Privacy Policy
We respect your privacy, collect only what we need, secure it, and give you control.
We provide AI-assisted BaZi analysis. We respect your privacy, collect only what we need, secure it, and give you control. This Policy explains what we collect, why, how long we keep it, who we share it with, and your rights.
Who we are
Legal Entity: Kita Bersatu Bersama, PT (“SuperBazi”, “we”, “our”, “us”)
Contact: hello@superbazi.com
Registered Address: Jakarta, Indonesia
This Privacy Policy applies to superbazi.com, our web/mobile apps, and related services (collectively, the “Services”).
For most processing described here, SuperBazi acts as a Data Controller (GDPR/UK GDPR). For payment processing, fraud screening, and similar activities performed by payment providers (e.g., Stripe, Xendit), those providers are independent controllers.
Data you provide directly
- Account & Identity: name, email, phone (optional), password hash.
- Profile & Birth Data: date/time/place of birth, gender, preferences, notes you enter.
- Transaction Data: plan purchased, price, currency, last 4 digits (via processor), billing address (if required for tax).
- Support Content: messages, attachments, feedback, survey responses.
Data we collect automatically
- Usage & Device: pages viewed, clicks, time on page, referrer/UTM, approximate location (city/country), device type, OS/browser, language.
- Technical: IP address, cookies, SDK events, crash logs, diagnostics.
Data from third parties (where lawful)
- Payment status from Stripe/Xendit; analytics (e.g., GA4); authentication (e.g., OAuth providers, if enabled).
We do not intentionally collect sensitive categories (e.g., health, religion) beyond what can be inferred from BaZi-related inputs. Do not share information you consider sensitive unless necessary for your use of the Services.
| Purpose | Examples | Legal Bases (GDPR) |
|---|---|---|
| Provide the Services | account creation, generating BaZi reports, troubleshooting | Contract necessity Art. 6(1)(b) |
| Improve & secure | analytics, debugging, preventing abuse/fraud, QA for AI outputs | Legitimate interests Art. 6(1)(f) |
| Payments & billing | process purchases, tax/VAT invoices | Contract necessity; Legal obligation |
| Communications | transactional emails/SMS, service updates | Contract necessity; Legitimate interests |
| Marketing (optional) | newsletters, promotions | Consent Art. 6(1)(a) |
| R&D / AI model enhancement (optional) | data sampling, de-identification/pseudonymization | Consent; Legitimate interests (where permitted) |
You can withdraw consent at any time without affecting prior processing.
Our Services use algorithms to analyze BaZi charts and generate insights. This may include profiling to tailor recommendations (career, business, relationship compatibility).
- These outputs do not have legal or similarly significant effects.
- You can request human review, express your viewpoint, or contest an output by contacting hello@superbazi.com .
We share data with:
- Payment processors: Stripe, Xendit (independent controllers for card data).
- Hosting & Infrastructure: e.g., AWS/GCP/Vercel (processors).
- Analytics / Crash Reporting: e.g., Google Analytics, Sentry (processors).
- Email & Notifications: e.g., SendGrid/SES/FCM (processors).
- Customer Support / CRM: e.g., Help Scout/Zendesk/Intercom (processors).
We require processors to sign Data Processing Agreements and follow appropriate security measures. We do not sell your personal information.
We may transfer personal data internationally (e.g., to the US/Singapore). Where required, we use lawful transfer mechanisms such as Standard Contractual Clauses (SCCs) and implement supplemental safeguards. Details are available on request.
We keep personal data only as long as necessary for the purposes stated or as required by law. Illustratively:
- Account data: for the life of the account + up to 24 months after closure.
- Transaction records: 7–10 years (tax/accounting).
- Logs/analytics: 3–24 months (aggregated/anonymized thereafter).
- Customer support tickets: 24 months.
We may anonymize data for statistics or R&D; anonymized data is not personal data.
We implement organizational and technical safeguards (e.g., encryption in transit/at rest, access controls, MFA for admins, backups). No system is 100% secure; report security issues to hello@superbazi.com (we appreciate responsible disclosure).
EU / UK (GDPR / UK GDPR)
- Access, rectification, erasure, restriction, portability, objection, and rights regarding automated decisions.
- Right to lodge a complaint with your local Data Protection Authority.
California (CCPA / CPRA)
- Right to know/access, correct, delete; opt-out of sale/share; limit use of sensitive personal information; non-discrimination for exercising rights.
- We do not sell personal information. If we “share” for cross-context behavioral advertising, you can opt out via our “Do Not Sell or Share My Personal Information” link or GPC signal.
Singapore / Indonesia / Malaysia PDPA & other APAC regimes
- Rights of access, correction, withdrawal of consent, and complaint to regulators where applicable.
To exercise rights: contact hello@superbazi.com . We may verify your request (and agent authority where relevant).
- Transactional messages (e.g., receipts, essential service updates) are required to operate the Services.
- Marketing communications (email/newsletters) are opt-in; unsubscribe anytime via in-message link or by emailing unsubscribe@superbazi.com .
Our Services are not directed to children under 16. If you believe a child provided personal data, contact us; we will take appropriate steps to delete or obtain necessary consent.
Our Services may include links to third-party sites. Their privacy practices are governed by their policies; please review them independently.
We may update this Policy from time to time. Material changes will be notified (e.g., in-product notice or email). The “Effective Date” above reflects the latest version.
- General / Data Rights: hello@superbazi.com
- DPO: hello@superbazi.com
- Security Reports: hello@superbazi.com
- Postal: Jakarta, Indonesia