Privacy policy
Applies to the LombokRent website and app (working name). DRAFT, 28 October 2026 — to be reviewed before launch.
LombokRent is operated by Seraf Inc. It rents scooters, motorbikes and cars in Lombok, Indonesia, from local fleet partners, checked by our mechanics and delivered by our runners. This page says what we collect, who sees it, and how to have it deleted.
What we collect
- Bookings. Your name, email, WhatsApp number, the delivery address or map link you give, the vehicle and dates, any note you write, whether you confirmed holding a licence, and the price we showed you. When the vehicle is handed over and collected we record the time and the odometer reading.
- Accounts (optional). Your name, email, WhatsApp number and a password. We store only a salted hash of the password. We record when you last signed in.
- Sign-in sessions. A random token that keeps you signed in, as a cookie on the website and in your phone's secure storage in the app. We keep only a hash of it.
- Failed sign-ins. Email address and time, kept for at most one day to stop password guessing.
We do not collect your location, contacts, photos, device identifiers or advertising ID. There are no ads, no analytics and no tracking.
Who sees it
- The runner who delivers and collects your vehicle sees your name, WhatsApp number, delivery address and booking, only while that job is assigned to them, so they can find you.
- Our support and operations staff see bookings and your contact details to confirm and dispatch them.
- Our finance staff see booking amounts and dates, not your contact details.
- The fleet partner who owns the vehicle sees only the dates and status of the booking — not your name or contact details.
- Mechanics see vehicles, never customers.
- Cloudflare runs the website, app back end and database on our behalf.
We do not sell your information or use it for advertising.
How long we keep it
Accounts and their bookings are kept until you delete the account. Bookings made without an account are kept as business records; you can ask us to delete them.
Deleting your account and data
- In the app: My bookings → menu (⋮) → Delete account.
- On the website: sign in → Account settings → Delete account.
- By email: hello@seraf.dev from the address you used. We delete within 30 days.
A booking that is still live (requested, confirmed or out) has to be cancelled or returned first.
Security
All traffic uses HTTPS. Passwords are PBKDF2 hashes. In the app, the sign-in token is kept in the Android Keystore or iOS Keychain and is excluded from backups.