Privacy Policy
Effective 28 September 2026 · Last updated 30 September 2026
Amara manages your villa's calendar, rates, and reservation data. So it's fair to want to know exactly what data we hold and what we do with it. This page explains it as clearly as possible, without legalese.
1. Who We Are
Amara is a channel manager service for villa owners in Indonesia, run as a sole proprietorship under the trade name Amara, legally registered in Indonesia with Business Identification Number (Nomor Induk Berusaha, NIB) 0307260063419, located at Kecamatan Ubud, Kabupaten Gianyar, Provinsi Bali, Indonesia. In this document, "Amara", "we", and "us" refer to the operator of that service, namely the sole proprietor recorded under that NIB.
This policy explains what personal data we collect when you use Amara, what we use it for, who we share it with, where it is stored, and what rights you have over it. It is based on Indonesia's Law No. 27 of 2022 on Personal Data Protection.
By signing up for and using Amara, you confirm that you have read and understood this policy. This policy forms one agreement together with Amara's Terms of Service. Questions and requests about personal data can be sent to amara.privacy@nullmarks.com.
This is an English translation. If it differs from the Bahasa Indonesia version, the Bahasa Indonesia version prevails.
2. Two Roles You Should Distinguish
Amara holds two different roles over two different kinds of data, and this distinction determines who is responsible for what.
For your data as a villa owner (account, WhatsApp number, subscription and billing data), Amara acts as the Data Controller. We decide the purpose and means of processing, and this policy is the basis for it.
For guest data received through the OTAs you connect, or recorded by you as direct bookings, you are the Data Controller and Amara acts as a Data Processor, processing that data on your instructions and only to provide the service.
This means the obligation to have a valid legal basis for collecting and using guest data, and to inform guests about that processing, rests with you as the villa owner. Amara does not use your guest data for its own purposes.
3. Data We Collect
We collect the following data, only as far as needed to run the service:
Account data. The name and email address of the Google account you sign up with, plus a profile photo if your Google account provides one. We never receive or store your Google account password. Amara only requests this basic access, not access to your email, files, calendar, or any other data in your Google account.
WhatsApp number. Used for verification at sign-up, to send new-reservation notifications, and as a Customer Care channel.
Villa data. Villa name, address and map location (from the place search field or a map pin), room list, rates, availability, stay rules, and the per-OTA commission rate you enter.
Reservation and guest data. Guest name, contact details provided by the OTA or entered by you, stay dates, reservation source, and transaction value. We receive this from the OTAs you connect, or you enter it yourself for direct bookings.
Subscription and payment data. Records of subscription periods, invoices, and payment status. Payments are processed by Midtrans (PT Midtrans), a third-party payment gateway provider. Amara does not store your card or bank account payment details.
Technical data. IP address, device and browser type, access times, and in-system activity logs for security and troubleshooting.
4. What the Data Is Used For and the Legal Basis
Syncing calendars, rates, and room availability with the OTAs you connect, recording reservations, issuing invoices, and preparing finance reports. Basis: performance of our service agreement with you.
Sending new-reservation notifications to your WhatsApp number. Basis: your consent, which you may withdraw at any time.
Billing and managing your subscription. Basis: performance of the agreement.
Verifying your identity, securing your account, and preventing misuse. Basis: legitimate interest, as long as it does not override your rights.
Providing support through Amara Customer Care. Basis: performance of the agreement.
Sending information about Amara updates and new features. Basis: legitimate interest for email, and your consent for WhatsApp. You can stop receiving it at any time.
Improving service reliability and performance, using aggregated data that does not identify individuals. Basis: legitimate interest.
Keeping billing and bookkeeping records. Basis: compliance with legal obligations, including tax regulations.
We do not sell your data or your guests' data to anyone. We do not use your guests' data for advertising.
5. Service Messages and Product Updates
Amara sends two kinds of messages, and they are treated differently:
Service messages. Verification codes, new-reservation notifications, invoices, account security notices, and notices of changes to the Terms of Service or this policy. These are sent via WhatsApp to the number you verified yourself at sign-up, and by email. Because they are part of the service, service messages continue for as long as your account is active.
