Privacy Policy
This page covers what we collect, why, how long we keep it, and your rights. It governs every other policy surface on the brand.
LEGAL REFERENCE
How We Handle Your Account Data
This is the mars88 privacy policy. We wrote it so you know exactly what we collect when you open an account, what we keep on file while you're...
Plain-English policyIndonesia-awareAccount-data scopeUpdated regularlyEasy to contact us
Privacy Posture for Supported Regions
Our privacy practices apply where local law permits and follow the data-protection expectations relevant to Indonesia. We collect only what we need to run your account: identity check fields, contact details, device signals for security, and transaction records linked to your wallet. We retain this data for the period required by financial and audit rules, then archive or remove it. We don't
sell your data. We share it only with processors who help us verify identity, route deposits, and keep the lobby secure — and only under written agreements that match this policy.
Service availability is jurisdiction-dependent. Users are responsible for checking local law before access.
REVIEW SIGNALS
How We Keep This Policy Honest
Editorial Review
Our policy text is reviewed by the brand team before any change goes live, so the wording matches what the platform actually does. No silent rewrites between versions.
Legal Sign-Off
External counsel familiar with Indonesia data rules signs off on material changes. They check retention windows, processor lists and the lawful basis we cite for each data category.
Version History
Every published version is dated and archived. If you signed up under an older policy, you can ask for that exact version and we'll send the PDF to your registered email.
Processor Audits
Vendors that touch your data — KYC partners, payment routers, fraud tooling — are audited annually. We drop any processor that can't show current controls and notify you if scope changes.
Breach Protocol
We run a tested incident plan. If your data is exposed, we contact you on your registered channel, explain what happened, and tell you the steps we're taking before regulators ask.
Staff Training
Everyone with account-data access completes privacy training before logging in and refreshes it each year. Access is role-based and logged, so we can show who saw what.
BENCHMARKED
Consistency Across Our Policy Pages
Cookie Notice
Our cookie page explains the trackers in your browser session. It points back here for the underlying lawful basis and retention rules.
Terms of Service
The terms set the contract between you and mars88. Where they mention data, the wording mirrors this privacy policy exactly to avoid drift.
KYC Notice
Identity-check steps are described in the KYC page. The data categories listed there appear in the table below and follow the same retention windows.
Account Closure
Closing your account triggers the deletion path described here. The closure page explains timing; this page explains what survives for audit law.
Marketing Preferences
Opt-in and opt-out controls live in your account settings. The lawful basis for each marketing channel is recorded in this policy, not elsewhere.
Complaints Path
If you disagree with how we handled your data, the complaints page routes you to the same privacy inbox referenced in the support section above.
AT A GLANCE
What This Policy Page Shows You
Data Categories
A clear list of the fields we hold on your...
Retention Windows
Each category carries a retention window in months or years...
Your Rights Panel
A summary of access, correction, portability and deletion rights with...
Processor Index
The current list of third parties that handle your data...
Change Log
A dated record of every meaningful policy update with a...
Contact Block
The privacy inbox, written-notice address and chat path sit at...
Privacy Questions We Hear Often
We collect your name, date of birth, contact details, an identity document for KYC, and the device signals needed to keep the login secure. Wallet activity is logged against your account for audit.
We share data only with vetted processors who help us verify identity, route DANA, OVO, GoPay and QRIS transactions, and detect fraud. They act on our instructions and never use your data for their own marketing.
Active account data stays while you're with us. After closure we hold financial and KYC records for the period Indonesia rules require, then delete or anonymise the rest on a scheduled cycle.
Yes. Send a request from your registered email to the privacy inbox. We confirm your identity, package the data in a readable format, and deliver it within the window local rules set.
Most fields update inside your account settings instantly. For locked fields like name or date of birth, message the privacy inbox with supporting documents and we'll amend the record after a quick check.
Marketing data goes immediately. KYC and transaction records move to a restricted archive for the legally required period, then drop out of our systems entirely. You'll get a confirmation note when deletion completes.
Yes. Material changes trigger an in-lobby notice and an email to your registered address before they take effect. The change log on this page records every update with the date and a short summary.