Mr Nearby Privacy Policy

Last updated: September 9, 2026

This document is part of the Mr Nearby Terms of Service and will be updated as the Service grows.

1. Introduction

Mr Nearby (“we”) respects the privacy of every User. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over that data, in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (“PDP Law”).

Data Controller: Mr Nearby, located in Denpasar Barat, Bali. Contact for personal data matters: hello@mrnearby.com.

2. Data We Collect

Account data: name, email address, phone number, password (encrypted).
Business profile data: business name, category, address, business phone number, operating hours, and other information you enter into the Service.
Google Business Profile data: access token and refresh token provided by Google when you connect your Business Profile, used to read and update your business profile data on your own behalf.
Customer review data: review text, ratings, and replies processed through the Review Management feature.
Transaction data: payment history, subscription status, and chosen payment method (full card data is NOT stored by Mr Nearby — it is processed directly by the payment gateway partner).
Usage data: in-app activity logs, including requests sent to the AI Agent feature, for audit and service-improvement purposes.
Technical data: IP address, device type, and browser used to access the Service.

3. Purposes of Data Use

Providing and operating the Service, including managing your Business Profile on Google Business Profile at your instruction.
Processing payments and managing subscription status.
Generating AI Content (post drafts, review replies) using your review data and business information.
Sending Service-related notifications (new reviews, payment status, feature updates) via email.
Improving the quality of the Service based on usage patterns (data is used in aggregate/anonymized form where possible).
Fulfilling legal obligations, including tax reporting and official requests from authorized authorities.

4. Sharing Data with Third Parties

We share your data with the following third parties, to the extent necessary to operate the Service:

Third Party	Data Shared	Purpose	Server Location
Google LLC	Business Profile access token, data read/written to GBP	Managing your Business Profile on Google	United States / global
Supabase Inc.	All account, business, and transaction data (primary database)	Data storage & authentication	Seoul, South Korea
Anthropic (Claude API)	Review text and business context needed to generate AI drafts	Generating AI Content (posts/replies)	United States
Xendit / Midtrans / DOKU	Name, contact details, and payment transaction details	Processing subscription payments	Indonesia
Resend	Your email address and notification content (invoices, updates)	Sending automated notification emails and invoices	United States

We do NOT sell your personal data to any third party for marketing purposes.

4.1 Cross-Border Data Transfer

Some of your data is stored and processed on servers located outside Indonesia (see table above). We ensure our third-party partners implement adequate data security standards. By using the Service, you consent to this cross-border data transfer as regulated under Article 56 of the PDP Law.

(Internal note: this cross-border transfer consent clause needs to be confirmed with a lawyer — whether implicit consent through use of the service is sufficient, or whether a separate explicit consent mechanism is required.)

5. Your Rights as a Data Subject

Under the PDP Law, you have the right to:

Access and obtain a copy of the personal data we hold about you.
Correct your personal data that is inaccurate or incomplete.
Request deletion of your personal data, with the understanding that deletion may affect your ability to use the Service.
Withdraw consent for certain data processing, including disconnecting Google Business Profile at any time via the dashboard.
Object to data processing for certain purposes.
File a complaint with the relevant personal data protection authority if your rights are not fulfilled.

Requests related to the rights above can be submitted via hello@mrnearby.com, and will be responded to within 30 (thirty) days in accordance with applicable regulations.

6. Data Retention

We store your personal data for as long as your account is active and as needed to provide the Service. After an account is closed/subscription ends, data will be retained for a maximum of 90 (ninety) days for account-recovery purposes, unless a longer period is required by tax or other applicable law, after which the data will be permanently deleted or anonymized.

7. Data Security

Data is stored using Row Level Security (RLS), so each User can only access their own data.
Google Business Profile access tokens and API keys are stored in encrypted form, never stored as plaintext.
Payment card data is processed directly by our PCI DSS-certified payment gateway partner; Mr Nearby does not store full card data.
While we implement reasonable security measures, no electronic system is completely free of risk. We will notify you in accordance with applicable legal obligations in the event of a data breach incident affecting your personal data.

8. Children's Data

The Mr Nearby Service is intended for business operators aged 18 years and above. We do not knowingly collect personal data from minors.

9. Cookies & Tracking Technology

The Mr Nearby website and application may use cookies to maintain login sessions and improve user experience. [TO FILL: complete the actual cookie details once the production frontend is finalized, e.g. Supabase Auth session cookies, analytics, etc.].

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and/or dashboard notification before taking effect.

11. Contact

Questions or requests related to your personal data can be submitted via hello@mrnearby.com.