Privacy Policy

Effective 27 October 2026

This is an English translation. If it differs from the Indonesian version, the Indonesian version applies.

Vestodia is a personal finance tracking and planning app run as a sole proprietorship in Indonesia. This policy explains what data we process, why, and your rights over that data under Indonesian Law No. 27 of 2022 on Personal Data Protection.

Data we process

• Account identity: your Telegram username and ID, and the display name and profile photo you choose.
• Financial data you enter: transactions, accounts and balances, assets, debts and receivables, budgets, goals, and preferences.
• Receipt photos and voice notes you send to be recorded automatically.
• Technical data: records of feature and quota use (counts and types, without the content of your messages), and error logs to keep the service running and prevent abuse.
• Payment data (if you subscribe to Pro): status and order number from the payment provider. We do not store card numbers or PINs.

What the data is used for

• Showing your financial summaries, reports, budgets, and goals.
• Sending the reminders you turn on.
• Answering your questions through the AI assistant, based on your own data.
• Managing plans, quotas, and payments.

We do not sell your data, show ads, or share your data for other parties' marketing.

Parties that help us

• Telegram: where the Vestodia bot and Mini App run.
• Google (Gemini API): reads receipt photos, voice notes, and questions to the AI assistant. Media is sent only when you ask for it and we do not keep it after processing.
• DigitalOcean: the servers that store data, located in Singapore. By using Vestodia, you agree to the transfer of data outside Indonesia for this purpose.
• Market data providers: prices for stocks, crypto, gold, and exchange rates. They do not receive your personal data.
• Midtrans (once payments are available): processes Pro plan payments.

How long data is kept

Data is kept while your account is active. If you delete your account, your financial data is removed from our servers within 30 days. Payment records are kept as required by law.

Your rights

• View and export your data (using the export feature in the app or by email request).
• Correct inaccurate data.
• Delete your account and all your data.
• Withdraw consent, for example by turning off reminders or no longer using AI features.

Send requests to [email protected]; we respond within 3 x 24 business hours.

Security

Connections are encrypted (HTTPS), dashboard access is verified through Telegram, and service keys are stored separately from the code. No system is fully immune; if a breach affects you, we will notify you within 3 x 24 hours as required by the Personal Data Protection Law.

Changes

If this policy changes in a meaningful way, we will notify you through the bot before the change takes effect.