Privacy Policy

Who we are

Vlora is booking and payment software for fitness studios in Indonesia, such as pilates and yoga. The service is operated by PT Fintastic Digital Inovasi, based in Denpasar, Bali, Indonesia.

This policy is written against Law Number 27 of 2022 on Personal Data Protection (UU PDP), and covers the vlora.app website, each studio's public booking pages, the dashboard application at dash.vlora.app, and the documentation at docs.vlora.app.

Our two roles over your data

Vlora serves many studios at once. Our legal position differs depending on whose data is in question, and that difference determines who you address a request to.

Vlora as Controller

For data about visitors to vlora.app and about account holders who register and sign in to the dashboard. We determine the purpose and means of processing, and requests about this data come directly to us.

Vlora as Processor

For client data a studio enters into the system, such as class participants' names, contact details, notes, and booking history. The studio is the Controller of that data: the studio collects it, decides its purpose, and is responsible for its lawful basis. We process it on the studio's instructions.

If you are a class participant at a studio and want to access, correct, or delete your data, address the request to the studio you are registered with. We help the studio act on it, but we are not authorised to change or delete client data on a direct request without that studio's knowledge.

What we collect

The actual inventory of what is stored, grouped by where it comes from.

Site visitors

IP address, browser type, and pages viewed, through server logs and the analytics and cookies described in section 7. The demo request form on the website's pages sends nothing to our servers. It opens WhatsApp with the message pre-filled, so we receive it as an ordinary WhatsApp message and WhatsApp's own privacy terms govern that transmission.

Account holders

First and last name, email address, your password as a hash (we never store the password itself), the studio you belong to, and your permissions within it.

Studio clients

Name, email, phone number, date of birth, gender, address, emergency contact, notes, medical notes, waiver signature status, booking history, and total spend. Which fields are actually filled in is decided by the studio, not by us.

Bookings and payments

Classes booked, packages and credits you hold, and transaction status. Payment instrument data is processed by Duitku as the licensed payment provider; card numbers never pass through or rest in our systems.

Specific personal data

Two fields in the list above are specific personal data under Article 4(2) of the UU PDP: medical notes and date of birth. Both are optional and are only filled in if a studio chooses to collect them.

Medical notes are collected by the studio, not by Vlora. The studio is responsible for obtaining its client's explicit consent before filling that field, and for ensuring only staff who need it can see it. We provide the access control; we do not decide what is written in it.

We do not use this data for any purpose beyond showing it back to the studio that owns it. It is not analysed, not profiled, and not shared with anyone.

Purposes and basis for processing

• Running the service: creating and maintaining accounts, processing bookings, issuing payment receipts, and sending transactional email such as class confirmations and schedule reminders.
• Security: detecting suspicious sign-in attempts, rate-limiting requests, and recording application errors so faults can be found and fixed.
• Legal obligations: retaining transaction records for as long as tax and bookkeeping regulations require.
• Communication: answering questions you send us by email or WhatsApp.
• Measurement and advertising: counting visits to the vlora.app website and the documentation, and, on the website only, showing Vlora's own ads to people who have visited it, as described in section 7.

We do not sell personal data, and we do not share it with data brokers. The only advertising use is the one in section 7, on the vlora.app website: no account data, no studio client data, and nothing from the dashboard is ever used for advertising.

Signing in with Google

Vlora offers signing in with a Google account. If you use it, we receive from Google only your name, email address, profile picture, and your Google account's unique identifier. We do not receive your Google password and we gain no access to Gmail, Drive, Contacts, or any other Google service.

That data is used solely to create and recognise your Vlora account. It is not sold, not shared with third parties other than the processors named in section 9, and not used for advertising or to train any model.

You can revoke Vlora's access to your Google account at any time from your Google account permissions page, and request deletion of your Vlora account through the contact in section 15.

Cookies

We use the cookies needed to run a signed-in session, plus analytics cookies on the vlora.app marketing pages. Vlora sets no advertising cookies of its own: the advertising features described below rely on Google's own cookies, which Google sets on its own domains.

vlora_access

Marks an active session. Set on the parent domain so public pages can tell that you are signed in.

vlora_refresh

Renews a session without asking you to sign in again. Restricted to the dashboard host.

vlora_preauth

Bridges the studio-selection step when your account has access to more than one studio. Restricted to the dashboard host.

vlora_docs

Opens the studio guide on docs.vlora.app to a signed-in staff member, for up to 24 hours. Restricted to the documentation host.

All four are httpOnly, so no script in the browser can read them.

On the vlora.app website — every page of it, articles included, this privacy policy and the terms of service among them — we load a Google Tag Manager container of our own, running Google Analytics with Google Signals switched on. It sets cookies named _ga and _ga_ followed by our Google Analytics property's identifier, to count visits and recognise a repeat visit from the same browser. These are not httpOnly, because Google's own script is what reads them. A studio's booking pages, at that studio's own address under vlora.app, are not part of the website.

