Privacy Policy

Who is responsible for your data

BisaSpeak operates in Indonesia and is the data controller for everything described on this page.

For anything about your personal data, contact halo@bisaspeak.com or the official BisaSpeak WhatsApp number shown on this site.

What we collect

When you sign up or buy the course: your name and WhatsApp number. Once your payment is confirmed you complete your account with an email address and a password. Passwords are stored as a hash, never in their original form.

When you pay: the transfer receipt or screenshot you send, the amount, date and payment method. We do not store card numbers or e-wallet PINs.

When you study: class attendance, study guide progress, quiz and game scores, the homework you hand in including voice or video recordings, teacher feedback, badges and certificates.

When you communicate with us: the content of WhatsApp messages and emails between you and BisaSpeak.

When you visit the site: technical data such as IP address, device and browser type, and pages opened. Only if you accept the cookie notice do we also collect visit statistics through Google Analytics. Details are in the Cookie Policy.

When you join the waitlist: the name, email address and WhatsApp number you enter.

Legal bases and purposes

Performing our agreement with you: running the classes and the learning portal, marking homework, issuing badges and certificates, processing payments, and supporting you about your course.

Your consent: visit statistics, promotional messages, and the use of your testimonial, photo or screenshots for promotion. You can withdraw consent at any time without affecting your course.

Legal obligations: keeping payment records for bookkeeping and tax.

Legitimate interests: account security, preventing misuse, and improving the service, in ways that do not override your rights.

Students under 18

Students under 18 may only register with the consent of a parent or guardian. The consent box on the signup form states that the person registering is 18 or older, or that a parent or guardian has given consent. The parent or guardian is responsible for the account.

A parent or guardian can request access to, correction of, or deletion of their child's data through the contacts above. If we learn that an account was created without the required consent, we will contact the registrant and may close the account.

Who processes your data

BisaSpeak teachers and staff see the data needed to teach and manage your class, according to their role.

Service providers processing data on our behalf: Vercel (site hosting), Prisma Postgres (database), Resend (email delivery), Zoom (live classes and class recordings), Meta or WhatsApp (messaging), and Google (Google Analytics, only if you accept it). If we enable Microsoft Clarity for anonymous statistics, it also runs only after your consent.

If we use a payment gateway in the future, your payment data will be processed by that provider under its own privacy policy, and we will update this page.

We never sell or rent personal data to anyone. We disclose data to authorities only when the law requires it.

Transfers outside Indonesia

Some of the providers above store or process data on servers outside Indonesia, including the United States. We choose providers with internationally recognised security standards that are bound by data protection terms.

By using BisaSpeak you understand that your personal data may be processed abroad with the safeguards described here.

How long we keep data

Account data and learning results: while your account is active and until 2 years after your last course ends, then deleted or anonymised.

Homework voice and video recordings: until 12 months after the course ends, then deleted.

Class recordings: available to the cohort's students until 6 months after the course ends, then deleted.

Payment records and transfer receipts: for as long as bookkeeping and tax regulations require.

Waitlist data: until you ask us to delete it, or 2 years after your last interaction.

Certificate name and number: kept so that the authenticity of your certificate can be verified through the link on it.

Cookies

We use necessary cookies for login, your theme, your language, the seat you are reserving, and referral codes. Analytics cookies are only set after you accept them. The full list is in the Cookie Policy.

Security and breach notification

All connections to the site are encrypted (HTTPS). Passwords are stored as bcrypt hashes. Staff access is limited by role, and the learning portal carries no analytics tools.

If a personal data breach affects you, we notify you and the competent authority within 3 x 24 hours of becoming aware of it, as the Personal Data Protection Law requires, together with the steps we are taking.

Your rights

You have the right to information about and a copy of your data, to correct inaccurate data, to request deletion, to withdraw consent, to restrict or object to certain processing, and to lodge a complaint with the personal data protection authority.

How to ask: email halo@bisaspeak.com from your account's email address, or WhatsApp from your account's number. We may ask you to verify your identity. We respond within 7 working days at most.

Data we must keep by law, such as payment records, cannot be deleted early. Deleting your account ends access to classes and the portal; refunds still follow the Refund Policy.

Promotional messages

We contact you about your class, schedule and payment as part of the service. Promotional messages are sent only with your consent. To stop them, reply to our message with the word stop, or email halo@bisaspeak.com; we stop within 7 days.

Changes

If this policy changes, the date above changes with it. We announce significant changes by email or WhatsApp before they take effect.