Privacy Policy

This page explains what personal data iMasyour League processes, why, how long it is kept, and your rights under Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "PDP Law").

Last updated: October 29, 2026

This is a translation for convenience. If it differs from the Indonesian version, the Indonesian version applies.

Summary.

The website does not have accounts, login, or online payments yet. The "Member accounts" section below explains the rules that will apply when accounts open.
We use Ahrefs Analytics for visit statistics. According to Ahrefs, it uses no cookies or persistent identifiers.
We also use Microsoft Clarity to see how pages are used (clicks, scrolling, session recordings, and heatmaps). Clarity uses cookies, masks form contents, and does not run on member account pages.
Forms on the website are put together on your device and are not sent to or stored by the website.
Questions to the iMasyourLeague Assistant are processed by an AI provider outside Indonesia and kept for at most 90 days.
Data about anyone under 18 is processed only with a parent's or guardian's consent.
You can ask for a copy, correction, or deletion of your data at any time.

Who is responsible.

The data controller is iMasyour League, a basketball community in Jakarta run by Irvan Masyur-Sutan, operating from Gelanggang Remaja Duren Sawit, Jl. Balai Rakyat No.14, Klender, Duren Sawit, East Jakarta 13470.

Data protection contact: Irvan Masyur-Sutan, email irvan@imasyourleague.com, WhatsApp +62 896-9105-7195.

What we process and why.

Messages you send via WhatsApp, email, phone, or Instagram: to answer questions, manage session attendance, and handle class or event sign-ups.
Session or class registration forms: name, WhatsApp number, birth year, emergency contact, injury-risk acknowledgement, and photo consent. Used to manage participants, reach family in an emergency, and record consent.
Chats with the iMasyourLeague Assistant: the questions and answers, to reply and improve answer quality.
Visit statistics (Ahrefs Analytics): pages viewed, referral source, device type, and city, to understand how the site is used.
On-page behaviour (Microsoft Clarity): clicks, scrolling and cursor movement, session recordings, device type, and approximate location, to improve the site's layout and ease of use. Form field contents are masked and not recorded.
Photos and videos of activities: for documentation and official content, in line with your photo consent.
Transaction data (sessions, jerseys, referee services): name, contact, amount, and proof of payment, for order confirmation, delivery, and tax obligations.
Attendance analysis (member accounts): the organizers see totals per area, division, and week and no-show rates per session, and use pseudonymised attendance data (no names, contacts, district, or dates; each member replaced by a random code) to forecast how many players each session will have. For internal use only, never used to assess or make decisions about a particular person, and not shared with others.

We do not ask for national ID numbers (KTP/NIK), full home addresses, or full dates of birth unless truly necessary and the purpose has been explained. Health information, such as an injury the organizers should know about, is recorded only if you provide it and only for your safety.

Legal bases.

Consent: for publishing photos, WhatsApp update messages, Assistant chats, and children's data. You can withdraw consent at any time without affecting your participation in sessions.
Performance of an agreement: for session registration, jersey orders, and referee services you request.
Legal obligation: for transaction records required by tax rules.
Legitimate interest: for website security and abuse prevention. Also for internal, pseudonymised attendance analysis; you can object through the contact below.

Chat assistant.

The chat button in the corner opens the iMasyourLeague Assistant, an AI that answers questions about schedules, venues, classes, jerseys, and event services from the data on this website. AI answers can be wrong; confirm important details with the organizers.

What you type is sent to Meta (the Muse Wonder model) outside Indonesia to write the answer, and the question and answer are stored on Cloudflare infrastructure for at most 90 days. We do not store IP addresses, cookies, or accounts with the chat history; conversations are tagged only with a random code per browser tab.

Do not send sensitive data such as ID numbers, bank details, passwords, or health data in the chat. To have your chat history deleted, contact us with the approximate time of the conversation.

