Privacy Policy

1. Introduction

Topnesia ("we", "our", or "us"), operated by PT Kalosa Digital Indonesia, is committed to protecting the privacy and personal data of all users ("you") of our platform. This Privacy Policy explains what information we collect, how we use it, and the choices you have with respect to your personal data. By using Topnesia, you consent to the practices described in this policy.

2. Information We Collect

We collect the following categories of information when you use our platform:

• Account information: name, email address, username, and password (hashed).
• Profile information: display name, profile picture, bio, and contact details voluntarily provided.
• Transaction data: order history, payment status, seller earnings, and related financial data.
• Identity verification (sellers): full name, phone number, portfolio URL, and address — collected during seller verification.
• Communications: messages exchanged between buyers and sellers through our chat system.
• Usage data: pages visited, features used, browser type, IP address, device type, and timestamps.
• Payment data: payment method selection and transaction status. We do not store full card numbers — all card data is handled by Midtrans.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your account.
• To facilitate transactions between buyers and sellers.
• To process payments through our payment gateway partner (Midtrans).
• To communicate with you regarding your account, orders, and updates.
• To verify seller identity and ensure platform integrity.
• To improve our platform, services, and user experience.
• To detect and prevent fraudulent activity and ensure security.
• To comply with legal obligations under Indonesian law.

4. Information Sharing

We do not sell, rent, or trade your personal data to third parties. We may share your information only in the following circumstances:

• With service providers who assist us in operating our platform (e.g., Midtrans for payment processing, Firebase for authentication and file storage, Cloudinary for image hosting). These parties are contractually obligated to protect your data.
• With other users on the platform as necessary to facilitate transactions (e.g., your display name and order details are visible to the seller you transact with).
• With law enforcement or government authorities when required by applicable Indonesian law or a valid legal process.
• In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality obligations.

5. Data Security

We implement industry-standard security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (HTTPS/TLS), hashed passwords (bcrypt), HTTP-only cookies for authentication tokens, and access controls. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Cookies

Topnesia uses cookies and similar technologies to maintain your login session, remember your preferences, and analyze platform usage. Authentication tokens are stored in HTTP-only cookies to prevent client-side access. You may configure your browser to refuse cookies, but doing so may limit certain features of the platform.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will remove your personal information from our active systems within 30 days, except where we are legally obligated to retain certain records (e.g., transaction records for tax compliance purposes), which may be retained for up to 5 years.

8. Your Rights

In accordance with applicable Indonesian data protection laws, you have the following rights with respect to your personal data:

• Right to access: you may request a copy of the personal data we hold about you.
• Right to correction: you may update or correct inaccurate personal data through your account settings or by contacting us.
• Right to deletion: you may request deletion of your account and associated personal data, subject to our legal retention obligations.
• Right to withdraw consent: you may opt out of marketing communications at any time through your account settings.

9. Third-Party Links

Our platform may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access through our platform.

10. Children's Privacy

Topnesia is not intended for individuals under the age of 17. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal information without parental consent, we will take steps to delete that information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our platform or by email. Your continued use of the platform after such changes constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at: Email: hello@topnesia.id Website: topnesia.com/contact