Privacy Policy

1. Who We Are and What This Policy Covers

1. ZyroNet is a WiFi hotspot service operated by an individual business owner domiciled in Indonesia, who acts as the data controller for the personal data described in this Policy.
2. This Policy covers the ZyroNet WiFi networks at our Hotspot Locations, the Captive Portal used to buy access, the session status page, and the public website at zyronet.zephyr.co.id.
3. It does not cover the websites, apps, or services you reach over the internet while connected, nor the e-wallet or banking app you use to pay. Those are governed by their own privacy policies.

2. Personal Data We Collect

We collect only the data needed to run the Service:

1. Device identifiers. The MAC address of the Device you connect with, the local IP address assigned to it by the hotspot router, and a short device name (for example "iPhone") derived from your browser so you can recognise your own device on the portal.
2. Session logs. When a WiFi Session starts and ends, which Hotspot Location and router it used, the Access Package, and technical events needed to activate, extend, or end access (for example whether the router confirmed the login).
3. Transaction records. The package bought, the amount and time of payment, the transaction and payment-gateway reference numbers, payment status, and any refund processed.
4. Contact details you enter. The WhatsApp number you provide at checkout so we can identify your purchase and reach you about it, and, if you choose to enter one, the email address used to send your voucher details.
5. Support messages. The name, email address, WhatsApp number, and message you send through our contact form or support channels.
6. Website data. Standard web server logs (IP address, browser type, pages requested, and time of access) when you visit our public website.

We do not collect your card numbers, bank account details, e-wallet credentials, or PIN. Payment is confirmed inside your own payment app and processed by iPaymu; we only receive confirmation that the payment succeeded and its reference number.

We do not inspect the content of your internet traffic. Like any network operator, our equipment handles the technical routing of your traffic while you are connected.

3. Purposes and Legal Basis

We process your personal data for the following purposes and on the following legal bases under the PDP Law:

1. Providing the Service you paid for (performance of a contract): linking your Access Package to your Device, activating and ending your WiFi Session, letting you add or switch Devices where your package allows it, and restoring access if you lose the page.
2. Processing payments and refunds (performance of a contract and compliance with legal obligations): confirming QRIS payments through iPaymu, keeping transaction records, and handling refund requests under Article 4 of our Terms.
3. Customer support (performance of a contract and our legitimate interest in resolving problems): identifying your transaction when you contact us and replying to your message.
4. Network security and abuse prevention (our legitimate interest and legal obligations): detecting misuse of the network, enforcing session limits, and protecting the Service and other Users.
5. Legal compliance (compliance with legal obligations): keeping the records that Indonesian law requires of an electronic system operator and a business, and responding to lawful requests from authorities.
6. Sending your voucher by email (your consent): only if you enter an email address for that purpose. You can skip this step; the codes are always shown on screen.

4. Sharing of Personal Data

We never sell your personal data. We share it only with:

1. iPaymu, our licensed payment gateway, which receives the amount, a transaction reference, and the details needed to create and confirm your QRIS payment and process refunds, under its own privacy policy.
2. Service providers that host our systems or deliver messages on our behalf (for example server hosting and email delivery). They may only use your data to provide the service to us.
3. Hotspot Location operators, limited to what is needed to keep the network running at that location (for example that a Device is registered on the router). They do not receive your payment details.
4. Authorities, when we are legally required to disclose connection logs or transaction records to authorized government bodies, law enforcement, or courts under Indonesian law.

Where a provider stores data outside Indonesia, we make sure the transfer meets the requirements of the PDP Law.

5. Retention Periods

We keep personal data only as long as it is needed for the purposes above, then delete or anonymise it:

1. Session and connection logs (device identifiers, session start/end, router events): for the period required of electronic system operators under Indonesian law, and otherwise no longer than 12 months after the session ends, after which they are deleted or anonymised.
2. Transaction and refund records: for as long as required for accounting and tax purposes under Indonesian law (currently up to 10 years), because they form part of our financial records.
3. Contact details entered at checkout (WhatsApp number, optional email): for the life of the related Access Package and the refund window in Article 4 of our Terms, plus the period we keep the transaction record they belong to.
4. Support messages: up to 24 months after the issue is resolved, so we can follow up on repeat problems.
5. Website server logs: up to 90 days, for security and troubleshooting.

6. How We Protect Your Data

1. Credentials and payment-gateway keys stored in our systems are encrypted, and access to our dashboard is limited to authorised staff with individual accounts and roles.
2. Our website and Captive Portal are served over HTTPS. Because public WiFi carries inherent risks, we recommend using secure (HTTPS) websites and avoiding sensitive transactions on any public network.
3. If a security incident affects your personal data, we will notify you and the relevant authority within the time required by the PDP Law.

7. Your Rights

Under the PDP Law you have the right to:

1. Ask what personal data we hold about you and get a copy of it;
2. Ask us to correct data that is inaccurate or incomplete;
3. Ask us to delete your data, except where we must keep it (for example transaction records required by tax law or logs required by law);
4. Withdraw consent where processing is based on consent (for example the optional voucher email), without affecting processing done before the withdrawal;
5. Object to processing based on our legitimate interests, and ask us to restrict it while we review your objection;
6. Receive data you provided to us in a commonly used format, where technically feasible;
7. Lodge a complaint with the authority responsible for personal data protection in Indonesia.

To exercise these rights, contact us using the details in Section 11. We may ask you for your transaction reference or Device details to verify that the request concerns your own data, and we will respond within the time required by the PDP Law.

8. Cookies and Local Storage

1. The Captive Portal stores a small amount of data in your browser (session or local storage) so that your purchase, Device identifiers, and session status survive a page reload or a switch to your payment app. This data stays on your Device and is not used for advertising or tracking across other websites.
2. Our public website does not use advertising or analytics cookies. Clearing your browser data removes everything stored by the portal; you may then need to enter your transaction reference to restore your session page.

9. Children

The Service is intended for adults and for minors using it under the supervision of a parent or guardian, who is responsible for the purchase and for the minor's use of the network. We do not knowingly collect more data from a child than from any other User.

10. Changes to This Policy

We may update this Policy from time to time, for example when we add a feature or when the law changes. The updated version will be posted at zyronet.zephyr.co.id/privacy with a new Effective Date. Where a change materially affects how we use your data, we will give notice on the Captive Portal before it takes effect.

11. Contact Information

For questions about this Policy, or to exercise your rights, please contact: