Privacy Policy

This Privacy Policy explains what information Mantavaya collects when you use the Platform to discover and book boat and liveaboard trips, how we use it, and the choices you have. It applies to travelers using the customer-facing site. This is a working draft, published for transparency while it is finalized with legal counsel.

We collect the following, depending on how you use the Platform:

• Account information — your email address and a password. Passwords are stored only in hashed form; we never store them in plain text.
• Booking and traveler details— to confirm a trip and meet operator and maritime safety requirements, we collect each traveler’s full name, date of birth, gender, nationality and passport number, along with an emergency contact name and phone number. Where you tell us, we also record dietary requirements and any pre-existing medical conditions relevant to your safety on board. Medical and passport information is sensitive, and we collect it only because operators and Indonesian maritime authorities require it to carry you.
• Payment information — handled by our payment provider (see below). Verafi does not receive or store your full card number.
• Usage and device information — basic technical data such as pages viewed, collected to operate and improve the Platform.
• Preferences stored in cookies— such as your chosen display currency and language (see “Cookies”).

We use your information to:

• create and secure your account, and verify your email address;
• process bookings and payments, and send booking confirmations;
• share the details an Operator needs to run your trip;
• provide customer support and respond to your enquiries; and
• operate, secure, and improve the Platform.

Payments are processed by our payment provider (NCB Nustar / Artajasa). Card payments are completed on the provider’s secure hosted payment page, and your full card details are entered there rather than on Verafi. Verafi does not receive or store your full card number. Your payment is also subject to the payment provider’s own privacy practices.

We use a small number of cookies, including:

• a session cookie that keeps you signed in;
• a display currency cookie that remembers the currency you choose to view prices in;
• a language cookie that remembers your locale preference.

Analytics cookies are only set when analytics is enabled for the site (see “Analytics”), and only after you accept them. You can review or change your choice at any time:

When analytics is enabled, we use Google Analytics to understand how the Platform is used in aggregate so we can improve it. Analytics is only active when it has been configured for the site, and it does not run otherwise. Google processes this data under its own terms.

We share information only where needed to run the Platform:

• Operators — the traveler details required to fulfill your booking;
• Payment provider — to process your payment;
• Service providers — who help us operate the Platform (such as hosting and analytics), under appropriate obligations; and
• Legal — where required by law or to protect rights and safety.

We do not sell your personal information.

We are based in Indonesia, and some of the services we rely on operate elsewhere. Our email delivery, error monitoring, file storage and hosting providers process data outside Indonesia, including in the United States and Europe. We only use providers that commit to protecting your information to the standard described in this policy.

We keep your account details for as long as your account is open. Booking and payment records are kept for as long as tax and accounting law requires. Passport numbers and emergency contact details are cleared once they are no longer needed for the trip they were collected for. If you close your account, we remove or anonymise what we are not legally required to keep.

You can view and update your saved traveler details at any time from your account. You can also ask us for a copy of the personal information we hold about you, or ask us to delete it. Write to us at the address below and we will respond within 30 days.

Some information we cannot delete on request. Where you have made a booking or a payment, we must keep the transaction record to meet tax and accounting obligations. In those cases we remove or replace the details that identify you personally and retain only the financial record.

We take reasonable measures to protect your information: passwords are stored hashed, traffic is served over HTTPS, and full card details are handled by our payment provider rather than by Verafi. No system is completely secure, so we cannot guarantee absolute security, but we work to protect your information appropriately.

Children travel with us, and we collect a child’s name, age and nationality when they are booked onto a trip. We collect this from the adult making the booking, not from the child, and we use it only to operate the trip safely and to apply child pricing. We do not knowingly allow anyone under 18 to create an account or make a booking themselves.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date shown above and, where appropriate, let you know of material changes.

For privacy questions or to exercise your rights, email us at support@verafi.my.id. We will respond within 30 days.