Privacy Policy

Last updated: October 9, 2026

1. Who is responsible

The controller is Ask Dalam.

We apply the EU General Data Protection Regulation (GDPR). We also follow Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).

2. What data we collect and where it comes from

What you type in chat. Your messages to Dalam, your search criteria (area, budget, bedrooms), your preferences and saved listings.
Sign-in. If you sign in with Telegram or WhatsApp, we receive your Telegram user ID, username and name, or your WhatsApp phone number and profile name.
Contact details you give us. A phone number or messaging handle, if you ask us to connect you with an agent or owner.
Email sign-ups. If you sign up on a tool page or the Rent Index for the monthly Rent Index and price alerts: your email address, language, and the area and budget you checked. We use the area and budget only to build those emails, and nothing else. We do this with your consent, which you can withdraw at any time by unsubscribing; every email has a one-click unsubscribe. We keep your sign-up until you unsubscribe or ask us to delete it. After you unsubscribe we keep only your address on a suppression list, so we don't email you again.
Device and usage data. Browser type, language, pages viewed and referral source (UTM parameters).
Share links. When someone opens a Dalam Partner share link, we count one open per visitor per day using a short-lived code made from the IP address and browser that can't be turned back into either. It sets no cookie and is deleted after 48 hours. We do this to stop abuse of share rewards (our legitimate interest in preventing fraud).
Payments. If you buy a Dalam Partner plan, our payment provider handles the payment. It acts as merchant of record; its name is shown at checkout. We receive your name, email, country, plan and payment status. We never see your card number.
Partner agency data. If you are an agency or agent: your business and contact details, your team members, your listings, and the leads and messages you handle in the Partner dashboard.
Listings and posts from other places. We collect listings and posts from villa and agency websites, property platforms, Facebook groups and Facebook Marketplace posts we can read without logging in, Telegram groups, and WhatsApp groups we read as a member. These can include names, phone numbers and what a person wrote. See section 4.

We do not ask for government IDs, card numbers, precise GPS location, or your Telegram contacts.

3. Why we use your data, and the legal basis

Run the search service and your account (chat answers, saved listings, alerts). Basis: contract, Art. 6(1)(b) GDPR.
Connect you with an agent or owner. We share your contact only when you ask us to. Basis: your consent, Art. 6(1)(a).
Take payments and keep invoices. Basis: contract and legal obligation, Art. 6(1)(b) and (c).
Keep the service safe and fix problems (abuse and bot protection, logs). Basis: legitimate interests, Art. 6(1)(f).
Improve the product. Basis: legitimate interests, Art. 6(1)(f).
Optional analytics. Basis: your consent, Art. 6(1)(a). See section 9.
Collect public listings and posts. Basis: legitimate interests, Art. 6(1)(f). See section 4.
Send you messages. We send marketing messages only with your consent. Service messages (sign-in, receipts, replies to you) need no consent.

We do not sell your data and we do not use it for third-party advertising.

4. If your post or listing was collected

Ask Dalam collects posts and listings so that people looking for a home can find them in one place, and so that agencies using Dalam Partner can see requests that fit their villas. If you posted in a group or on a property site, your post may appear on Ask Dalam or in Dalam Partner.

What we collect: the text of the post, photos, price, location, and the contact details you published (such as a name or phone number).
Why: to show the listing in search and to let interested people reach the person who posted it. Basis: legitimate interests, Art. 6(1)(f) GDPR.
Source: villa and agency websites, property platforms, Facebook groups and Facebook Marketplace posts we can read without logging in, Telegram groups, and WhatsApp groups we read as a member. We did not get your data from you directly.
How long: we keep personal details from collected posts for as long as we need them for the search service.
We do not sell contact details. We do not hand your phone number to third parties in bulk. Contact details are shown to signed-in users who want to reach you about that listing.
Object or get it removed: write to support@askdalam.com and tell us which post or number. You can ask us to delete or stop using your details at any time, and we act on requests within 30 days. You have the right to object under Art. 21 GDPR.

