Home/Privacy
LegalPlain English

Your data goes to exactly who you say.

We collect what we need to get you quotes, share it only with the licensed partners you consent to, and never sell it to anyone. Here's the whole policy — including the cookies and the IP address, because those count too.

6 min readLast updated 23 August 2026
What we collect

Only what the form asks, plus the receipts.

01

Quote-form answers

Your name, WhatsApp number, email, and what you told us about your insurance needs — the cover type, who it's for, your rough budget. Only what the form asks; we don't collect anything you don't type.

02

Proof of consent

When you submit a quote request we store your IP address, your browser's user-agent string, the exact version of the consent wording you ticked, and a timestamp. This is the record that shows you agreed — and it is what lets us tell a real request from a bot or a prank submission.

03

How you got here

A first-touch cookie (idl_attr) remembers the campaign, referrer, and landing page that brought you to the site, for 90 days. If you arrive again through a newer campaign, the newer one replaces it. This exists so the partner or channel that actually sent you gets credited — not so we can profile you.

04

Outbound clicks

When you click through to an insurer or partner, we log which provider, which page you clicked from, the destination URL, your IP address, any campaign tags, and a random session id (idl_sid) so we can reconcile our numbers against partner dashboards. No names are attached to click logs.

05

Standard server logs

Our hosting provider keeps ordinary request logs — pages visited, response times, errors — so we can fix what's broken. Nothing exotic.

06

What we don't collect

No analytics scripts and no third-party ad trackers today. No Facebook pixel, no ad-network cookies following you around the internet. If that ever changes, this page changes first — and we'll say so loudly.

Why we collect it

Four reasons. All about your quote.

Matching you with licensed partners. Your answers tell us which insurers actually fit your situation, so partners can quote you properly instead of guessing. Legal basis: your consent.
Contacting you about your request. Confirming your request, sending your quotes, answering your questions — on the channels you agreed to. Legal basis: your consent.
Proving consent and stopping fraud. The IP address, user-agent, consent version, and timestamp stored with your request show that a real person agreed to the sharing — and let us block fake or automated submissions before they reach a partner. Legal basis: your consent, plus our legitimate interest in preventing fraud.
Crediting partners fairly. Attribution and click-out records tell us which campaign or page sent a request, so the right partner or channel gets credited and we can check partner reports against our own. Legal basis: our legitimate interest in running the business honestly.

That's the full list. We don't build advertising profiles, and we don't use your data for anything you'd be surprised by.

Who we share it with

Only the partners you consent to. Full stop.

When you submit a quote request, your details go to the licensed insurance partners you consented to — the ones who can actually quote your request. That's the only sharing that happens on purpose. The companies that store or move the data for us are listed in the next section; they process it on our instructions and don't get to use it for themselves.

Never sold. Your data is not a product. No data brokers, no marketing lists, no "trusted third parties" you've never heard of.
Never rented. Nobody pays for access to our database. Partners receive individual requests you initiated — nothing more.
Who handles it for us

Five companies. Named, not hinted at.

These are the processors — companies that store, send, or serve data on our behalf. Some of them are outside Indonesia, which means your data crosses a border. We only use providers with published security and privacy commitments, and we'll keep this list current.

ProcessorWhat they doWhereWhat they see
SupabaseDatabase — stores quote requests, consent records, click-out logsSingaporeEverything you submit, plus IP and user-agent
VercelHosting — serves the site and runs the quote formGlobal edge network, US-headquarteredRequest logs: IP, user-agent, pages visited
ResendEmail delivery — sends a lead summary to the partner you chose (only when enabled)United StatesThe summary of your request, when a partner notification is sent
logo.devInsurer logos — loads provider logos on comparison pagesUnited StatesYour IP and user-agent, as with any image loaded from a third party
WhatsApp (Meta)Messaging — the channel our team and partners reply onPer WhatsApp's own policyYour number and the messages you exchange with us

The quote form has three checkboxes. Here they are, word for word — rendered from the same source the form uses, so they can't drift:

Required

I agree InsuranceIndo may share my information with selected licensed insurance partners.

