How we handle your details when you book Maheswari

The company that holds your details is PT Komodo Explorer Indonesia, NIB 1805260128363, based in Labuan Bajo. When you write to us about Maheswari, we are the ones who read the message, answer it and keep the thread.

Indonesian law governs this notice, including Indonesia's Personal Data Protection Law, UU No. 27 of 2022. If you live elsewhere, the data law of your own country also protects you, and we answer a request from you in the same way.

You reach the person responsible for your data at sales@maheswari-phinisi.pages.dev. That address forwards to the company's main inbox, and a message there is read by the same team that handles your booking.

We collect only what the trip needs. At the start that is your name, your email address, your phone number and the dates and party size you tell us. Later it is each guest's name as it appears on the passport, the nationality, and any dietary or medical note that the crew should know for safety.

When you pay, we keep the payment reference and the invoice, and we do not keep your full card number. If you message us on WhatsApp, we receive your phone number, your profile name and the text of your messages, through the business messaging service of Meta Platforms.

Some of your messages are passed to an AI service, Cerebras Systems in the United States, that helps our team draft or route a reply. A person is involved in your booking and in every decision about it, including price and acceptance.

Passport details are the sensitive part of a booking, so we ask for them late and for a stated reason. We need each guest's name and passport or ID details at least 7 days before sailing.

Two official systems require them. The harbour's electronic boarding pass must carry the name of each passenger as it is on the passenger list, and the park's online ticket is registered by name and passport number. We enter the details into those systems and send them on for no other purpose than those two.

A passport scan is not needed to request a quote. Send one only when we ask for it, and send it as a message to us, not in a public post.

Payments are taken by bank transfer in rupiah, by a card payment link, and by Wise, Revolut, PayPal, QRIS and Alipay. WeChat Pay runs through a payment partner. Xendit, an Indonesian company, and PayPal process your email address when they create and complete a payment for your booking.

Brevo sends our booking emails, such as confirmations, using your name and email address. Cloudflare handles network traffic and security for our website and our messaging. Google keeps a backup of our operating records, and a limited number of recent backups are kept while older ones are removed automatically.

We do not sell your personal data. Some of these companies are outside Indonesia, including in the United States, and for those transfers we rely on each company's own data protection commitments and its contract with us.

A note on advertising: only with your consent do we share a one-way scrambled form of your email or phone number with Google and Meta, for measuring our advertising. You can withdraw that consent at any time, and withdrawing changes nothing about your booking or its price.

We do not apply a fixed maximum period to a WhatsApp conversation. It stays in our customer records until you ask us to delete it. No other retention period has been set.

Indonesian law requires us to keep certain financial and tax records of completed bookings, such as invoices and payment entries. Where your details sit inside such a record, we keep the minimum the law requires and remove the rest. We also keep what we need to establish or defend a legal claim.

Deleting your data from our systems does not delete your own copy of a conversation on your phone, and it does not delete the copy held by Meta, which Meta's own terms govern.

Write to sales@maheswari-phinisi.pages.dev, or send a WhatsApp message to the number on the contact page, and say what you are asking for. You can ask for a copy of what we hold, for a correction, or for deletion. Give your name, phone number or booking reference so that we can find your record.

We ask you to verify your identity first, so that nobody else can delete your data. We confirm receipt within a few business days. We complete a deletion, or tell you which part cannot be completed and why, within 30 days of verifying you.

What is deleted: your contact details, your conversation history, your marketing consent records and the free-text notes on your profile. What stays is the financial record that the law requires.