Privacy Policy

Who we are

Vlora is booking and payment software for fitness studios in Indonesia, such as pilates and yoga. The service is operated by PT Fintastic Digital Inovasi, based in Denpasar, Bali, Indonesia.

This policy is written against Law Number 27 of 2022 on Personal Data Protection (UU PDP), and covers the vlora.app website, each studio's public booking pages, and the dashboard application at dash.vlora.app.

Our two roles over your data

Vlora serves many studios at once. Our legal position differs depending on whose data is in question, and that difference determines who you address a request to.

Vlora as Controller

For data about visitors to vlora.app and about account holders who register and sign in to the dashboard. We determine the purpose and means of processing, and requests about this data come directly to us.

Vlora as Processor

For client data a studio enters into the system, such as class participants' names, contact details, notes, and booking history. The studio is the Controller of that data: the studio collects it, decides its purpose, and is responsible for its lawful basis. We process it on the studio's instructions.

If you are a class participant at a studio and want to access, correct, or delete your data, address the request to the studio you are registered with. We help the studio act on it, but we are not authorised to change or delete client data on a direct request without that studio's knowledge.

What we collect

The actual inventory of what is stored, grouped by where it comes from.

Site visitors

IP address, browser type, and pages viewed, through server logs and the cookies described in section 7. The demo request form on the landing page sends nothing to our servers. It opens WhatsApp with the message pre-filled, so we receive it as an ordinary WhatsApp message and WhatsApp's own privacy terms govern that transmission.

Account holders

First and last name, email address, your password as a hash (we never store the password itself), the studio you belong to, and your permissions within it.

Studio clients

Name, email, phone number, date of birth, gender, address, emergency contact, notes, medical notes, waiver signature status, booking history, and total spend. Which fields are actually filled in is decided by the studio, not by us.

Bookings and payments

Classes booked, packages and credits you hold, and transaction status. Payment instrument data is processed by Duitku as the licensed payment provider; card numbers never pass through or rest in our systems.

Specific personal data

Two fields in the list above are specific personal data under Article 4(2) of the UU PDP: medical notes and date of birth. Both are optional and are only filled in if a studio chooses to collect them.

Medical notes are collected by the studio, not by Vlora. The studio is responsible for obtaining its client's explicit consent before filling that field, and for ensuring only staff who need it can see it. We provide the access control; we do not decide what is written in it.

We do not use this data for any purpose beyond showing it back to the studio that owns it. It is not analysed, not profiled, and not shared with anyone.

Purposes and basis for processing

• Running the service: creating and maintaining accounts, processing bookings, issuing payment receipts, and sending transactional email such as class confirmations and schedule reminders.
• Security: detecting suspicious sign-in attempts, rate-limiting requests, and recording application errors so faults can be found and fixed.
• Legal obligations: retaining transaction records for as long as tax and bookkeeping regulations require.
• Communication: answering questions you send us by email or WhatsApp.

We do not sell personal data, and we do not share it with advertisers or data brokers.

Signing in with Google

Vlora offers signing in with a Google account. If you use it, we receive from Google only your name, email address, profile picture, and your Google account's unique identifier. We do not receive your Google password and we gain no access to Gmail, Drive, Contacts, or any other Google service.

That data is used solely to create and recognise your Vlora account. It is not sold, not shared with third parties other than the processors named in section 9, and not used for advertising or to train any model.

You can revoke Vlora's access to your Google account at any time from your Google account permissions page, and request deletion of your Vlora account through the contact in section 15.

Cookies

We use the cookies needed to run a signed-in session, plus analytics cookies on the vlora.app marketing pages. Vlora sets no advertising cookies.

vlora_access

Marks an active session. Set on the parent domain so public pages can tell that you are signed in.

vlora_refresh

Renews a session without asking you to sign in again. Restricted to the dashboard host.

vlora_preauth

Bridges the studio-selection step when your account has access to more than one studio. Restricted to the dashboard host.

All three are httpOnly, so no script in the browser can read them.

