Privacy Policy — Donation Box

Last updated: June 2026

The Donation Box app is run by Yayasan Harapan Sejahtera to manage donation box records and the collections made from them. This policy explains what we collect, how we use it, where it is stored, and what rights you have over it, in line with Indonesia’s Personal Data Protection Act (Law No. 27 of 2022).

1. Data controller

The data controller for this app is Yayasan Harapan Sejahtera. For any question or request about personal data, contact: kontak@demo.example.

2. What we collect

• User account data: the name and email address of the officers and admins who use the app.
• Donation box location data: location name, address, district, sub-district, region, and coordinates where given.
• Collection data: the amount collected, the date, the officer’s name, any notes, and the photo taken as proof.

We collect no sensitive personal data beyond what recording donations requires.

3. How we use it

• Recording and monitoring collections from donation boxes.
• Managing user access by region and role (admin or field officer).
• Producing reports and accounting for how donations are managed. Downloaded reports (Excel/CSV/PDF) may contain the data above, including location addresses and map coordinates, and are intended for the internal use of the organisation.
• Sending collection notifications to managers via Telegram.

4. Where data is stored & cross-border transfer

App data is stored on Supabase with servers in Singapore. Collection photos are stored in Supabase Storage (Singapore). The application itself runs on the hosting service Vercel.

Because those servers sit outside Indonesia, data is transferred across borders. Under the Personal Data Protection Act, such transfers go to countries with an adequate level of protection. By using this app you understand and agree to your data being stored there.

5. Sharing with third parties

We do not sell your personal data. It is processed only by the following third parties, and only to run the service:

• Supabase — database and file storage (data processor).
• Vercel — application hosting; it stores no personal data permanently.
• Telegram — delivery of collection notifications, which include the location name, region, amount, officer’s name, and a link to the photo.

6. How long we keep it

Account data is kept while the account is active. Collection and donation records are kept while the program runs and are archived according to the administrative and accountability rules that apply to the organisation managing the donations. Anything no longer needed is deleted or destroyed.

7. Security

We apply safeguards including user authentication, access limited by role and region, and service credentials kept in server environment variables. Even so, no system is entirely free of risk.

8. Your rights

Under the Personal Data Protection Act, you have the right to:

• Access and obtain a copy of your personal data.
• Correct data that is inaccurate.
• Request deletion of your personal data, as far as that does not conflict with the organisation’s legal and record-keeping obligations.
• Withdraw your consent to the processing of your data.

To exercise any of these rights, contact kontak@demo.example.

9. Changes to this policy

This policy may be updated from time to time. Significant changes will be announced in the app.

10. Contact

Questions about this privacy policy can be sent to: kontak@demo.example.