Privacy Policy

Last updated: October 7, 2026

This Privacy Policy explains what personal data BoardBali (boardbali.com and the BoardBali apps for Android and iPhone) collects, why we collect it, who we share it with and the choices you have. We follow Indonesia's Personal Data Protection Law (UU PDP No. 27/2022) and, for visitors from the European Union and the United Kingdom, the GDPR.

Who is responsible

BoardBali decides how your personal data is used (the data controller under the GDPR, the "personal data controller" under UU PDP). For any privacy question or request, write to atakan.serce4@gmail.com. We answer as soon as we can and within the time limits the law sets — for example 3 × 24 hours for requests to see or correct your data under UU PDP.

What we collect

Account: when you sign in with Google we receive your name, e-mail address and profile photo; we never see your Google password. Profile: the phone number you add (shown on your listings only after our team approves it) and, if you ask to be verified, the documents you send, which only our team can see. What you post: listings, photos, the approximate map location you choose, messages, reviews, reports and feedback. Device: browser and device type, language, time zone and, in the app, a notification token.

How we use it

To run BoardBali: show your listings, deliver messages and notifications and keep you signed in. To keep it safe: review listings before they go live, prevent spam, fraud and abuse. To translate listings and messages automatically (the text is sent to a translation service without your name). To show sellers how their listings perform and to improve the site. And to meet legal obligations. We do not sell your personal data.

Why we may use it (legal basis)

To provide what you asked for — your account, listings, messages and purchases (a contract with you). To keep BoardBali safe, prevent fraud and improve it (our legitimate interests, weighed against yours). With your consent, which you can withdraw at any time: optional cookies, the analytics identifier, advertising cookies and push notifications. And where the law requires it, for example keeping purchase records.

Cookies and local storage

Necessary: a cookie that keeps you signed in, your language choice and security checks; your browser also stores your cookie choice, favourites and recently viewed listings. Optional, only if you accept: a random analytics identifier and Google's advertising cookies. You can change your choice at any time with "Cookie settings" at the bottom of every page.

Analytics

We measure how BoardBali is used with our own first-party analytics — pages viewed, listings seen and opened, searches, contacts and page speed — to improve the site, show sellers how their listings perform and order results. These analytics use no third-party trackers and we do not store IP addresses (advertising is explained below). If you accept cookies we keep a random identifier in your browser to recognise returning visits; if you decline, you are counted with an anonymous identifier that changes every day. Raw analytics events are deleted after about a year.

Advertising and Google AdSense

BoardBali shows ads to keep the site free to use: sponsored listings and businesses sold by us, and ads from Google AdSense in spaces nobody has bought. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to BoardBali and/or other sites on the Internet. Google ads are only loaded after you accept cookies in our banner; if you reject them, no advertising cookies are set by us. How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites

You can opt out of personalised advertising at any time in Google's Ads Settings (https://adssettings.google.com), and opt out of other third-party vendors' use of cookies for personalised advertising at https://www.aboutads.info/choices. You can also clear or block cookies in your browser.

Payments

Extra listings and promotions are bought only in the BoardBali apps, through Google Play or the App Store. Google or Apple processes the payment; we never see your card or wallet details. We keep what was bought, the store order number, the date and the status, as required for accounting.

Who we share it with

Public: what you put in a listing, your public name, rating and approved phone number. Service providers that help us run BoardBali: Google (sign-in, AdSense, Google Play billing, notifications), Apple (App Store, notifications), machine translation providers, our hosting provider (servers in the European Union) and the map providers OpenFreeMap and OpenStreetMap (your browser fetches map images from them, so they see your IP address). Authorities, only when the law requires it. Each provider may only use the data to provide its service.

How long we keep it

Your account data is kept while your account exists. When you delete your account, your profile, listings, messages, reviews and saved searches are deleted at once. Listings end after 30 days and can be deleted at any time. Purchase records are kept as long as accounting law requires. Server logs, which include IP addresses, are kept for up to 14 days to protect the site from attacks and abuse. Backups are kept for 14 days and then overwritten.

Your rights

You can ask to see, correct, export or delete your data, object to how we use it and withdraw your consent at any time. You can delete your account yourself on the Delete your account page, or write to us. You also have the right to complain to your data protection authority.

Security

BoardBali is only served over HTTPS, sign-in goes through Google so we store no passwords, and verification documents are kept outside the public site where only our team can open them. No system is perfectly secure, but we work to protect your data and fix problems quickly.

Children

BoardBali is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

International transfers

Our servers and some of our providers, such as Google, are located outside Indonesia, so your data may be processed in other countries. We only use providers that protect personal data to a standard comparable to the law that applies to you.

Changes to this policy

If we change this policy, the date at the top changes. If the change is important we will also tell you on the site or in the app before it applies.

Contact

For any question about your data, or to ask us to correct or delete it, write to atakan.serce4@gmail.com. You can also delete your listings at any time from your account.