On the vlora.app website — every page of it, articles included, this privacy policy and the terms of service among them — we load a Google Tag Manager container of our own, running Google Analytics. It sets cookies named _ga and _ga_ followed by a container identifier, to count visits and recognise a repeat visit from the same browser. These are not httpOnly, because Google's own script is what reads them. A studio's booking pages, at that studio's own address under vlora.app, are not part of the website.

That measurement stops at the marketing pages. The dashboard at dash.vlora.app loads no analytics script at all — not switched off by a setting that could be switched back, but never included there in the first place. What you do once signed in is not measured by us.

Studio pages and third-party tags

Each studio may install its own Google Tag Manager container on its public booking pages. That container is managed by the studio, not by us.

We therefore cannot guarantee a fixed list of which tags are active on a given studio's pages. A studio can add analytics tools or advertising pixels at any time without telling us. What governs those tags is that studio's own privacy policy, not this one.

The vlora.app marketing pages carry one Google Tag Manager container of Vlora's own, and we decide what goes in it: Google Analytics and nothing else, as described in section 7. No studio's container runs there, and ours runs on no studio's booking pages.

Third parties that process data

Duitku

A licensed Indonesian payment provider. Processes QRIS, virtual account, and card transactions. Your payment instrument data sits with them, not with us.

Cloudflare R2

File storage: studio logos, class photos, and uploaded documents.

Sentry

Application error reporting, so faults can be found and fixed. Receives technical error traces, which can contain account identifiers.

Google Analytics

Visit statistics for the vlora.app marketing pages, loaded through Google Tag Manager. Receives your IP address and the pages you open. It is not present on the dashboard or on a studio's booking pages.

Email delivery provider

Delivers transactional email such as booking confirmations and password resets.

Some of the providers above run their infrastructure outside Indonesian territory, so part of the processing takes place across borders. We select providers that apply protection equivalent to what the UU PDP requires, and bind them with data processing terms.

Beyond this list, we disclose data only where required by law or on a valid request from law enforcement.

Storage and retention

We keep personal data for as long as it is needed for the purposes in section 5: for accounts, while the account is active; for studio client data, while the studio remains a Vlora customer and has not deleted it themselves.

Transaction records are kept longer than other data, because tax and bookkeeping regulations require it.

We do not run automatic deletion on a fixed deadline. Deletion happens on request or when an account is closed, through a process a person carries out. We say so plainly rather than publishing a retention period the system does not enforce.

Security

• Passwords are stored as hashes, never in their original form.
• All traffic runs over HTTPS.
• Each studio's data is separated at the database level, so one studio cannot read another's.
• Each studio's payment credentials are stored encrypted.
• Staff access to data is limited by per-role permissions.

No system is completely immune. In the event of a personal data protection failure, we will notify you and the competent authority as Article 46 of the UU PDP requires.

Your rights

The UU PDP gives you a number of rights over your personal data:

• Obtain information about the data we process about you and why.
• Complete or correct inaccurate data.
• Access and obtain a copy of your data.
• End the processing of, delete, or destroy your data.
• Withdraw consent you previously gave.
• Object to decision-making carried out solely by automated means.
• Claim compensation for a violation in the processing of your personal data.

For data we control ourselves, send the request to the address in section 15 and we will respond within a reasonable time. For studio client data, address the studio. The reason is set out in section 2.

Children's data

Vlora is not directed at children under 18 and we do not knowingly collect children's data. Where a studio admits underage participants, obtaining parental or guardian consent is the studio's responsibility under Article 25 of the UU PDP.

Changes to this policy

This policy may change as the service develops. The date of the last change appears at the top of the page. For changes that materially affect your rights, we notify account holders by email.

Contact us

Questions, requests about your data, or objections can be sent to:

Data Controller

PT Fintastic Digital Inovasi

Address

Denpasar, Bali, Indonesia

Email

hi@vlora.app

If you consider our handling inadequate, you have the right to complain to the authority competent for personal data protection.