Dion helps people meet in real life, so we collect what's needed to run Communities and Activities safely, show Hosts only what they need, and never sell your data. This policy explains what we collect, why, who sees it, how long we keep it and your rights under Indonesia's Personal Data Protection Law (UU 27/2022) and PP 33/2026.
1. Who is responsible#
[PT name] ("Dion") is the data controller for your account and Platform data. Hosts are separate controllers for the Member data they receive to run their Activities, and must follow UU PDP too.
Data Protection Officer: [DPO name] · [privacy email]
2. What we collect#
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Email, name, sign-in method (email or Google), date of birth | You, Google if you use Google sign-in |
| Profile | Nickname, handle, gender, region and city, phone, bio, social links (Instagram, LinkedIn and others), scenes and interests, profile photo | You; optional fields can be left empty |
| Bookings | Tickets, ticket type, price paid, promo code, order receipt, gifts sent and claimed, waitlist and approval requests | Your activity on Dion |
| Payments | Payment method used, transaction status and reference. Dion does not see or store full card numbers. | Our payment provider |
| Refund details | Bank or e-wallet account number and holder name you give for a refund | You |
| Attendance | QR check-in time and which team member scanned it | Hosts' door scanners |
| Communities and social | Communities joined, friends, friend requests, blocks, saved Activities | Your activity on Dion |
| Content | Feed posts, comments, reactions, Activity chat messages, photos uploaded to an Activity's Drive folder, feedback answers | You |
| Safety | Reports you file, reports about you, case notes and outcomes | You, other users, Dion staff |
| Host and team | Community profile, teammates' names, emails and roles, payout account, verification documents (ID) | Hosts |
| Device and usage | IP address, device and browser type, app version, pages viewed, crash logs, notification tokens | Automatically, when you use the Platform |
From our website. When you use the contact form on dion.live (to request a demo, or as a venue, brand or vendor), we collect your name, email, organisation, what you run or offer, and your choice to receive launch updates. We use it to reply to you and, only if you ticked the box, to send launch news. Ask us at [privacy email] to delete it at any time.
We do not ask for sensitive personal data such as religion, health or biometric data, except ID documents a Host submits for verification. Please don't put such data in your bio or messages.
3. Why we use it, and on what legal basis#
| Purpose | Legal basis under UU PDP |
|---|---|
| Create and run your account; sell and deliver Tickets; check-in; refunds and payouts | Performance of our agreement with you |
| Share your booking details with the Host of an Activity you book | Performance of agreement and your consent at sign-up |
| Safety: reviewing reports, enforcing the Community Guidelines, preventing fraud and off-platform payments | Legitimate interest and legal obligation |
| Recommendations in Discover, based on your scenes, interests and region | Legitimate interest; you can change your interests at any time |
| Activity reminders, Ticket updates, cancellations and refunds | Performance of agreement |
| Marketing from Dion and partners | Consent, which you can withdraw at any time |
| Tax, accounting and responding to lawful requests from authorities | Legal obligation |
| Improving the Platform with aggregated statistics | Legitimate interest |
We do not make decisions with legal or similarly significant effects about you by automated means alone. Automatic flags, such as off-platform payment wording, are always reviewed by a person before action is taken against your account.
4. Who sees your data#
Hosts of Activities you book see your name, handle, ticket type, check-in status and whether you're a member of their Community. They see your profile and social links only if your privacy setting "Hosts can see my profile & socials" is on. Each role on a Host's team sees only what that role needs, for example door staff see the guest list but not payouts.
Co-hosting Communities see the same as the Host for the shared Activity.
Other Members see what your privacy settings allow: profile, attendance, Communities and socials can each be switched off.
Dion staff see what their job needs. Contact details and account numbers are masked by default; revealing them requires a written reason and is logged. Staff never read private chats or direct messages.
Service providers process data on our instructions: payment processing (Midtrans), cloud hosting and database ([hosting provider and region]), email and push delivery ([email provider]), sign-in (Google), and error monitoring.
