provided during registration; (b) Booking information — guest name, contact details, and stay information; (c) Usage data — pages visited, features used, device and browser information; (d) Payment information — processed securely by our payment partners; we do not store card numbers.
We use your information to: provide and improve the platform; process bookings and payments; send booking confirmations and operational notifications; comply with legal obligations under Indonesian Personal Data Protection Law (UU PDP) and GDPR where applicable; and prevent fraud and maintain platform security.
We do not sell your personal data. We share data only: (a) with property operators to fulfil your booking; (b) with payment providers to process transactions; (c) with infrastructure and analytics providers under data processing agreements; (d) when required by law or valid court order.
Our infrastructure is hosted on servers that may be located outside Indonesia. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses where required under applicable law.
We implement industry-standard security measures including encryption at rest and in transit, access controls, and regular security reviews. No system is completely secure — if you believe your account has been compromised, contact us immediately.
Under applicable law, you have the right to: access your personal data; correct inaccurate data; request deletion (where no legal retention obligation applies); object to certain processing; and withdraw consent. Submit requests to our support team. We respond within 30 days.
We use cookies and similar technologies for security, functionality, performance analytics, session recording on designated Kiyo product routes, social-channel measurement, and advertising measurement when a provider is configured. Optional categories start enabled. You can review or change them at any time in the Cookie Center; Strictly Necessary cookies cannot be disabled.
When Performance or Targeting is enabled, Google Analytics and Google Tag Manager may collect pages visited, device or browser details, referral or campaign context, and approved conversion actions. We do not send passwords, payment details, or form-field values. Google explains how it collects and processes this information: How Google uses information from sites or apps that use its services
When Performance is enabled, Kiyo sends a limited set of anonymous page, call-to-action, engagement, and confirmed-form events to PostHog. Session replay is restricted to designated Kiyo account and PMS routes with input masking; it is off on corporate marketing, property, and booking pages. When Targeting is enabled, configured advertising providers such as Meta Pixel may receive page and marketing-conversion events. Vercel independently creates limited operational request logs needed to deliver, secure, and troubleshoot the site; those logs are not controlled by Cookie Center choices.
We retain account data for as long as your account is active, plus 12 months. Booking records are retained for 5 years to comply with Indonesian financial regulations. Anonymised analytics data may be retained indefinitely.
Kiyo is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, contact us and we will delete it promptly.
We may update this policy periodically. Material changes will be communicated by email and in-platform notification at least 14 days before taking effect. Continued use after that date constitutes acceptance of the updated policy.
For privacy enquiries, data access requests, or complaints, contact our Data Protection team. We aim to respond within 5 business days. You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.
For privacy enquiries, data access requests, or complaints, contact our Data Protection team. We aim to respond within 5 business days. You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.
Email our privacy team → hello@kiyoHQ.com