Privacy Policy

Last updated: October 15, 2026

1. Data Controller

Baliestate is operated by Koza Lab (PT. KOZA LAB), an Indonesian entity based at Canggu, Bali, Indonesia. Koza Lab is the data controller responsible for your personal data under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).

Contact: [email protected]

2. Data We Collect

We collect only what is needed to provide the property search service:

  • Account identifiers — Telegram user ID, username, or phone number (depending on how you log in)
  • Search history — your property search queries, preferences (area, budget, bedrooms), and saved listings
  • Conversation data — messages exchanged with Baliestate to provide personalized recommendations
  • Device information — browser type, screen resolution, and language (used for session management, not tracking)
  • UTM parameters — referral source if you arrived via a shared link (used to measure which channels are effective)

We do not collect: government IDs, financial information, precise GPS location, or data from your Telegram contacts.

3. How We Use Your Data

Your data is used for:

  • Property search — answering your queries with relevant listings from our database
  • Personalization — remembering your preferences, saved listings, and search alerts
  • Service improvement — understanding common search patterns to improve our recommendations
  • Lead referral — connecting you with property agents or service providers, only with your explicit consent

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties without your explicit consent.

4. Data Sharing

We share your data only in these cases:

  • With your consent — when you ask Baliestate to connect you with a property agent or service provider, we share relevant search context (area, budget, property type) so the agent can help you effectively. You will always be asked before any handoff.
  • Service providers — we use Google Cloud (database and application hosting), Google Analytics (website usage statistics), OpenAI (AI processing), and Telegram/WhatsApp (messaging). These providers process data on our behalf under their own privacy policies.
  • Legal requirements — if required by Indonesian law or a valid court order.

5. Data Retention

We retain your data for as long as your account is active. Specifically:

  • Conversation history — retained to provide context in ongoing searches. Summarized after 6 message pairs.
  • Search preferences and saved listings — retained until you delete them.
  • Account data — retained until you request deletion or after 2 years of inactivity.

6. Your Rights

Under UU PDP (Article 20), you have the right to:

  • Access your data — send /profile to Baliestate to see what we know about you
  • Delete your data — send /forget to Baliestate to permanently delete all your data. This is immediate and irreversible.
  • Withdraw consent — you can stop using the service at any time. Existing data will be deleted upon request.
  • Correct your data — send /profile and update any incorrect preferences
  • Object to processing — contact us at [email protected]

7. Data Security and Breach Notification

We protect your data using:

  • Encrypted connections (HTTPS/TLS) for all data in transit
  • Credentialed, access-controlled database hosting (Google Cloud SQL)
  • HMAC signature verification for Telegram authentication
  • Prompt injection defenses in our AI processing

In the event of a data breach affecting your personal data, we will notify you within 3x24 hours and report to the relevant Indonesian regulator, as required by UU PDP.

8. Cookies and Browser Storage

We use one first-party cookie (baliestate_uid) to recognize returning users. This cookie contains your user ID and has a 1-year expiry. Google Analytics also sets its own cookies (_ga and _ga_*) to count visits and see which pages are used. No cookie consent banner is required under Indonesian law (UU PDP does not mandate cookie consent banners for functional cookies).

We also use localStorage to store your chat session ID and message history for convenience.

9. Baliestate Partner, Google Sign-In and Google Calendar

Baliestate Partner (partner.baliestate.co) is the dashboard property agencies and their agents use. It uses Google data only as described here.

  • Sign in with Google — your Google account ID, name, email address and profile picture, used only to sign you in.
  • Google Calendar, only if you connect it — an agent can connect their own Google Calendar on the Calendar page. Baliestate then adds, updates and removes events for the viewings, handovers and signings you book in Baliestate, on calendars you own; reads whether you are busy or free, never what your other events are, so it does not offer viewing times you cannot make; and reads back the events it created, to see whether you moved or deleted one in Google Calendar.

What we store: the Google account email you connected, an encrypted token that lets the sync run while you are signed out, and the ID of each event Baliestate created. We do not store your other calendar events, their titles, guests or notes, or your busy times.

How it is used: only to provide the calendar features you see in Baliestate Partner. It is not sold, not used for advertising, not used to train AI models, and not read by people at Baliestate unless you ask us for help, for security, or when the law requires it. When you ask for an AI reply draft, the viewing time it suggests (chosen to avoid your busy times) is sent to OpenAI with the draft request; your busy times and calendar events are not.

Deleting it: Disconnect on the Calendar page revokes Baliestate's access at Google and deletes the token and event IDs at once. You can also remove access in your Google Account under Security, Third-party apps. Events already added stay in your calendar until you delete them.

Baliestate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the policy

10. Changes to This Policy

We may update this policy as our service evolves. Significant changes will be communicated through the Baliestate bot. The “last updated” date at the top reflects the most recent revision.

11. Contact

For privacy-related questions or to exercise your rights:

  • Email: [email protected]
  • Bot: send /profile or /forget to Baliestate
  • Entity: PT. KOZA LAB (Koza Lab), Canggu, Bali, Indonesia