Product updates. News about Amara updates and new features. We send these by email, and via WhatsApp only if you have given separate consent for it.
You can stop receiving product updates at any time, through the unsubscribe link in the email, by withdrawing your WhatsApp consent, or by emailing amara.privacy@nullmarks.com. Stopping product updates does not affect service messages.
You can also stop receiving reservation notifications on WhatsApp by contacting Amara Customer Care or emailing amara.privacy@nullmarks.com. After that, new reservations are still recorded in Amara; they are simply no longer sent to your WhatsApp.
7. Storage Location, International Transfers, and Security
Amara's service data is stored in Singapore, with backups in the Asia-Pacific region. Some third-party providers also process data outside Indonesia. This means your personal data is transferred abroad. If the country where data is stored changes, we will update this policy.
For these transfers, our core-service providers are bound by agreements requiring an equivalent level of data protection, while data passing through business email is limited to what is needed. Data is protected with encryption both in transit and at rest.
Encryption of data in transit and at rest.
OTA connection credentials are stored encrypted.
Access to data is restricted to those who need it.
System activity logging to detect unusual access.
8. How Long Data Is Kept
Your account and villa data are kept for as long as your account has not been deleted, including when your subscription ends. That way you can return to Amara without setting everything up again.
Before deleting your account, you can request a copy of your data. If you request account deletion, all your data, including backups, is permanently deleted no later than 30 days after we receive the request.
There is only one exception: invoices and billing records for your subscription to Amara, which we must keep for the period required by tax laws and regulations, with personal data in them kept to a minimum.
Guest data is processed for as long as needed to provide the service to you, and is deleted or returned according to your instructions as Data Controller, unless this conflicts with applicable legal obligations.
9. How to Delete Your Account and Data
To delete your account and its data, email amara.privacy@nullmarks.com from your account's email address with the subject "Delete Account". We will confirm the request, then delete your data no later than 30 days after we receive it, with the exceptions described under How Long Data Is Kept.
Before deleting your account, we recommend requesting a copy of your data and switching the connection settings back in each OTA's extranet. Deleting your Amara account does not remove your listings from any OTA.
10. Your Rights Over Personal Data
Under Law No. 27 of 2022, you have the right to:
Obtain information about the personal data we process and receive a copy of it.
Receive your data in a commonly used, machine-readable format (data export).
Correct or update inaccurate personal data.
Request deletion of your personal data.
Withdraw consent you have given.
Object to certain processing, and request that processing be postponed or restricted.
File a complaint and claim compensation for violations of your personal data protection.
You can send these requests to amara.privacy@nullmarks.com or through Amara Customer Care. We will respond within the time limits set by Law No. 27 of 2022. Please note that deleting certain data may mean the service can no longer be provided for your account.
If one of your guests sends us a request about their data, we will forward it to you as the Data Controller and help you fulfil it.
11. Personal Data Breaches
To be honest, no system is completely free of risk. If a personal data breach occurs, we will notify affected users and the competent authority in writing within 3 x 24 hours, as required by Law No. 27 of 2022, including which data was affected, when and how the breach happened, and the steps we are taking to handle it.
13. Age Limit
Amara is intended for businesses and is not intended for users under 18 years of age. We do not knowingly collect personal data from children as users of the service.
14. Changes to This Policy
We may update this policy from time to time, for example because of changes to the service, third-party providers, or regulations. This policy will be updated before we start any new use of data or use any new third-party provider. The date at the top of the page will be updated, and for material changes we will notify you by email or WhatsApp.
15. Language
This policy is available in Bahasa Indonesia and English. If the two versions differ in interpretation, the Bahasa Indonesia version prevails.
16. Contact Us
Operator: Amara, a sole proprietorship registered in Indonesia under NIB 0307260063419
Address: Kecamatan Ubud, Kabupaten Gianyar, Provinsi Bali, Indonesia. The business owner's identity and full registered address (as on the NIB) are available on request for official correspondence at amara.support@nullmarks.com.
Personal data email: amara.privacy@nullmarks.com
Customer Care email: amara.support@nullmarks.com
WhatsApp: Amara Customer Care (in development, will be announced on this site once active)