Reference

How We Protect Your Personal Data

At gulalitoto, your personal data — from account registration details to payment records across DANA, OVO, GoPay, and QRIS — is handled with clear retention rules and strict…

End-to-end data encryptionDANA, OVO, GoPay & QRIS transaction privacyYour right to access or erase your data24/7 data support channelIndonesia-specific data handling

Explore Lobby Read FAQ

Explore What Data We Collect and Why

gulalitoto Service availability depends on jurisdiction. Users are responsible for checking local law before access.

We collect data you provide directly — your name, email address, phone number, and payment method identifiers such as your DANA wallet ID or linked OVO number — as well as technical data like your device type and session timestamps. We also log transaction references when

1
you deposit or withdraw via GoPay or QRIS so we can resolve disputes quickly. Data is stored on secured servers and is not sold to third parties. Access to your personal records is restricted to authorised gulalitoto staff operating under strict internal confidentiality agreements. Your use
2
of our platform, and the data rights available to you, depends on local law.

Service availability depends on jurisdiction. Users are responsible for checking local law before access.

DATA PRIVACY CONTACT

Open a Privacy Request With Our Team

If you want to access, correct, or delete your personal data held by gulalitoto, our dedicated privacy support channel is available around the clock.

DATA HANDLING STANDARDS

Browse How gulalitoto Manages Your Privacy

Every layer of your account data — from login credentials to payment channel records — is governed by the six practices below.

Data Encryption in Transit

All data moving between your device and our servers is encrypted using TLS 1.3. This applies to login sessions, DANA and OVO payment confirmations, and any form submission on the site.

Cookie Usage

We use session cookies to keep you logged in and preference cookies to remember your lobby settings. We do not use third-party advertising cookies. You can clear cookies via your browser settings at any time without losing your account.

Account Security Controls

Your account is protected by a hashed password and optional two-factor authentication via SMS. Failed login attempts beyond five in a row trigger an automatic account lock, and we send an alert to your registered email immediately.

Data Retention Schedule

Transaction records — including GoPay and QRIS deposit logs — are retained for a maximum of five years for dispute resolution. Account profile data is deleted within 30 days of a confirmed account closure request.

Third-Party Data Sharing

We share data only with payment processors (such as your DANA or OVO provider) and identity verification partners where required. We do not sell, rent, or exchange your personal data with marketers or analytics brokers.

Your Rights and How to Exercise Them

You may request a full copy of your personal data, ask us to correct inaccuracies, or ask for erasure — subject to what depends on local law. Submit any of these requests via live chat, email, or your in-account privacy ticket.

Switch Through Your Most Common Privacy Questions

The questions below reflect what account holders in Indonesia ask us most frequently about data collection, storage, and their rights under this Privacy Policy. If your question is not covered here, our live chat team is available 24 hours a day.

We collect your full name, email address, phone number, date of birth, and the payment method identifiers you link — such as your DANA wallet number or OVO account. We also log the device type and IP address used during registration.

Authorised staff can see transaction reference numbers and amounts to resolve disputes, but they cannot access your DANA or OVO account directly. Your payment provider handles the authentication on their side; we only see the confirmed transfer record.

Profile data is deleted within 30 days of a confirmed account closure. Financial records such as GoPay and QRIS deposit logs are kept for up to five years to meet dispute resolution requirements, after which they are permanently erased.

Yes. Log in, go to Settings, select 'Privacy & Data', and submit a data access request. We will compile and send a full copy of your personal record to your registered email within 7 business days of receiving your request.

We share data only with payment processors like your DANA or QRIS provider and identity verification services where necessary. We do not sell your data or share it with advertisers. Any sharing depends on local law and is limited to what is strictly required.

Submit an erasure request through our live chat, privacy email inbox, or the in-account 'Privacy & Data' ticket form. We acknowledge within 24 hours and complete the deletion within 7 business days, subject to legal retention obligations.

We use session cookies for login continuity and preference cookies for lobby settings. No third-party advertising cookies are placed. You can clear or block cookies through your browser settings at any time; your account data is not affected.

How We Protect Your Personal Data

Open a Privacy Request With Our Team

Browse How gulalitoto Manages Your Privacy

Data Encryption in Transit

Cookie Usage

Account Security Controls

Data Retention Schedule

Third-Party Data Sharing

Your Rights and How to Exercise Them

Switch Through Your Most Common Privacy Questions

01 What personal data does gulalitoto collect when I open an account?

02 Is my DANA or OVO transaction history visible to gulalitoto staff?

03 How long does gulalitoto keep my personal data after I close my account?

04 Can I request a copy of all the data gulalitoto holds about me?

05 Does gulalitoto share my data with third parties?

06 How do I ask gulalitoto to delete my personal data?

07 What cookies does gulalitoto use and how do I control them?

Related Pages