Privacy Policy - Maha Smart

1. Introduction

PT MAZARAT HARAMAIN TAQWA ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Maha Smart mobile application ("App").

Maha Smart is a comprehensive Umrah pilgrimage management platform designed for marketing agents (mutowif) to manage jamaah (pilgrims), coordinate travel arrangements, process payments, and facilitate communication throughout the Umrah journey.

By using our App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our App.

2. Information We Collect

2.1 Personal Information

We collect personal information that you provide directly when registering and using our App:

• Account Information: Full name, email address, phone number, user identification codes (usrcode, usrcode, mktcode)
• Identity Documents: National ID card (KTP), Family Card (KK), passport photos, and personal photographs required for Umrah registration
• Profile Information: Profile photos, date of birth, place of birth, gender, residential address (including province, regency, district, village, postal code)
• Financial Information: Bank account details (bank name, account number, account holder name) for payment processing
• Emergency Contact: Guardian/next of kin information (name and relationship)
• Travel Information: Program codes, schedule codes, group codes, room type preferences, departure and arrival dates

2.2 Payment and Transaction Data

• Payment Records: Payment dates, amounts (IDR/USD), currency types, payment descriptions, transaction references
• Payment Proof: Uploaded images of payment receipts (file_buktibayar)
• Financial Status: Total package fare, total paid amount, remaining balance, payment progress percentage

2.3 Device and Technical Information

• Device Information: Device type, operating system version, unique device identifiers
• FCM Token: Firebase Cloud Messaging device token for push notifications
• Network Information: Internet connectivity status and network type
• App Usage Data: Features accessed, screens viewed, interaction patterns
• Error Logs: Crash reports and performance diagnostics

2.4 Camera and Media Access

• Camera: Used to capture photos for profile pictures, document uploads, and payment proofs
• Photo Gallery: Access to select existing images from your device storage
• File Storage: Read/write access to save and retrieve uploaded documents (limited to Android SDK 28 and below for write; SDK 32 and below for read)

3. How We Use Your Information

3.1 Core App Functionality

• User Authentication: To verify your identity, secure your account, and manage role-based access (marketing agents vs. jamaah)
• Jamaah Management: To create, update, and manage jamaah profiles and registration data
• Document Processing: To store and verify required Umrah documents (KTP, KK, passport photos, personal photos)
• Payment Processing: To record payments, track payment status, and manage financial transactions
• Travel Coordination: To assign jamaah to programs, schedules, groups, and room types
• Downline Management: For marketing agents to manage their network of sub-agents (downline structure)

3.2 Communication and Notifications

• Push Notifications: To send important updates about bookings, payments, document status, and travel schedules via Firebase Cloud Messaging
• In-App Notifications: To display alerts and updates within the app
• Email Communications: To send account-related information and important announcements

3.3 Business Operations

• Marketing Network: To track and manage hierarchical marketing structures (usrtree) and commission calculations
• Performance Analytics: To monitor app usage, identify popular features, and improve user experience
• Customer Support: To respond to inquiries, troubleshoot issues, and provide assistance

3.4 Legal and Security

• Fraud Prevention: To detect and prevent unauthorized access, suspicious activities, and fraudulent transactions
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Terms Enforcement: To enforce our Terms of Service and protect our rights and property

4. Information Sharing and Disclosure

4.1 Within Your Organization

Information is shared within the marketing network structure:

• Marketing Agents: Your assigned marketing agent (mutowif) can view your jamaah profile, documents, payment status, and travel details
• Upline Agents: Agents in your upline hierarchy may access relevant data for commission tracking and network management
• Group Members: Other jamaah in your assigned travel group may see basic information (name, group assignment) for coordination purposes

4.2 Third-Party Service Providers

We use trusted third-party services to provide app functionality:

Service/SDK	Purpose	Data Shared
Firebase Cloud Messaging	Push notifications	Device token, user ID, notification content
Cloudflare R2	Document and image storage	Uploaded files (photos, documents, payment proofs)
HTTP/Dio Client	API communication	Request/response data for all app features
Shared Preferences	Local data storage	Session tokens, user preferences (stored locally)
Image Picker	Photo selection and capture	Selected images from camera or gallery
File Picker	Document selection	Selected PDF and image files

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice in the App of any such change in ownership.