Required

I agree to be contacted by WhatsApp, phone, or email about my quote request.

Optional

Send me occasional tips and renewal reminders. (Optional)

Consent wording version v2-2026-08-24 — stored with every request, so we can always show you the exact text you agreed to, even if we change the wording later.

The two required boxes exist because without them we literally can't do the job — no sharing means no quotes, no contact means no way to send them. The third is genuinely optional; skipping it changes nothing about your quotes.

The STOP switch: reply STOP to any partner on WhatsApp and they're cut off — no follow-ups, no “one last offer,” no re-adding you to a list. Consent is yours to withdraw, one partner at a time or all at once.

WhatsApp communications

We work where you already are.

WhatsApp is how Indonesia talks, so it's our main channel too. When you consent to contact, quotes and follow-ups arrive on the WhatsApp number you gave us — from a person on our team and from the partners quoting your request. There is no bot on the other end. Messages travel over WhatsApp's own end-to-end encryption; WhatsApp's handling of your account is governed by Meta's privacy policy, not ours.

We keep it useful, not chatty: your quotes, answers to your questions, and — only if you ticked the optional box — the occasional tip or renewal reminder.

How long we keep it

Actual numbers. Not “as long as necessary.”

Quote requests (your form answers) 24 months after our last contact with you, then deleted. If you bought a policy through us, your name, number, email and answers are erased on the same schedule; only the anonymous commercial record (reference, category, premium, date) stays for accounting.
Consent records (IP, user-agent, wording version, timestamp) Kept with the quote request and deleted with it.
Click-out logs 13 months, then deleted.
Attribution cookie (idl_attr) Expires on its own after 90 days.
Click session cookie (idl_sid) Expires on its own after 1 year.

If Indonesian law obliges us to hold something longer — tax or record-keeping rules, for instance — we hold only that part, only for that long. Ask us to delete your data sooner and we will, except the parts the law requires us to keep; we'll tell you exactly what stays and why.

Your rights

UU 27/2022 gives you rights. We honor them on WhatsApp.

Under Indonesia's Personal Data Protection Law (UU 27/2022, the “PDP Law”), your data is yours. That means you can:

Access it. Ask what we hold about you and we'll show you — including the consent record.
Correct it. Wrong number, old email, typo in your name — tell us and we fix it.
Delete it. Ask and we erase it, minus anything the law requires us to keep. We'll tell you exactly what stays and why.
Withdraw consent. Stop the sharing, the contact, or the marketing at any time. Withdrawing doesn't undo what was already shared, but it stops everything from that moment on.

To use any of these, message us on WhatsApp — the same number your quotes come from. No forms, no 30-day acknowledgment letters; a human answers and it gets done.

Cookies & identifiers

Three cookies. No ad cookies.

Here is every cookie this site sets, by name. None of them are advertising cookies and none are shared with ad networks; they exist so the site works and so partners get credited for the people they actually sent us. That's why there's no cookie banner begging you to “accept all”. If we ever add analytics or marketing cookies, this table gets a new row before they do.

CookiePurposeLifetime
idl_attrRemembers which campaign, referrer, or landing page brought you here, so partners and channels are attributed fairly. First touch wins within the window; a newer campaign replaces an older one.90 days
idl_sidA random id set when you click out to a partner, so we can reconcile our outbound click counts with partner dashboards. Contains no personal data.1 year
id_admin_session / id_partner_sessionKeeps our team or a signed partner logged in to their dashboard. Only ever set when someone logs in — visitors never get one.12 hours

Not a cookie, but you should know: your IP address and browser user-agent are stored with each quote request as proof of consent, and logged each time you click out to a partner. Insurer logos are loaded from logo.dev, so your browser makes an image request to them the same way it would for any third-party image.

One honest note

This policy is written by humans, for humans, and checked against what the code actually does. A lawyer-reviewed version is coming as we formalize the entity — the promises won't change, but the wording will get sturdier. If anything here is unclear, ask us on WhatsApp and a person will explain it.

Last updated: 23 August 2026