1. Policy Acceptance

By using StarWorld / StarWALLET — including installing our apps, registering on our website, connecting a account, signing in with social/email, or creating an account for membership, ambassador, or merchant onboarding — you accept the uses, disclosure, and regulations outlined in this Policy.

2. Data We Collect

We necessitate your personal information in order to provide you with our services and create a personalised experience. Personal information includes information that would identify you as a real person.

• Identity: name, gender, birth date, email, phone, address verification, identity proof / government ID (KYC as required)

• Account / auth: account addresses, social login identifiers, session tokens, member number

• Financial: bank details where collected, billing and transaction records, payment processor references (Stripe, Xendit)

• Digital assets: account addresses, on-chain references, StarPOINTS / StarXP balances and redemptions

• Location / venue: location if enabled, venue entry/exit timestamps, staff door logs

• Technical & usage: IP, device/browser, feature usage, AI/chat metadata (subject to retention)

• Role-specific: Members (tier, referrals); Ambassadors (referral/commission data); Merchants (business profile, listings, settlement)

Data will never be given to unauthorised parties.

3. How We Use Your Data

• Provide membership, account, marketplace, venue, and related Services

• Process transactions, loyalty, swaps, and gift cards

• Identity verification and financial-crime detection (AML/CFT/fraud)

• Account communications and platform updates

• Security, fraud prevention, accounting, reporting, and legal compliance

• Improve Services; marketing/remarketing only as described in Privacy Choices

4. How We Process Your Personal Information

Data is processed by computer and/or IT system databases. Only certain individuals responsible for operations — website and apps administrators, system technical & IT, marketing, and accounting — have need-to-know access.

5. Data Security

Personal information is not to be shared or sold to unauthorised parties. We take considerable precautions against unauthorised access, use, alteration, disclosure, or loss. Only employees and business partners who require such information have restricted access.

We implement appropriate technical and organisational measures, including encryption, access controls, and regular security assessments.

6. Data Retention

Personal data is handled and maintained as long as necessary for the purpose for which it was acquired, including internal research, fraud prevention, accounting, reporting, and legal requirements.

• User profile: duration of relationship + ~1 year

• Transaction / financial records: up to 7 years

• Venue access logs: ~1 year

• AI conversation data: ~90 days (unless otherwise required)

• Marketing preferences: until consent withdrawn

• Disabled accounts: up to 1 year for reactivation, then permanent loss of login access

On-chain addresses and transaction records cannot be erased by us.

7. Age Restrictions / Children’s Privacy

Users must be at least seventeen (17) years old under the StarWALLET baseline. Where local law requires majority age, the Services are not intended for persons under 18. We do not knowingly sell or share for cross-contextual behavioural advertising the personal data of anyone under 16.

If you use the Services on behalf of a minor child and you are the parent or legal guardian, we treat information you give us under this Privacy Policy.

8. Data Sharing

• Payment processors (Stripe, Xendit)

• Operational service providers (hosting, analytics, auth/account infrastructure, email)

• Credit / fraud / financial-crime agencies for identity verification (should not adversely affect credit rating)

• Regulators when required by law

• Business, merchant, or venue partners as needed to deliver requested Services, or with consent

• Analytics / advertising partners — see Privacy Choices for sale/sharing opt-out

9. Your Rights Under UU PDP

Under Indonesian Data Protection Law (UU No. 27/2022) and similar laws, you may have rights to access, rectification, deletion, restriction, portability, and objection. Exercise rights via privacy@tokenizin.com or dpo@tokenizin.com. US sale/sharing opt-out: /privacy-choices.

10. International Data Transfers

Your data may be transferred to and processed outside Indonesia. We ensure appropriate safeguards in compliance with UU PDP and applicable law.

11. Privacy Policy Updates

This Privacy Policy is subject to revision at any time. We periodically evaluate it for legal compliance and business changes. We update the Effective / Last updated date at the top of this page and will try to notify you of material changes.

Please review this notice regularly. Continued use of the Services after an update constitutes acceptance of the revised Privacy Notice.

12. Complaints

If you believe we have not handled your data properly, you may contact dpo@tokenizin.com and/or lodge a complaint with the Indonesian Data Protection Authority.