Privacy Policy
Effective 3 November 2026 · Last updated 3 November 2026
This is a translation; the Indonesian version prevails.
Legal basis: Law No. 27 of 2022 on Personal Data Protection (PDP Law).
1. Controller
MetaBox. Contact: via the Contact page on metabox.id.
2. Data we process
- When you order as a guest: name, phone number, order contents, notes, and (if delivery opens) address and landmark.
- Order data and status history; payment references from the payment provider (never card data).
- Messages you send to customer support.
- Technical security logs (for example IP address for rate limiting and abuse prevention), without order personal data.
- First-party aggregate usage statistics (visits, language, events such as "add to box") with no tracking cookies and no personal data.
- If optional accounts are offered later: the account data you provide.
3. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Process and prepare orders, contact you about them | Performance of the agreement with you |
| Verify payments, refunds, bookkeeping | Agreement and legal obligation |
| System security and fraud prevention | Legitimate interest |
| Aggregate statistics to improve the service | Legitimate interest (no personal data) |
| Marketing | Only with your consent; not done today |
4. Recipients and processors
Our hosting and infrastructure providers, a payment service provider licensed by Bank Indonesia and, if delivery opens, delivery partners. We share data only as needed for the purposes above or when the law requires. GrabFood, GoFood and ShopeeFood process your data under their own policies.
5. Storage and security
Data is stored on our servers. Server location: Finland (European Union), via Hetzner Online GmbH. The database is not publicly reachable, access is role-limited, and staff actions are audit-logged.
6. Retention
We keep data for the following periods, then delete or anonymise it:
- Transaction and financial records: 10 years (Company Documents Law No. 8 of 1997 and tax obligations).
- Order contact details (name, phone number): 2 years after your last order.
- Support messages: 2 years.
- Security logs: 90 days.
- Preview or test data: deleted at launch.
7. Your rights
Under the PDP Law you may access, correct, request deletion or restriction, withdraw consent and object to processing. Contact us via the Contact page on metabox.id. We respond within the periods the regulations set.
8. International transfers
Our servers are located in Finland (European Union), via Hetzner Online GmbH, so your personal data is transferred outside Indonesia. In line with the PDP Law (Law No. 27 of 2022), we ensure that the destination country or recipient offers an equivalent or higher level of personal data protection; if not, we ensure adequate and binding protection, or obtain your consent. The same applies if a payment provider processes data outside Indonesia.
9. Data breaches
If a personal data protection failure occurs, we notify you and the competent authority as the regulations require.
10. Changes
Material changes will be announced on the site with an updated date.
11. Contact
Contact page on metabox.id