Brands and partners receive only aggregated statistics, such as attendance counts for a sponsored Activity, never your identity, unless you choose to claim their offer.
Authorities receive data only when Indonesian law requires it, under a valid request.
We never sell your personal data.
5. Transfers outside Indonesia#
Some providers store data outside Indonesia. When that happens we make sure the receiving country or the provider's contract gives protection equal to or higher than UU PDP, as PP 33/2026 requires. [List the countries once providers are confirmed.]
6. How long we keep it#
| Data | Kept for |
|---|---|
| Account and profile | Until you delete your account, then removed within 30 days |
| Activity group chats | Locked 7 days after the Activity ends; deleted 30 days after it ends |
| Tickets, orders, refunds, payouts, invoices | 10 years, as required for company and tax records |
| Safety reports and case records | [3] years after the case closes, longer if needed for a legal claim |
| Host verification documents | Deleted [30] days after the verification decision; the decision itself is kept |
| Device and usage logs | [12] months |
| Marketing preferences and consent records | As long as the account exists, plus [2] years as proof of consent |
7. Your rights#
Under UU PDP you can:
- get information about how your data is processed;
- access and get a copy of your data;
- correct inaccurate data (most of it directly in Profile);
- delete your data or account (Profile → Delete account);
- withdraw consent, for example to marketing (Profile → Notifications);
- object to or restrict processing;
- object to decisions made only by automated processing;
- move your data to another service in a common format;
- claim compensation for a breach of your data rights.
Email [privacy email] from your account email. We respond within the period UU PDP sets, generally 3 × 24 hours. If we can't fulfil a request, for example because tax law requires us to keep a record, we'll tell you why.
8. Security and breaches#
We use encryption in transit, access controls by role, row-level security on stored records, signed links for private media, audit logs for staff access, and the two-person rule for sensitive staff actions. If a breach affects your data, we will notify you and the authority within 3 × 24 hours of becoming aware of it, as UU PDP requires, with what happened and what to do.
9. Age#
Dion is for people 18 and older. We don't knowingly collect data from anyone younger. If we learn that an account belongs to someone under 18, we close it and delete its data. If you think a minor is using Dion, tell us at [safety email].
10. Safety on Dion#
Before an Activity
- Activity pages show who is hosting, the price and fees, capacity and the Host's requirements before you pay.
- A Host can keep the exact venue hidden until you hold a Ticket.
- Private Communities hide their Activities from people who aren't members.
- A Verified badge means Dion staff have checked the Host's identity.
- Dion never asks you to pay outside the app. If a Host does, report it.
At the Activity
- Your QR Ticket is personal; gifted Tickets get a new QR and the old one stops working.
- Hosts are responsible for running their Activity safely. Follow their and the venue's instructions.
- In an emergency, call 112 (or 110 police, 118/119 ambulance) first.
Tools you control
- Block a person or Community: you won't see them in your feed or chats, and they can't send you friend requests.
- Report a person, Community or Activity from its page or from Support. You can follow your report's status in Support → History. The person you report is not told who reported them.
- Privacy switches for profile, attendance, Communities and socials.
- Refunds without asking the Host until 24 hours before the Activity starts.
What happens after a report
- You get a case number.
- Dion's safety team reviews it, usually within [48 hours], faster for urgent risks.
- The Host sees only that a report is open, never who filed it or its details.
- Possible outcomes: no action, a warning, content removed, an Activity paused, a Community suspended or an account closed. Both sides are told the outcome where safe, and can appeal within 14 days.
For anything urgent that isn't an emergency, email [safety email].
11. Cookies and similar technology#
The website and app use local storage and cookies to keep you signed in, remember settings such as theme, and measure use. We don't use third-party advertising cookies. [Update this if analytics or ad tools are added.]
12. Changes#
We'll notify you in the app or by email before material changes take effect. Previous versions are listed on the Legal page.
13. Contact#
[PT name] · [registered address] · Privacy: [privacy email] · Safety: [safety email]