This policy explains what personal data Konek QR processes, why, how long it is kept, who else processes it, and what your rights are. It follows Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP") and its implementing rules.
1. Data controller
The data controller for the Konek QR service is Konek QR. Contact us about personal data at [email protected] with the subject "Data pribadi", or on WhatsApp at 0899-6511-116.
For buyer data that you, as a merchant, send to Konek QR (in an invoice's description or metadata, for example), you are the controller and Konek QR processes it on your behalf.
2. The data we process
When you sign up and use your account
- email, full name and WhatsApp number (optional);
- your password, stored only as an argon2id hash; if you sign in with Google, your Google account ID and email;
- your 2FA secret (encrypted) and recovery codes (as hashes);
- language and theme choice, sign-in sessions, and the devices that have signed in successfully.
QRIS and invoices
- the content of the static QRIS you add: registered merchant name, NMID, city, issuer and business category;
- invoices: amount, unique code, description,
referenceId,metadata,returnUrl, status and times; - the logo, display name and label of your payment page.
Listener phones
- the name you give the phone, the app version and regular health reports: notification access, battery and charging, network type, queue size and the time of the last notification;
- a device identifier in hashed form, to detect one phone paired to several accounts. We store only an HMAC of the hash of its Android ID, never the ID itself;
- payment notifications from merchant apps on the Listener's list (supported merchant account apps). A notification's text can include the payer's name if your merchant app shows it. Notifications from other apps, chats and SMS are never sent.
Balance and fees
- balance top-ups, fee deductions and the balance ledger.
Integrations and notifications
- API keys (as hashes), webhook endpoints and their secrets (encrypted), webhook delivery logs;
- the Telegram chat you connect for notifications.
Technical and security data
- IP address, browser type, access times and sign-in attempts;
- risk signals used to detect abuse, such as amount patterns and keywords in invoice names or descriptions.
Reports and messages
- reports from the "Laporkan" (report) button on payment pages, including the reporter's email if given;
- emails and WhatsApp messages you send us.
Visitors to this site and to payment pages
- konekqr.web.id uses no cookies, analytics or third-party trackers. The Check a QRIS tool reads the QRIS in your browser; only its NMID and MPAN (the merchant's number at its issuer) are sent to the server, to show its status at Konek QR.
- payment pages record the IP address and technical data in server logs for security.
We never ask for or store the password, PIN, OTP or token of your merchant account.
3. Why we use data, and on what basis
| Purpose | Basis |
|---|---|
| Creating and running your account, making invoices and QRs, matching payments, sending the notifications you set up | performance of a contract (the Terms of Service) |
| Taking fees, managing the balance and keeping transaction records | performance of a contract and legal obligation |
| Keeping accounts secure, preventing fraud, online gambling and QRIS misuse | legitimate interest and legal obligation |
| Answering your questions, reports and requests | performance of a contract and legitimate interest |
| Sending important news about your account, security and changes to the service | performance of a contract |
| Reading payment notifications through the Listener | your consent on the Listener's data consent screen, which you withdraw by disconnecting the phone |
We do not sell personal data, use it for advertising, or send promotional email without your consent.
4. Automated decisions
The abuse detection system scores risk from transaction patterns, invoice content, account behaviour and payer reports. A high score can hold back live invoices automatically until they are reviewed. Closing an account and blacklisting an NMID are always decided by a person. You may ask for a person to review any automated decision through [email protected].
5. How long data is kept
| Data | Kept for |
|---|---|
| Payment notification text from the Listener | 30 days, then only the amount and time |
| Notifications queued on the phone and not yet sent | up to 7 days, on that phone |
| Listener phone device identifier (hashed) | while your account is active, also for phones that were disconnected |
Account events (also readable through GET /v1/events) and webhook delivery logs | 30 days |
| Sign-in sessions | until you sign out, or 7 days |
| Records of failed sign-in attempts | 90 days |
| Server logs | 30 days |
| Encrypted database backups | 30 days |
| Account, QRIS, invoice and settings data | while your account is active |
| After an account is closed | deleted or anonymised within 30 days, except transaction records, the balance ledger, audit logs and abuse case data, which we keep as long as the law requires or as needed to settle disputes |
6. Who else processes data
We use these providers, each only for its task:
- Cloudflare: network and protection for every konekqr.web.id host, Turnstile on the sign-in and sign-up forms, forwarding of care@ email, and storage of encrypted backups;
- the server (VPS) provider that runs the application and database;
- Resend: sending account emails;
- Google: if you choose to sign in with Google;
- Telegram: if you connect it for notifications;
- Have I Been Pwned: checking for leaked passwords; only the first 5 characters of the password's hash are sent, never the password.
