Privacy Policy

1. Who we are

SunDown ("SunDown," "we," "us," or "our") operates the sundown.id website and the SunDown mobile app (together, the "Service"), a platform that helps guests discover, book and enjoy beach clubs, bars, restaurants and other nightlife venues ("Venue Partners") in Bali, Indonesia. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the choices and rights you have.

SunDown is based in Bali, Indonesia. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information we collect

Information you give us directly

• Account details: name, email address, phone/WhatsApp number, and password (stored securely, never in plain text).
• Booking details: venue, date, time, party size, table/seating preference, special requests, and any notes you add.
• Communications: messages you send us or a venue through the app, WhatsApp, email, or our AI concierge ("Sandy"), including voice input when you use voice features.
• Payment-related information: we do not store full card numbers ourselves — payments are processed by a licensed third-party payment gateway (see "Who we share it with" below). We retain a record of transaction status, amount and method for your booking history and receipts.

Information collected automatically

• Usage data: pages viewed, venues browsed, features used, and time/date of activity.
• Device data: device type, operating system, browser, and general (non-precise) location inferred from IP address, used to show relevant venues in your area.
• Precise location: only if you explicitly grant location permission (e.g. to find nearby venues) — you can revoke this at any time in your device settings.
• Cookies and similar technologies: see our Cookie Policy for full detail.

3. How we use your information

We use the information we collect to:

• Create and manage your account and process your bookings;
• Communicate with you about bookings, confirmations, changes, and support requests;
• Share necessary booking details (name, party size, time, special requests) with the specific Venue Partner you're booking with, so they can prepare for your visit;
• Power AI features such as venue recommendations and the Sandy voice/chat concierge;
• Improve and personalise the Service, including which venues and offers we show you;
• Detect, prevent, and address fraud, no-shows, abuse, and security issues;
• Send you marketing communications about SunDown, new venues, or promotions — only where you've opted in, and always with an easy way to opt out;
• Comply with legal obligations, including under Indonesia's Personal Data Protection Law (UU PDP).

4. Our legal basis for processing

We process your personal data on the following bases: performance of a contract (fulfilling your booking), your consent (e.g. marketing communications, precise location, voice features), our legitimate interests (fraud prevention, service improvement), and compliance with legal obligations. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Who we share it with

We do not sell your personal data. We share information only as needed to operate the Service:

• Venue Partners: the specific venue you book with receives your name, party size, date/time, and any notes relevant to your reservation.
• Payment processors: licensed Indonesian payment gateway providers process your payment directly; we receive confirmation of payment status, not your full card/account details.
• Infrastructure and service providers: we use third-party providers for backend data storage and processing (including providers that may host data outside Indonesia — see "International data transfers" below), messaging (e.g. WhatsApp Business, for booking confirmations you request), and AI processing (see "AI features" below). These providers are contractually bound to only use your data to provide services to us.
• Legal and safety reasons: where required by law, regulation, legal process, or governmental request, or to protect the rights, property or safety of SunDown, our users, or the public.
• Business transfers: if SunDown is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to the same protections described here.

6. AI features (Sandy)

SunDown's AI concierge, Sandy, can answer questions, recommend venues, and — where you choose to use voice booking — listen to and act on your spoken requests. When you use voice or chat features:

• Your spoken audio may be sent to a third-party AI transcription provider to convert it to text, and text you write or speak may be sent to a third-party AI provider (such as Anthropic's Claude) to generate a response. These providers process the data solely to return a response to Sandy and do not use it to train their models on our behalf without a separate agreement prohibiting that.
• We do not use voice recordings for any purpose beyond generating that response, and audio is not retained by SunDown after transcription.
• You can always use the Service without voice features by typing instead.

7. International data transfers

Some of our infrastructure and service providers are located outside Indonesia. When your data is transferred internationally, we take steps to ensure it continues to be protected in line with this Privacy Policy and applicable law, including Indonesia's Personal Data Protection Law (UU PDP No. 27 of 2022), through contractual safeguards with our providers.

8. How long we keep data

We keep your personal data for as long as your account is active, or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it (for example, financial records for tax purposes).

9. Security

We use industry-standard technical and organisational measures — including encryption in transit, access controls, and row-level security on our databases — to protect your personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to continually improve our safeguards.

10. Your rights

Subject to applicable law (including Indonesia's UU PDP), you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your personal data;
• Withdraw consent at any time, where processing is based on consent;
• Object to or request restriction of certain processing;
• Request a copy of your data in a portable format.

To exercise any of these rights, contact us using the details in "Contact us" below. We will respond within a reasonable timeframe and in accordance with applicable law.

11. Cookies

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the Service is used. Full detail on what we use and how to control it is in our Cookie Policy.

12. Children's privacy

SunDown facilitates bookings at venues that serve alcohol and operate late-night hours. The Service is not directed at, and we do not knowingly collect personal data from, anyone under 18. If we learn we've collected data from someone under 18, we will delete it promptly. If you believe a minor has provided us data, contact us using the details below.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational or regulatory reasons. We'll update the "Last updated" date above, and for material changes, we'll provide a more prominent notice (such as an in-app or email notification).

14. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

• Email: partnerships@sundown.id
• WhatsApp: +62 851 7756 2553
• Bali, Indonesia