Privacy notice

GoCheck connects people who want to rent a property they can't visit (renters) with verified local people who visit it for them and report back (checkers). GoCheck decides how the personal data described here is used, so under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) we are its controller.

For anything about your personal data, email us at hellogocheck@gmail.com.

Only what we need to run GoCheck:

• Your account: the WhatsApp number you log in with, or, if you log in with Google or Facebook, the ID of your account there and the email address it shares (Facebook may share none); your name; and whether you use GoCheck as a renter or a checker.
• Your requests (renters): the property's address and listing link, the area, your budget and requirements, notes, the questions you want answered, the dates that suit you and the report's language.
• Your checker application: your full name; your ID type and number (KTP, passport or driver's license) and a photo of the ID; your phone number and email; your areas, languages and experience; and your bank or e-wallet with the account holder's name and the account number.
• Your checker profile and work: your photo, what you write about yourself, your rates and availability, the jobs you accept, and your reports, including the photos, videos and notes you take at a property.
• Messages you exchange on GoCheck with the other side of a job, and any problem you report with a report or shortlist.
• Messages you send us through the contact form: your name, email address, topic and message.
• Technical data: your IP address and the time of each login code request and contact message, to stop abuse; and the cookies described below.

We don't collect health, biometric or other specific personal data, and we don't buy data about you from anyone else.

• To log you in, with a one-time code by WhatsApp or with your Google or Facebook account, and keep your account secure, which is needed to provide the service you signed up for.
• To pass your request to checkers in the area, let the checker who accepts it do the visit and deliver your report: also needed to provide the service.
• To verify a checker's identity before approving them, and to pay them: needed for our agreement with them and done with their consent, which they give when they apply.
• To answer your messages, and to stop fraud, spam and misuse of GoCheck (for example by limiting how many login codes can be sent): our legitimate interest in running a safe service.
• To meet our legal obligations, such as keeping payment and tax records and answering lawful requests from authorities.

We don't sell your personal data, and we don't use it for advertising.

• Checkers: open requests show checkers in that area only the area, dates, package and report language. The address, listing link, notes and questions are shown only to the checker who accepts the job.
• Renters: see a checker's public profile (name, photo, areas, languages, about text, experience, rates, availability and reviews). Renters never see a checker's ID or payout details.
• Service providers that run parts of GoCheck for us and may use the data only on our instructions: Meta sends login codes by WhatsApp, Resend sends you emails about your jobs and passes contact form messages to us, and our hosting and database providers, Cloudflare and Supabase, run the site and store its data. When you log in with Google or Facebook, that company learns you use GoCheck and shares your name, email address and account ID with us, under its own privacy policy.
• Authorities, when Indonesian law requires us to share data with them.

Some of our service providers process data outside Indonesia: our database is kept in Singapore (Supabase), and Cloudflare, Meta, Google and Resend may process data in other countries, for example the United States. We only use providers that protect personal data to the standard the Personal Data Protection Law requires, under agreements that bind them to it.

The site is served over an encrypted connection, the login cookie is encrypted, and ID numbers, ID photos and payout account numbers are stored encrypted with a separate key. Location and camera details are removed from profile photos before they're shown to anyone. Only the people who need personal data to run GoCheck can see it.

If personal data is ever exposed in a breach, we'll tell the people affected and the authorities within 3 × 24 hours, as the law requires, with what happened and what we're doing about it.

Your account data for as long as your account is open. Requests, reports and payment records for as long as they may be needed for disputes, payouts and the record-keeping the law requires. Login code and contact form records only for as long as they help prevent abuse or answer you. After that we delete the data or remove what identifies you.

Under the Personal Data Protection Law you can:

• ask what personal data we hold about you, why, and who it's shared with, and get a copy of it;
• have wrong or incomplete data corrected;
• have your data deleted, or its processing stopped, when we no longer need it or you withdraw your consent;
• withdraw consent you gave, such as for checker identity verification (we then can't keep you approved as a checker);
• object to decisions made about you only by automated processing (GoCheck doesn't make any);
• ask us to restrict or pause processing, and get your data in a format other services can read;
• complain about how your data is handled, and claim compensation if it was handled unlawfully.

To use any of these rights, email hellogocheck@gmail.com from the email address or with the phone number on your account. We'll answer within the time the law sets.

GoCheck uses only the cookies it needs to work, and no advertising or tracking cookies:

• gocheck-session keeps you logged in;
• gocheck-challenge remembers a login code that is on its way to you;
• gocheck-oauth remembers, for up to 10 minutes, a login with Google or Facebook that you have started;
• gocheck-locale remembers your language.

Your browser also keeps, on your device only, a draft of a checker application while you fill it in (never your ID or account numbers), until you close the tab, and requests made on this device before you logged in, until they're moved into your account.

GoCheck is for people aged 18 and over. We don't knowingly collect personal data from children.

When we change this notice we'll update the date at the top. If a change affects how we use the data you've already given us, we'll tell you before it applies.

Questions or requests about your personal data: hellogocheck@gmail.com.