Some of these providers process data outside Indonesia. We choose providers that give data protection equal to or higher than the UU PDP.
We may also give data to law enforcement, or to a QRIS provider in a case of fraud or QRIS misuse, when the law requires it or on a lawful request.
7. How we protect data
Connections are always encrypted (HTTPS). Passwords, API keys and tokens are stored as hashes; webhook, Telegram and 2FA secrets are encrypted. QRIS content is sealed with an HMAC so it cannot be swapped quietly. The servers accept traffic only through Cloudflare, admin access requires 2FA, and every admin action is written to an audit log. Backups are encrypted.
8. Your rights
Under the UU PDP you have the right to:
- be told how your data is processed, and get a copy of it;
- correct data that is wrong or incomplete; you can change much of it yourself in the dashboard;
- have your data deleted, or its processing stopped or restricted;
- withdraw consent you gave;
- object to fully automated decisions and ask for a review by a person;
- receive your data in a machine-readable format, such as the invoice CSV export in the dashboard;
- file an objection or claim under the applicable law.
Send your request from your account email to [email protected] with the subject "Data pribadi". We reply within 3 x 24 hours of receiving it, and may ask you to prove that the account is yours. Some data stays with us when the law requires it (see section 5).
9. If a data breach happens
If a failure to protect personal data affects your data, we notify you and the competent authority in writing within 3 x 24 hours of learning of it. The notice says which data was affected, when and how it happened, what we are doing about it and what you should do.
10. Children
Konek QR is for merchants aged 18 and over. We do not knowingly process children's data. If you know of an account that belongs to a child, tell us.
11. Changes to this policy
If this policy changes in an important way, we tell you by email and in the dashboard at least 14 days before the change applies. The version date is at the top of this page.
12. Cookies and browser storage
This section explains the cookies and browser storage Konek QR uses. In short: this site uses no cookies at all, and the dashboard uses only the cookies it strictly needs so that you can sign in safely. There are no advertising, analytics or third-party tracking cookies. On a first visit the site shows a short notice about this; your "Got it" is kept in your browser as kq.notice, not as a cookie.
The konekqr.web.id site
This site, the documentation and the Check a QRIS tool included, sets no cookies. Some of your choices are kept in your browser's local storage (localStorage). They are never sent to our servers, and you can clear them at any time in your browser settings:
| Name | Holds | Created when |
|---|---|---|
kq.theme | light or dark theme | you pick a theme other than your device setting |
kq.locale | Indonesian or English | you pick a language with the ID/EN switch |
kq.notice | that you closed the cookie notice | when you press "Got it" |
scalar-reference-selected-client-v2, colorMode | the code sample language chosen in the API reference, and possibly its colour mode (kept by Scalar, the API reference viewer) | you open or use the API reference page |
The app.konekqr.web.id dashboard
The dashboard uses only the cookies needed to sign in and keep your account secure. All of them are __Host- cookies: sent only over HTTPS to app.konekqr.web.id, unreadable by JavaScript, and never shared with other sites.
| Name | Purpose | Lasts |
|---|---|---|
__Host-kq_session | shows that you are signed in | until you sign out, at most 7 days |
__Host-kq_device | recognises a browser that has signed in to your account before, so someone guessing your password cannot lock you out of that browser | 180 days |
__Host-kq_2fa | keeps your sign-in step while you enter a 2FA code | 5 minutes |
__Host-kq_reg | keeps your sign-up step after your email is verified | 30 minutes |
__Host-kq_oauth | links your trip to Google and back when you sign in with Google | 10 minutes |
Because these cookies are needed for the service you asked for, they do not need separate consent. If you block them, you cannot sign in to the dashboard.
The sign-in and sign-up forms use Cloudflare Turnstile to tell people from bots. Turnstile runs in a frame from challenges.cloudflare.com and is governed by Cloudflare's privacy policy. Your language and theme choices in the dashboard are saved in your account profile.
Payment pages and the API
The payment pages at pay.konekqr.web.id and the API at api.konekqr.web.id set no cookies.
13. Language
This policy is written in Indonesian and English. If the two differ, the Indonesian version applies.