4.4 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, government requests)
• Enforcement of our Terms of Service
• Protection of our rights, property, or safety
• Protection of users' safety or the public interest
• Investigation of fraud or security issues

5. Data Security

We implement comprehensive security measures to protect your personal information:

5.1 Technical Safeguards

• Encryption in Transit: All data transmissions use HTTPS/TLS encryption
• Secure Storage: Documents and sensitive data are stored on secure cloud infrastructure (Cloudflare R2)
• Authentication: Sanctum Bearer Token authentication for API access
• Role-Based Access: Strict role-based permissions (marketing agents vs. jamaah)

5.2 Organizational Safeguards

• Access Control: Only authorized personnel can access user data
• Data Minimization: We collect only the data necessary for app functionality
• Regular Audits: Periodic security reviews and vulnerability assessments
• Employee Training: Staff trained on data protection best practices

5.3 Limitations

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but continuously work to improve our safeguards.

6. Your Rights and Choices

6.1 Access and Correction

You have the right to:

• Access: View the personal information we hold about you
• Correction: Update or correct inaccurate information through the app settings
• Portability: Request a copy of your data in a structured, machine-readable format

6.2 Location Data (Not Collected)

This app does not collect or access device location data. No location permissions are requested, and no location-based features are implemented.

6.3 Permission Management

You can manage app permissions through your device settings:

• Camera: Required for capturing photos; can be revoked (limits photo upload features)
• Storage: Required for document uploads; can be managed through device settings
• Notifications: Can be disabled through device settings (may limit important updates)

6.4 Account Deletion

You can request deletion of your account and associated data by:

• Contacting us at mahaproyek@gmail.com
• Providing your user ID and registered email for verification
• Allowing up to 30 days for complete data deletion

Note: Some data may be retained for legal compliance, dispute resolution, or fraud prevention as required by law.

6.5 Marketing Communications

• You can opt out of promotional notifications through app settings
• Transactional notifications (payment confirmations, booking updates) cannot be disabled as they are essential to the service

7. Data Retention

We retain your personal information for different periods depending on the data type:

Data Type	Retention Period	Reason
Account Data	While account is active + 1 year after closure	Service provision, legal compliance
Identity Documents	Duration of Umrah registration + 5 years	Legal requirements, audit purposes
Payment Records	7 years from transaction date	Financial regulations, tax compliance
Usage Logs	12 months	Security monitoring, app improvement
FCM Tokens	While account is active	Push notification delivery

8. Children's Privacy

Our App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at mahaproyek@gmail.com. We will take steps to delete such information from our systems.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your jurisdiction.

We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy, regardless of where it is processed.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

We will notify you of any material changes by:

• Posting the updated Privacy Policy in the App
• Updating the "Effective Date" at the top of this policy
• Sending a push notification or email for significant changes
• Requiring your consent for material changes that affect your rights

We encourage you to review this Privacy Policy periodically. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please contact us:

PT MAZARAT HARAMAIN TAQWA
Email: mahaproyek@gmail.com

We will respond to your inquiry within a reasonable timeframe, typically within 14 business days.

12. Your Consent

By using the Maha Smart App, you acknowledge that you have read and understood this Privacy Policy and consent to:

• The collection and use of your information as described herein
• The sharing of your data within your marketing network and with third-party service providers
• The storage of your documents and payment information for Umrah registration purposes
• The receipt of push notifications for important updates (can be disabled in settings)

13. Specific Permissions Explained

13.1 Required Permissions

Permission	Purpose	When Used
Internet	Connect to backend services	Always (core functionality)
Network State	Check connectivity status	Always (to ensure reliable operation)
Camera	Capture photos for documents and payments	When you choose to take a photo
Storage (Read/Write)	Save and access uploaded files	When uploading or viewing documents

13.2 Optional Permissions

Permission	Purpose	When Used
Notifications	Receive important updates	For booking, payment, and travel alerts

14. Data Protection Rights (GDPR/Similar Laws)

If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdictions with comprehensive data protection laws, you have additional rights:

• Right to Access: Obtain confirmation of whether we process your data and access to such data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Restriction: Limit how we use your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (without affecting prior processing)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise these rights, please contact us at mahaproyek@gmail.com.

Last Updated: April 30, 2026

Version: 1.0.5