Privacy Policy

Data we process

• Account data: name, email, and sign-in information.
• Event data: title, relevant names, date, message, and event settings.
• Guest and content data: name, relationship, video, duration, and information related to submission.
• Transaction data: orders, plans, amounts, status, and payment proof.
• Security and usage data: IP address, browser/device, activity time, and records needed for security and service operation.

Purpose and basis of processing

Data is used to provide the service, fulfil orders, maintain security, prevent abuse, handle support, meet legal obligations, and protect user rights. We limit processing to relevant purposes and use an appropriate lawful basis, including consent, service performance, legal obligations, or another basis permitted by law.

Service partners

We may use other service providers to support storage, account access, payments, communications, connectivity, security, or other supporting functions. They receive data only as needed for those functions and we seek appropriate safeguards.

Where data is processed outside Indonesia, we will handle the transfer in accordance with applicable data-protection requirements.

Data security

We use reasonable technical and organizational measures to help protect data against unauthorized access, use, alteration, disclosure, or loss. Safeguards are reviewed and may be updated as risks and the service evolve.

No electronic system can be guaranteed to be entirely risk-free. This statement does not reduce our obligation to protect data and handle incidents as required by law.

Retention and deletion

We retain data for as long as needed to provide the service, follow applicable plan and recovery periods, meet legal obligations, resolve disputes, and maintain security. Data that is no longer required will be deleted or otherwise handled under our retention policy and applicable law.

Your rights

Requests may require identity verification so we do not disclose or change data for the wrong person. Certain rights may be subject to exceptions permitted by law.

• Request information about and access to personal data.
• Request correction of inaccurate data.
• Request deletion or restriction where applicable conditions are met.
• Withdraw consent where processing depends on consent.
• Raise an objection or complaint through support.

Security incidents

If we become aware of a data-protection incident, we will assess it, take reasonable response measures, document required actions, and notify parties who must be notified where required by law.

User obligations toward others' privacy

Event owners and submitters must not use Rorakay to collect, submit, or distribute another person's personal data without the required basis, rights, or consent. Users are responsible for their use of data outside the Rorakay service.

Security and service activity data

Rorakay processes technical activity data when reasonably necessary to secure the service, prevent abuse, investigate incidents, provide support, and maintain reliable operations.

• IP address and network-derived country/city information when available. This is approximate network information and is not GPS or precise physical location data.
• Browser and device information, accessed page or path, activity timestamps, and page visibility state.
• Anonymous session identifiers used for security, service presence, and product analytics where a visitor is not signed in.
• First-seen and last-seen timestamps used to assess operational session activity.

Access to raw IP addresses and security monitoring information is restricted to authorized administrators and is not made available to event owners, ordinary users, or other guests through the public guest experience.

These records are retained only for as long as reasonably necessary for security, abuse prevention, troubleshooting, audit, service operation, and applicable legal obligations.