Member accounts (not open yet).

iMasyour League is preparing member accounts for session registration, iMasyour Hoops game progress, and credits. When accounts open, the following rules apply and the date of this policy will be updated:

Sign in with Google: we receive your name, email address, and Google account ID. We never receive your Google password.
Profile data: real name (private, for the organizers only), nickname (may appear publicly on leaderboards), WhatsApp number, division, birth year, and city and district. We do not ask for a street address, national ID number, or full date of birth.
Ages 13–17: teens create their own account, but it only becomes active after a parent or guardian consents.
Under 13 (iMasyourLeague Basketball Academy Family Account): children have no account or login of their own. A parent or guardian signs in with one Google account and adds a Kid Profile for each child, plus their own profile if they play Open Run. A Kid Profile holds only a nickname, birth year, division, and an optional private first name, with no email, WhatsApp, or login. Kid Profiles appear on a kids-only leaderboard only if the parent allows it. The parent manages all of the child's data and consents.
Credits and game progress: credits are earned by attending sessions and classes and by playing, cannot be bought, have no cash value, and cannot be exchanged for money. In a Family Account, credits from every profile go into one family balance; the credit record keeps which profile earned or spent them, and the parent can set a spending limit per child. A teen aged 13–17 gets their own credit balance from their first check-in.
Session bookings: session date, venue, category, price, and attendance status (booked, cancelled, attended, no-show). When booking you accept the injury-risk statement; that acceptance is stored with the policy version in force. Teens aged 13–17 can book only after a parent or guardian has given consent.
Emergency contact: the name and WhatsApp number of another person we can reach in an emergency, stored on your profile and used only for emergencies. Let that person know before you add their number.
Coordinator access: session coordinators appointed by the organizer see the roster of their sessions (nickname, real name, a teen marker, and emergency contact) to manage attendance and safety. Every roster view and every check-in is recorded in an audit log.
Waitlist and email notices: when a session is full you can join its waitlist; we store the session, your profile, status, and the time you joined, and automatically book the longest-waiting member when a place frees up. We send service emails to your Google email address: booking confirmation, promotion from the waitlist, a reminder 3 hours before the session (you can turn it off on your account page), and session-off notices. These are not marketing. The notice record keeps the kind, status, times, and session details, but not your email address.
Retention: accounts inactive for 24 months are deleted after notice. You can delete your own account at any time. Your data export includes your booking history, waitlist places, email notices, and credit record; deleting your account deletes all of them.

Children and teens.

We process data about children (under 18) only with a parent's or guardian's consent, under Article 25 of the PDP Law and Government Regulation No. 17 of 2025 on child protection in electronic systems. Children's program registrations and session forms for participants under 18 are signed by a parent or guardian.

For children, we do not show real names publicly, do not offer chat between users in the game, and do not show ads. Photos of children are published only with a parent's consent.

Service providers and transfers abroad.

We use the following providers. Some process data on servers outside Indonesia, under those providers' contractual safeguards:

Cloudflare: website hosting, chat history storage, and email.
Meta: the AI model behind the iMasyourLeague Assistant.
Ahrefs: visit statistics.
Microsoft (Clarity): heatmaps and session recordings.
Google: account sign-in (when it opens) and Gmail for email.
Resend (United States): delivers the member account service emails. Data sent: email address, nickname, and session details. Delivery is set to the Tokyo region, but it is still a transfer outside Indonesia.
WhatsApp and Instagram (Meta): messages you send through those channels.
Instagram, YouTube, TikTok, and Facebook: content embedded in the Social section. For YouTube we use the youtube-nocookie.com player.

We do not sell personal data and do not share it for advertising.

How long we keep data.

Assistant chat history: at most 90 days.
Microsoft Clarity data: session recordings about 30 days and aggregated statistics up to 13 months; Clarity cookies (_clck, _clsk) at most 1 year, and you can delete them in your browser settings.
Messages and registration forms: while you take part in activities, then deleted no later than 24 months after your last activity.
Member accounts, with booking history, attendance, emergency contact, and credit record: until you delete the account, or after 24 months of inactivity.
Finished email notice records: deleted after 90 days.
Transaction records and invoices: 10 years as required for tax, with only the data needed.
Published photos and videos: until you ask for them to be taken down.

Security and data breaches.

Access to data is limited to the organizers who need it. If a personal data protection failure occurs, we will notify you in writing and report to the competent authority within 3 × 24 hours of confirming it, including what data was affected, when and how it happened, and the steps taken to handle and recover from it.

Your rights.

Under the PDP Law you have the right to:

be informed about how your data is processed;
access your data and receive a copy;
correct inaccurate or incomplete data;
delete your data and end its processing;
withdraw consent you have given;
receive your data in a portable format;
object and file a complaint with the personal data protection authority.

Send requests to irvan@imasyourleague.com or WhatsApp +62 896-9105-7195, mentioning the channel you used before. We respond within 3 × 24 hours. For a child's data, the request is made by the parent or guardian.

Changes to this policy.

We update this policy when our activities or services change, for example when member accounts open. The last update date is shown above. Important changes are announced on the website and our official Instagram.