5. Who receives your data

These providers process data for us:

AI model providers, through the Vercel AI Gateway: they write chat answers, read and sort listings and posts, and draft messages. Requests that may contain personal data, such as what you type in the chat or a name or phone number in a post, are processed by AI model providers and the companies that host them, located in the USA, China and other countries outside the EU. You can ask us for the full list of providers at support@askdalam.com.
Supabase: database and file storage.
Railway: backend hosting.
Vercel: website hosting, the AI Gateway, and (with your consent) analytics.
Meta (WhatsApp Business): sending and receiving WhatsApp messages.
Telegram: sign-in and Telegram messages.
Our payment provider for Dalam Partner plans (its name is shown at checkout): payments. It is the merchant of record and acts as an independent controller for payment data.
Resend: sending email.

We also share data in these cases:

Agents and owners you ask us to contact. We share your contact and search criteria only after your action or consent. They use it as their own controllers.
Authorities, if the law or a valid court order requires it.

6. Transfers outside the EU

Some providers are in the USA or process data there (Vercel, Railway, Meta, the payment provider, Resend and AI model providers). Some AI model providers are in China or other countries outside the EU and process data there. Telegram and Supabase may process data in other countries. Not all of these countries have data protection the EU considers equivalent, and China does not. Where a provider offers them, we rely on the EU Standard Contractual Clauses (SCCs) or on the EU-US Data Privacy Framework where the provider is certified; for some AI providers no such safeguard is in place yet. We have not confirmed that every AI provider deletes requests straight away or never uses them to improve its models, so don't send us anything you would not want them to see. Agents in Indonesia and other countries without an EU adequacy decision receive your data only when you ask us to connect you (Art. 49(1)(a) and (b) GDPR). You can ask us for the full list of providers and a copy of the safeguards that are in place at support@askdalam.com.

7. How long we keep data

Conversation history: kept to give context in ongoing searches, and deleted with your account.
Search preferences and saved listings: until you delete them.
Account data: until you ask us to delete it.
Invoices and payment records: as long as tax law requires.
Collected posts and listings: we keep personal details from collected posts for as long as we need them for the search service. You can ask us to delete or stop using yours at any time at support@askdalam.com; we act on requests within 30 days.
Server logs: kept by our hosting providers for a limited period.

8. Your rights

You have the right to:

get access to your data and a copy of it
have wrong data corrected
have your data deleted
restrict how we use your data
receive your data in a portable format
object to processing based on legitimate interests, at any time
withdraw a consent at any time, without effect on the past
complain to a supervisory authority. For us this is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), or the authority in your country.

Write to support@askdalam.com. In the Telegram or WhatsApp bot you can also send /profile to see your data and /forget to delete it. Deletion is immediate and cannot be undone.

9. Cookies and browser storage

We use one essential cookie (dalam_uid) to recognize you when you come back. It lasts one year. We also use localStorage to keep your chat session and messages on your device.

We use Vercel Web Analytics to see which pages are used. A cookie banner lets you refuse analytics and other non-essential tools. Refusing is as easy as accepting. Essential cookies stay on because the service needs them.

10. AI use

Dalam is an AI assistant. When you chat with it on the website, Telegram or WhatsApp, an AI model writes the answers. It can make mistakes, so check important facts such as prices and availability. Your messages are sent to AI model providers through the Vercel AI Gateway to produce the answer (see section 5). We do not use the AI to take decisions about you that have legal effects. We use AI to read and sort public listings and posts.

11. Security

Encrypted connections (HTTPS/TLS) for data in transit
Row-level security in our database
Signature checks for Telegram sign-in
Protections against prompt injection in our AI processing

If a breach puts your rights at risk, we tell you and the competent authority as the law requires (GDPR: 72 hours to the authority; UU PDP: 3x24 hours).

12. Changes

We may update this policy as the service changes. The date at the top shows the latest revision. For big changes we tell you in the bot or on the site.

13. Contact

For privacy questions or to use your rights: support@askdalam.com