Privacy Policy
Updated: 25 June 2026
1. Data Controller & Scope
Undaku is operated by Web Lifestyle studio (operations manager: 鐙谷 直貴), located in Tokyo, Japan (2-11-15-105 Funabashi, Setagaya-ku, Tokyo). Web Lifestyle studio is the controller of personal data processed through Undaku. This policy explains what personal data we collect, how we use it, and your rights. We strive to comply with applicable data protection regulations, including Law No. 27 of 2022 on Personal Data Protection (UU PDP). Contact: support@undaku.id.
2. Personal Data We Collect
Account data (name, email, login IDs such as your Google account ID); invitation content you create (names of the couple/family, event details, photos, love story, gift account information); guest data you provide (names and contacts, including phone numbers for WhatsApp invitations, RSVP responses, guest wishes, the name a guest enters when marking a gift on the wishlist — shown only to the couple who owns the invitation, not to other guests — and open/view records); usage data (IP address, device/browser type, pages viewed); cookies; payment data (processed by KOMOJU for e-wallets and Stripe for cards — we do not store full card details).
3. Legal Basis for Processing (UU PDP)
We process data based on: performance of a contract; consent (e.g. RSVP, wishes and wishlist gift marks, which can be withdrawn at any time — a guest can undo a gift mark from the device used to make it); legitimate interests (security, service improvement, abuse prevention); legal obligations.
4. How We Use Data
To provide the service and display your invitation to guests; to process RSVPs/wishes and show statistics; to send transactional emails (login codes, receipts, notifications); to maintain, secure, and improve the service; to prevent fraud and comply with the law. We do not sell your data and do not send irrelevant marketing without your consent.
5. Data Sharing & Third-Party Processors
We do not sell data. We only share it with the providers that operate Undaku: • Render (hosting & compute, Singapore) • Neon (database, Singapore) • Upstash (cache & rate limiting, Singapore) • Cloudflare (CDN/DNS/security) • Cloudflare R2 (image storage) • KOMOJU (e-wallet payments) • Stripe (card payments) • Resend & Cloudflare Email Routing (email) • PostHog (analytics) • Sentry (error monitoring) • Google (sign-in/login) • Anthropic (optional AI assistance) Each provider processes data according to our instructions and its own security obligations.
6. International Data Transfers
Because the providers above operate outside Indonesia (e.g. Singapore and the United States), your personal data is transferred to and stored abroad. Where required, we rely on consent and/or contractual safeguards and choose providers that maintain an adequate level of protection, in accordance with the UU PDP provisions on cross-border data transfers.
7. Data Retention
We retain account/invitation data for as long as your account exists, so that your invitation remains available (we do not automatically terminate invitations; the free plan has feature limits, not time limits). You can delete your account and all your data at any time through your settings; guest data is deleted when the related invitation or account is deleted.
8. Your Rights
Under applicable law (including the UU PDP), you can: access and obtain a copy of your data; correct inaccurate data; delete your data/account; restrict or object to certain processing; request data portability; withdraw consent at any time. Use your account settings or contact support@undaku.id. You also have the right to lodge a complaint with the competent authority.
9. Notice for Guests
If you are a guest, the couple provides your data to create and send their invitation; the couple is responsible for having a lawful basis to share it. You can request access, correction, or deletion by contacting the couple directly or support@undaku.id, and we will assist or forward your request.
10. Security
We apply reasonable technical and organizational measures (encryption in transit, access controls, server-side authorization so data can only be accessed by its owner). No method is 100% secure, but we strive to protect your data and handle incidents appropriately.
11. Children
This service is intended for adults (18+) who are legally capable of entering into a contract. It is not intended for children, and we do not knowingly collect children's data.
12. Cookies
We use essential cookies for authentication (to keep you signed in) and analytics cookies to understand usage and improve the service. You can manage cookies through your browser; disabling essential cookies may interfere with signing in.
13. Gift Information (Digital Gift Envelope)
Undaku only displays the bank account/e-wallet/QR information or shipping address entered by the couple. We do not receive, store, process, or disburse funds, and we are not a payment processor. Gift transactions occur directly between the guest and the couple. See the Terms & Conditions.
14. Changes to This Policy
We may update this policy. Material changes will be indicated by updating the effective date and, where necessary, through a notice within the service.
15. Contact
Web Lifestyle studio — Operations manager: 鐙谷 直貴. Address: 2-11-15-105 Funabashi, Setagaya-ku, Tokyo, Japan. For privacy questions or to exercise your rights: support@undaku.id.