This Privacy Policy describes how PT Makin Kaya Raya Guna Indonesia ("Company", "we", "us", or "our"), as the operator of the SAVVR application ("Application" or "Service"), collects, uses, stores, and protects the personal data of users ("you" or "User"). We are committed to maintaining the confidentiality and security of your personal data in accordance with applicable laws and regulations in the Republic of Indonesia.
Last Updated: Effective Date
Data We Collect
Personal Data
When you register or sign in, we collect your email address, user ID, profile name, authentication credentials, and sign-in provider information (including email/password, Google, or Apple). This data is necessary to provide secure access and a personalized experience within the Application.
Financial Data
The Application stores financial information you voluntarily enter, including wallet names and balances, transactions, budgets, savings goals, debts, credit cards, installments, investments, fixed assets, recurring items, business organization data, and team/member records. If you use AI features, your prompts, selected financial context, receipt images, and extracted receipt text may also be processed after you provide explicit consent.
Usage Data
We may collect service diagnostics, feature usage patterns, app interactions, and error logs to maintain and improve the Service. We do not use IDFA, advertising tracking, data broker sharing, or cross-app tracking.
Data Storage
Limited Local Preferences
SAVVR Web may store limited local preferences or session-related data on your device, such as language, theme, authentication session state, and AI consent cache. SAVVR Web does not use local storage, IndexedDB, or an offline-first local database as the primary storage for your financial records.
Cloud Storage
In both Personal and Business mode on SAVVR Web, financial data is securely transmitted to our backend and stored in our cloud database with industry-standard protections. Data in transit is protected using TLS 1.3. Business data is scoped per organization.
Data Retention
Your data is retained for as long as your account is active. Upon account deletion, all associated data is permanently removed from our servers within 30 (thirty) days.
Data Protection
Encryption
All data transmitted between your device and our servers is encrypted using TLS 1.3. Stored data is encrypted at rest using AES-256 encryption.
Access Controls
We implement strict access controls and authentication mechanisms. Your data is protected by Row Level Security (RLS) in the database, meaning each user can only access their own data. No party, including SAVVR or the Margin Group team, can view or monitor your transactions or finances.
Security Measures
We regularly conduct security assessments and follow industry best practices to protect your data from unauthorized access, alteration, or destruction.
Purpose of Data Usage
Service Provision
Your data is processed solely to provide the Application's financial management features, including expense tracking, budget analysis, financial reporting, and AI-assisted financial consultation after you provide AI data processing consent.
Service Improvement
Aggregated, anonymized usage data helps us understand how users interact with the Application, enabling us to improve features and user experience.
Communication
We may use your email address to send service updates, security notifications, and feature announcements. You may opt out of non-essential communications at any time.
Your Rights
Right of Access
You have the right to access all personal data we store about you. You can export your data at any time through the Application settings.
Right to Correction
You may update or correct your personal data directly within the Application at any time.
Right to Deletion
You have the right to request complete deletion of your account and all associated data. This can be done from Settings → Delete Account, including the Business Settings entry, or by contacting us at legal@savvr.app.
Right to Data Portability
You may export your data in standard formats (XLSX) for use with other services or for personal records.
Third-Party Service Providers
Authentication & Storage (Supabase)
We use Supabase for secure authentication and cloud storage. Supabase adheres to industry-standard security practices.
Payment Processing (Midtrans, Xendit, Apple)
Subscription and credit purchases may be processed through Midtrans, Xendit, or Apple App Store/StoreKit where applicable. We share only the minimum information required for payment processing. We do not store your full payment card details.
AI Assistant (OpenRouter and AI Model Providers)
Savvy AI requires explicit permission before any AI request is sent. After consent, prompts, selected financial context (such as wallets, balances, transactions, budgets, goals, debts, investments, recurring items, and fixed assets), receipt images, and extracted receipt text may be sent through OpenRouter to the selected AI model provider solely to generate responses. SAVVR does not send passwords, PINs, authentication secrets, or full payment card details, and you can use SAVVR without AI.
File Storage (ImageKit)
File uploads, including receipt images you confirm for transaction records, are processed through ImageKit and are accessible only to authorized users within the appropriate scope.
Currency Exchange Rates
We may use third-party APIs for real-time currency exchange rates. No personal data is shared with these services.
No Sale of Personal Data
We do not sell, trade, or transfer your personal data to third parties for commercial purposes. Your financial data belongs to you.
Cookies and Local Storage
Essential Cookies and Preferences
We use essential cookies and limited local storage only to maintain your session, remember preferences, cache consent state, and ensure the Application functions properly. These browser storage mechanisms are not the primary database for your financial records in SAVVR Web.
No Advertising Tracking
The Application does not use IDFA, App Tracking Transparency tracking, third-party advertising cookies, data broker sharing, or cross-app tracking. Your browsing behavior is not tracked or shared with advertisers.
Business Mode Data Handling
Server-Only Storage
Business mode operates entirely online. All organization financial data is stored on our cloud servers and accessed via API, ensuring all team members work with current data at all times.
Organization Data Access
Within an organization, data access is controlled by role-based permissions. Owners have full access; Managers can view and manage most data; Staff and Viewers have limited access. All access is scoped per organization.
Member Data
When you join an organization, your email and role are visible to other members. If you leave or are removed, your access is revoked immediately. Your personal SAVVR account remains unaffected.
Children's Privacy
The Application is not intended for individuals under the age of 17 (seventeen) years. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at legal@savvr.app.
Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable regulations. Material changes will be notified through the Application and reflected in the "Last Updated" date. We recommend reviewing this policy periodically.
Contact Us
For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:
By using SAVVR, you consent to the collection and use of your data as described in this Privacy Policy.