Privacy Policy

Last updated: April 16, 2026

1. Data Controller

Dalam is operated by Koza Lab, an Indonesian entity based in Bali, Indonesia. Koza Lab is the data controller responsible for your personal data under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).

Contact: kaan@koza-lab.co

2. Data We Collect

We collect only what is needed to provide the property search service:

  • Account identifiers— Telegram user ID, username, or phone number (depending on how you log in)
  • Search history— your property search queries, preferences (area, budget, bedrooms), and saved listings
  • Conversation data— messages exchanged with Dalam to provide personalized recommendations
  • Device information— browser type, screen resolution, and language (used for session management, not tracking)
  • UTM parameters— referral source if you arrived via a shared link (used to measure which channels are effective)

We do not collect: government IDs, financial information, precise GPS location, or data from your Telegram contacts.

3. How We Use Your Data

Your data is used for:

  • Property search— answering your queries with relevant listings from our database
  • Personalization— remembering your preferences, saved listings, and search alerts
  • Service improvement— understanding common search patterns to improve our recommendations
  • Lead referral— connecting you with property agents or service providers, only with your explicit consent

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties without your explicit consent.

4. Data Sharing

We share your data only in these cases:

  • With your consent— when you ask Dalam to connect you with a property agent or service provider, we share relevant search context (area, budget, property type) so the agent can help you effectively. You will always be asked before any handoff.
  • Service providers— we use Supabase (database hosting), OpenAI (AI processing), and Telegram/WhatsApp (messaging). These providers process data on our behalf under their own privacy policies.
  • Legal requirements— if required by Indonesian law or a valid court order.

5. Data Retention

We retain your data for as long as your account is active. Specifically:

  • Conversation history— retained to provide context in ongoing searches. Summarized after 6 message pairs.
  • Search preferences and saved listings— retained until you delete them.
  • Account data— retained until you request deletion or after 2 years of inactivity.

6. Your Rights

Under UU PDP (Article 20), you have the right to:

  • Access your data — send /profile to Dalam to see what we know about you
  • Delete your data — send /forget to Dalam to permanently delete all your data. This is immediate and irreversible.
  • Withdraw consent— you can stop using the service at any time. Existing data will be deleted upon request.
  • Correct your data — send /profile and update any incorrect preferences
  • Object to processing — contact us at kaan@koza-lab.co

7. Data Security and Breach Notification

We protect your data using:

  • Encrypted connections (HTTPS/TLS) for all data in transit
  • Row-level security in our database (Supabase)
  • HMAC signature verification for Telegram authentication
  • Prompt injection defenses in our AI processing

In the event of a data breach affecting your personal data, we will notify you within 3x24 hours and report to the relevant Indonesian regulator, as required by UU PDP.

8. Cookies and Browser Storage

We use a single cookie (dalam_uid) to recognize returning users. This cookie contains your user ID and has a 1-year expiry. No cookie consent banner is required under Indonesian law (UU PDP does not mandate cookie consent banners for functional cookies).

We also use localStorage to store your chat session ID and message history for convenience.

9. Changes to This Policy

We may update this policy as our service evolves. Significant changes will be communicated through the Dalam bot. The “last updated” date at the top reflects the most recent revision.

10. Contact

For privacy-related questions or to exercise your rights:

  • Email: kaan@koza-lab.co
  • Bot: send /profile or /forget to Dalam
  • Entity: Koza Lab, Bali, Indonesia