Privacy Policy

Villa Ledger is operated by PT Amagi Kalam Bali, registered in Bali, Indonesia. PT Amagi Kalam Bali is the data controller for account and billing data. For data that a villa management company enters about its villa owners (names, phone numbers, statements), that company is the data controller and PT Amagi Kalam Bali, operating Villa Ledger, acts as a data processor on its instructions.

• Account data — name, email address, and password (stored only as a secure hash) for people who sign in.
• Contact data — names, phone numbers, and roles of staff and villa owners, entered by your organisation.
• Financial records — expense lines, receipt and product photos, wallet balances, and monthly statements, in IDR.
• Support tickets — anything you send us through the in-app Help form.
• Usage data — sign-in times and audit logs of actions taken in the app, kept for security and accountability.

We do not collect location data, contacts from your phone, or advertising identifiers.

• to provide the bookkeeping service and generate monthly statements;
• to send notifications you have enabled (for example, statement-ready messages via WhatsApp);
• to scan receipt photos you upload so expense details can be pre-filled (you always confirm before saving);
• to operate, secure, and improve the Service, and to resolve support tickets;
• to issue invoices and meet Indonesian tax and legal obligations.

We do not sell personal data and we do not use it for advertising.

If your organisation enables it, we send statement-ready and support-reply notifications to villa owners through WhatsApp, using our messaging provider (360dialog) and Meta's WhatsApp Business Platform. Messages are only sent to phone numbers your organisation has registered and switched on for WhatsApp notifications, and an owner can ask their manager to switch them off at any time.

We share data only with the service providers needed to run Villa Ledger:

• cloud hosting and database infrastructure;
• 360dialog / Meta (WhatsApp delivery);
• an AI receipt-reading provider, for receipt photos you scan;
• payment processing (once enabled) for invoicing.

Each provider processes data only on our instructions. We do not otherwise disclose personal data except where required by Indonesian law.

Data is stored on cloud servers which may be located outside Indonesia. Where personal data is transferred internationally, we do so in line with the requirements of UU PDP.

Account and financial records are kept while your organisation's subscription is active. After cancellation you may request an export within 30 days, after which data may be deleted. Records we must retain under Indonesian tax law are kept for the statutory period.

You have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion where the data is no longer needed;
• withdraw consent where processing is based on consent;
• object to certain processing and lodge a complaint with the competent authority.

To exercise any right, use the Help button inside the app or contact us via our website. If your data was entered by a villa management company, please contact that company first, as they control that data.

Access to each organisation's data is restricted to that organisation's users. Passwords are hashed, connections are encrypted, and administrative actions are logged. No system is perfectly secure; if a breach affects your data we will notify you as required by law.

We may update this policy. Material changes will be announced in the app at least 14 days before they take effect.