Privacy Policy

This Privacy Policy explains how Swastiva (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you use our Service. We aim to handle your data in line with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and, where it applies to you, other data-protection laws such as the EU GDPR.

1. Who is responsible for your data

Swastiva is the controller of the personal data you provide through the Service. If you have any questions or want to exercise your rights, contact us at hello@swastiva.com.

2. Data we collect

Data you give us

• Account details — your name, email address, phone number and password (stored only in hashed form).
• Booking details — traveller names, dates, and the information needed to complete a booking.
• Trip descriptions you type into the planner, and any messages you send us.

Data we collect automatically

• Usage and device data — pages viewed, approximate location, IP address, browser and device type.
• Cookies and similar technologies (see the Cookies section below).

Payment data

Card and payment details are collected and processed directly by our third-party payment providers. We do not store your full card details on our systems.

3. How we use your data

• To provide the Service — run the AI planner, and create and manage your trips and bookings.
• To process payments through our payment providers.
• To send booking confirmations, vouchers and essential service messages.
• To provide customer support and respond to your enquiries.
• To keep the Service secure and prevent fraud and abuse.
• To improve the Service, and to comply with our legal obligations.

4. Our legal bases

Where the GDPR or similar law applies, we rely on: performance of a contract (to run your account and bookings); our legitimate interests (to secure and improve the Service); your consent (for any non-essential cookies or marketing); and compliance with legal obligations.

5. The AI planner

When you describe a trip, that description is sent to our AI model provider (through a third-party model gateway) to generate an itinerary. Please don’t include sensitive personal information in your trip descriptions.

6. When we share your data

We share personal data only as needed to run the Service, with:

• Providers of accommodation, tours and transport — to fulfil the bookings you make.
• Payment processors — to take and reconcile payments.
• Our AI/model, email, hosting, infrastructure and analytics providers — to operate the Service.
• Authorities or advisers — where we are legally required to, or to protect our rights.

We do not sell your personal data.

7. International transfers

Some of our Providers and service partners are located outside Indonesia, so your data may be transferred and processed abroad. Where we do this, we take reasonable steps to ensure your data remains protected to a comparable standard.

8. Cookies

We use cookies and similar technologies that are essential for the Service to work (for example, to keep you signed in and to remember your currency and language). Where we use any optional analytics, you can control it through your browser settings or any consent controls we provide. Essential cookies cannot be switched off without affecting how the Service works.

9. How long we keep it

We keep your personal data for as long as you have an account and as long as we need it for the purposes above, including to meet legal, tax and accounting requirements. When it is no longer needed, we delete or anonymise it.

10. How we protect it

We use reasonable technical and organisational measures to protect your data — including encryption in transit, hashed passwords and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, to portability, and to withdraw consent at any time. To exercise any of these, email hello@swastiva.com. You may also have the right to complain to your local data-protection authority.

12. Children

The Service is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll change the date above and, for material changes, take reasonable steps to let you know.

14. Contact

For any privacy question, email hello@swastiva.com or use our contact page. See also our Terms of Service.