Privacy Policy

This Privacy Policy explains how Swastiva (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you use our Service. We aim to handle your data in line with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and, where it applies to you, other data-protection laws such as the EU GDPR.

1. Who is responsible for your data

Swastiva is the controller of the personal data you provide through the Service. If you have any questions or want to exercise your rights, contact us at hello@swastiva.com.

2. Data we collect

Data you give us

• Account details — your name, email address, phone number and password (stored only in hashed form).
• Booking details — traveller names, dates, and the information needed to complete a booking.
• Trip descriptions you type into the planner, and any messages you send us.

Data we collect automatically

• Usage and device data — pages viewed, approximate location, IP address, browser and device type.
• Cookies and similar technologies (see the Cookies section below).

Payment data

Card and payment details are collected and processed directly by our third-party payment providers. We do not store your full card details on our systems.

3. How we use your data

• To provide the Service — run the AI planner, and create and manage your trips and bookings.
• To process payments through our payment providers.
• To send booking confirmations, vouchers and essential service messages.
• To provide customer support and respond to your enquiries.
• To keep the Service secure and prevent fraud and abuse.
• To improve the Service, and to comply with our legal obligations.

4. Our legal bases

Where the GDPR or similar law applies, we rely on: performance of a contract (to run your account and bookings); our legitimate interests (to secure and improve the Service); your consent (for any non-essential cookies or marketing); and compliance with legal obligations.

5. The AI planner

When you describe a trip, that description is sent to our AI model provider (through a third-party model gateway) to generate an itinerary. Please don’t include sensitive personal information in your trip descriptions.

6. When we share your data

We share personal data only as needed to run the Service, with:

• Providers of accommodation, tours and transport — to fulfil the bookings you make.
• Payment processors — to take and reconcile payments.
• Analytics providers — to measure which pages help people plan a trip, and only if you allow it.
• Our AI/model, email, hosting and infrastructure providers — to operate the Service.
• Authorities or advisers — where we are legally required to, or to protect our rights.

We do not sell your personal data.

7. International transfers

Some of our Providers and service partners are located outside Indonesia, so your data may be transferred and processed abroad. Where we do this, we take reasonable steps to ensure your data remains protected to a comparable standard.

8. Cookies

We use cookies and similar technologies that are essential for the Service to work (for example, to keep you signed in and to remember your currency and language). The currency cookie is set on your first visit, before you have chosen anything, because prices are calculated on our servers and they need to know which currency to quote in; it holds nothing but a three-letter currency code. Essential cookies cannot be switched off without affecting how the Service works.

For analytics we use Google Analytics 4, and it measures nothing until you agree to it. The Google tag is present on every page, but it loads under Google’s Consent Mode with every storage permission set to “denied”: until you choose “Allow analytics” on the banner we show on your first visit, it writes no cookie and stores no identifier, so nothing it sends can be tied to you or to your next visit. Google does still receive a basic, cookieless signal that a page was viewed. We never grant the advertising permissions at all — this is analytics, not advertising. If you decline, we do not ask again and nothing about the Service changes.

If you allow it, Google Analytics sets cookies and receives your IP address (truncated), the pages you view and basic device information, as our processor, to tell us which pages help people plan a trip. Google may process that data outside Indonesia. You can change your mind at any time using the Analytics link in the footer of any page: switching it off returns the tag to its denied state and deletes the analytics cookies it had set. Clearing your browser cookies also resets the choice, and we will ask again.

Some tours on this site link out to the operator's own booking site (for example viator.com), and we may earn a commission when you book there. Such links are labelled where they appear. Following one takes you to that company's site, which may set its own cookies under its own privacy policy; we set no tracking cookie on this site for it, and we record only that an outbound link was clicked — not who clicked it.

9. How long we keep it

We keep your personal data for as long as you have an account and as long as we need it for the purposes above, including to meet legal, tax and accounting requirements. When it is no longer needed, we delete or anonymise it.

10. How we protect it

We use reasonable technical and organisational measures to protect your data — including encryption in transit, hashed passwords and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, to portability, and to withdraw consent at any time. To exercise any of these, email hello@swastiva.com. You may also have the right to complain to your local data-protection authority.

12. Children

The Service is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll change the date above and, for material changes, take reasonable steps to let you know.

14. Contact

For any privacy question, email hello@swastiva.com or use our contact page. See also our Terms of Service.