Privacy Policy

Thank you for using our services. The service is owned and operated by PipeIDR or PT Cipta Teknologi Negeri.

At PipeIDR ("we", "us", "our"), your privacy and the security of your personal information are paramount. This Privacy Policy explains how we collect, use, disclose, and safeguard your Personal Information when you use our payment and digital wallet platform ("Platform").

"Personal Information" refers to any information that can identify you directly or indirectly — such as your name, email address, username, home address, phone number, date of birth, gender, nationality, employment information, government identifiers, online identifier, or other personal information permitted by law or with your consent.

By accessing or using our Platform, you agree to the terms of this Privacy Policy, including providing your consent for us to collect, store, and process your personal information in accordance with the provisions of this Privacy Policy.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by updating this page or by providing notice in our App. The revised version will take effect on the effective date of publication. You are responsible for reviewing this Privacy Policy as often as possible. Your continued use of our Platform after the changes to this Privacy Policy means that you understand and agree to such changes.

Important Disclaimers

• PIPE is a tech company, not a bank and not a crypto exchange.
• Digital assets are stored and managed by a local custodian in Indonesia registered and supervised by OJK, member of CFX and KKI (the official crypto ecosystem).
• Payment services are provided by an Indonesian bank partner licensed and registered by Bank Indonesia, member of LPS (Indonesia Deposit Insurance Corporation).
• PIPE does not process end-to-end stablecoin payments — merchants always receive their own local fiat currency, not stablecoin.
• PIPE can be downloaded and used only by Indonesians, in countries that accept QRIS except Indonesia.

Information We Collect

We collect various types of personal and technical information to provide and improve our services, comply with legal obligations, and ensure the security of our users and platform. This may include:

Personal Information

When you register or interact with our Platform, we may collect information that can identify you directly or indirectly, including but not limited to:

• Full name, email address, phone number, and date of birth
• Government-issued identification documents (e.g., national ID / KTP, passport, or driver's license)
• Residential address and proof of address
• Facial recognition data or biometric identifiers (where applicable and with your consent)
• Employment information

Financial and Transactional Information

To facilitate payments, manage wallets, and comply with regulatory obligations, we may collect:

• Source of funds
• Bank account details
• Wallet addresses and recipient name
• Transaction amounts, history, and your fund balances
• Records of fiat deposits and withdrawals

Technical and Usage Data

To enhance security and improve user experience, we may collect information about how you use our Platform, such as the pages and features you access and the time and date of your use, along with device identifiers and IP address.

How We Use Your Information

We process your personal information for the following purposes, in accordance with applicable laws and based on legitimate business interests, contractual necessity, legal obligations, or with your consent:

• To deliver, maintain, and enhance our Platform and services, including processing transactions, managing user accounts, and ensuring the smooth operation of our offerings
• To verify your identity and assess risk. This includes the validation of your personal information and, where required, screening for Politically Exposed Persons (PEPs) and sanctions compliance
• To respond to your requests and facilitate user support, including handling inquiries, troubleshooting issues, and improving your overall experience
• To ensure the safety, integrity, and security of our Platform. This includes fraud prevention, risk monitoring, system protection, and enforcing our terms and policies
• To fulfil legal, regulatory, and compliance obligations, including Anti-Money Laundering (AML), Know Your Customer (KYC), and other applicable financial or operational laws
• To support business operations and decision-making, such as conducting audits, maintaining accurate records, performing data analytics, and supporting research and development
• To communicate with you, including sending service-related updates, administrative notices, or promotional content in line with your communication preferences
• As otherwise disclosed to you, either in this Privacy Policy or at the point of data collection, where additional purposes may be clearly communicated

Data Retention

We retain personal information only as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required by law (e.g., financial record-keeping regulations under OJK/BI requirements or Indonesian AML obligations). Upon a valid deletion request, we will process the removal of your data within 30 (thirty) calendar days, subject to any applicable legal retention requirements.

How We Share Your Information

We take your privacy seriously and only share your Personal Information when necessary to deliver our services, comply with legal obligations, or with your explicit consent. We may share your data with the following parties, under strict conditions and safeguards:

Third-party service providers

We engage carefully selected third-party vendors to perform services on our behalf, including:

• Payment processors for handling transactions and fiat transfers
• KYC and AML/CFT service providers for identity verification and compliance screening
• Data analytics and cloud service providers for performance monitoring, user behaviour analysis, and infrastructure hosting
• Security service providers for fraud detection, incident response, and platform integrity

These service providers are granted access only to the information necessary for them to perform their duties and are contractually bound to process personal data in accordance with applicable data protection laws and our privacy standards.

Independent Third-Party Data Controllers

Certain third parties may act as independent data controllers when processing your personal data for their own legitimate purposes, which may include:

• Compliance with regulatory obligations
• Fraud prevention, anti-money laundering profiling, and security analysis using AI or statistical models
• Legal claims, dispute resolution, or exercising legal rights

These parties are responsible for their own data handling and must comply with their respective privacy obligations.

As required by law or to comply with legal and regulatory disclosures

We may disclose your personal information to regulatory authorities (OJK, Bank Indonesia), law enforcement agencies, or courts if:

• Required to do so by law, regulation, or legal process
• Necessary to investigate or prevent illegal activity, fraud, or threats to the security of our Platform
• Needed to protect our legal rights or defend against claims

We may also share your information with your consent or at your direction.

Security

We take reasonable measures to protect your information from unauthorized access or disclosure by implementing industry-standard security measures. While no method is 100% secure, we take all reasonable steps to protect your data.

Children's Privacy

We do not allow anyone under the age of 18 to use our services and Platform. We do not knowingly request or collect any information about persons under the age of 18. If you are under the age of 18, please do not provide any Personal Information to our services or Platform.

Your Right to Data Removal

Subject to applicable data protection laws, you have the right to request the deletion of your Personal Information in certain circumstances.

You may request that we delete your personal data where:

• The data is no longer necessary for the purposes for which it was collected or otherwise processed
• You withdraw your consent (where processing was based on consent) and there is no other legal ground for the processing
• You object to the processing and there are no overriding legitimate grounds for us to continue processing the data
• Your Personal Information has been unlawfully processed
• The data must be erased to comply with a legal obligation under applicable law

Limitations to the Right of Erasure

Please note that this right is not absolute. We may retain certain personal data where required or permitted by law, including:

• To comply with legal obligations (e.g., AML, financial reporting, or regulatory reporting requirements)
• For the establishment, exercise, or defence of legal claims
• For the performance of a contract or in connection with our legitimate interests, where applicable and permitted by law

If you wish to request the deletion of your Personal Information or data, please send an email to: support@pipeidr.com. In your email, please provide your wallet's public address or registered account email so we can identify your account.

Upon receiving your request, we will initiate the process of data deletion and confirm once it is completed within 30 (thirty) calendar days. Please note that this process may take some time as we ensure the thorough and secure removal of your data.

Your trust in us is paramount, and we are committed to upholding your rights to privacy and data protection.

Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us at: