This policy explains what data WaitYa (“we”) collects, why, how long we keep it, and what your rights are. It covers the website at waitya.com and the app at app.waitya.com.
Two groups of people use WaitYa:
- Business owners and staff, who create an account to run a queue.
- A business’s customers, who take a queue number. They do not create an account.
For customer data, the business that uses WaitYa decides what is recorded. We store and process it on that business’s behalf, only to run its queue.
Data we collect
Account. Your name, email address, and chosen language. Your password is stored as a one-way hash that cannot be read back, by us or anyone else. If you sign in with Google, we receive your name, email address, and Google account ID. We never receive your Google password and cannot open your Gmail, Drive, or contacts.
Business. The business name, public page address, street address (if given), ticket text, logo, the word for its service points (such as Table or Counter), and the language shown to customers.
Queue. Queue numbers, party size, status, and when each number was called. A customer’s name is recorded only if staff type it in. On any page the public can see, names are always masked, for example Bu***.
Security. For each sign-in session: the IP address, the kind of device and browser, and when it was last used. We also count failed sign-in attempts so we can lock an account for a short while when someone guesses at its password. Our servers log incoming requests for security and to find the cause of problems.
How we use data
- To run the service: showing the queue in the app, on the TV screen, on customer pages, and on tickets.
- To sign you in and keep your account safe, including telling you when your account email changes.
- To send account emails: verification codes, password resets, and security notices. We do not send promotional email without your consent.
- To count queue statistics without identities, such as customers per day.
We do not sell data, show ads, or use third-party advertising trackers or analytics.
Cookies and browser storage
The app uses one cookie to keep you signed in. Scripts on the page cannot read it. Your browser also keeps a few choices on your own device, such as your language and which getting-started steps you have finished. We do not use advertising or analytics cookies. The waitya.com website sets no cookies of its own, and only remembers the language you chose in your browser. Cloudflare, which protects the website and the app, may set technical cookies to tell real visitors from automated attacks.
Who helps us
We use a few service providers. Each receives only the data its job needs:
- Our server host, where the app and its database run.
- Cloudflare, for the domain name, protection from attacks, and storing and delivering business logos.
- Resend, to send account emails.
- Google, only if you choose to sign in with Google.
Some of these providers are outside Indonesia, so data may be processed in other countries. We only use providers that apply appropriate data protection.
How long we keep data
- Customer names are deleted automatically 30 days after the queue session closes. A session left open is closed automatically after 24 hours. Numbers without identities are kept for statistics.
- Sign-in session records are deleted 30 days after the session ends.
- When a business is deleted, its public page goes offline at once and the business can be restored for 30 days. After that, the account, the business, its logo, and all its queue data are deleted for good.
- Server logs are kept only as long as needed for security and to find the cause of problems.
Security
All connections use HTTPS. Passwords are stored as hashes, an account is locked for a short while after repeated failed sign-ins, and you can see and sign out the devices on your account from the settings page. No system is completely secure. If a breach affects your data, we will tell you as the law requires.
Your rights
Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022), you have the right to:
- know what data we hold about you and get a copy of it;
- correct data that is wrong, for example your name or email on the settings page;
- delete your data, by deleting your business on the settings page or by asking us;
- withdraw your consent and stop using the service at any time.
To use these rights, email [email protected] from your account’s email address. Customers whose names were recorded in a queue should first contact the business concerned. If they write to us instead, we will pass the request on to that business.
Age
WaitYa is meant for adults who run a business. Children under 18 may not create an account.
Changes to this policy
If we make an important change, we will tell you by email or in the app before it takes effect. The date at the top of this page shows the latest version.
Contact us
Questions about privacy can be sent to [email protected].