Google Signals links those visits to the Google accounts of visitors who are signed in to Google and have ad personalisation turned on. From that, Google gives us reports on visitors' age range, gender and interests, only ever as aggregates, and lets us build remarketing audiences: groups of past visitors to whom Vlora's own ads can be shown on Google's services and its partners' sites. We never receive a name, an email address or a Google account from this; Google makes the link itself, with its own cookies. How Google uses this data is described on Google's page about sites that use its services.

Cloudflare, which carries the website's traffic and hosts it, also counts visits to the website and to the documentation at docs.vlora.app with Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser. It records the address of the page, the page you came from, your browser, and the country the visit comes from, without the query string of the address.

You can turn off ad personalisation in Google's My Ad Center, which also takes your visits out of Google Signals' reports and out of remarketing audiences. To stop Google Analytics measuring you on any website, install Google's opt-out browser add-on.

That measurement stops at the website and the documentation. The dashboard at dash.vlora.app loads no analytics script at all: Vlora's container is never included there, and Cloudflare Web Analytics is switched off for it. What you do in the dashboard is not measured by us.

Studio pages and third-party tags

Each studio may install its own Google Tag Manager container on its public booking pages. That container is managed by the studio, not by us.

We therefore cannot guarantee a fixed list of which tags are active on a given studio's pages. A studio can add analytics tools or advertising pixels at any time without telling us. What governs those tags is that studio's own privacy policy, not this one.

The vlora.app marketing pages carry one Google Tag Manager container of Vlora's own, and we decide what goes in it: Google Analytics with Google Signals and nothing else, as described in section 7. No studio's container runs there, and ours runs on no studio's booking pages. Cloudflare Web Analytics, described in the same section, is added by Cloudflare rather than through that container, and is switched off on every studio's booking pages too.

Third parties that process data

Duitku

A licensed Indonesian payment provider. Processes QRIS, virtual account, and card transactions. Your payment instrument data sits with them, not with us.

Cloudflare

Carries all traffic to vlora.app and its subdomains through its network, so it sees your IP address on every request. It also hosts the website and the documentation, stores files in R2 (studio logos, class photos, and uploaded documents), and counts visits to the website and the documentation with Cloudflare Web Analytics.

Sentry

Application error reporting, so faults can be found and fixed. Receives technical error traces, which can contain account identifiers.

Google Analytics

Visit statistics for the vlora.app marketing pages, loaded through Google Tag Manager, with Google Signals. Receives your IP address and the pages you open and, if you are signed in to Google with ad personalisation on, links them to your Google account for the aggregate reports and remarketing audiences in section 7. It is not present on the dashboard or on a studio's booking pages.

Email delivery provider

Delivers transactional email such as booking confirmations and password resets.

Some of the providers above run their infrastructure outside Indonesian territory, so part of the processing takes place across borders. We select providers that apply protection equivalent to what the UU PDP requires, and bind them with data processing terms.

Beyond this list, we disclose data only where required by law or on a valid request from law enforcement.

Storage and retention

We keep personal data for as long as it is needed for the purposes in section 5: for accounts, while the account is active; for studio client data, while the studio remains a Vlora customer and has not deleted it themselves.

Transaction records are kept longer than other data, because tax and bookkeeping regulations require it.

We do not run automatic deletion on a fixed deadline. Deletion happens on request or when an account is closed, through a process a person carries out. We say so plainly rather than publishing a retention period the system does not enforce.

Security

• Passwords are stored as hashes, never in their original form.
• All traffic runs over HTTPS.
• Each studio's data is separated at the database level, so one studio cannot read another's.
• Each studio's payment credentials are stored encrypted.
• Staff access to data is limited by per-role permissions.

No system is completely immune. In the event of a personal data protection failure, we will notify you and the competent authority as Article 46 of the UU PDP requires.

Your rights

The UU PDP gives you a number of rights over your personal data:

• Obtain information about the data we process about you and why.
• Complete or correct inaccurate data.
• Access and obtain a copy of your data.
• End the processing of, delete, or destroy your data.
• Withdraw consent you previously gave.
• Object to decision-making carried out solely by automated means.
• Claim compensation for a violation in the processing of your personal data.

For data we control ourselves, send the request to the address in section 15 and we will respond within a reasonable time. For studio client data, address the studio. The reason is set out in section 2.

Children's data

Vlora is not directed at children under 18 and we do not knowingly collect children's data. Where a studio admits underage participants, obtaining parental or guardian consent is the studio's responsibility under Article 25 of the UU PDP.

Changes to this policy

This policy may change as the service develops. The date of the last change appears at the top of the page. For changes that materially affect your rights, we notify account holders by email.

Contact us

Questions, requests about your data, or objections can be sent to:

Data Controller

PT Fintastic Digital Inovasi

Address

Denpasar, Bali, Indonesia

Email

[email protected]

If you consider our handling inadequate, you have the right to complain to the authority competent for personal data protection.