Privacy policy
Translation of the German version. In case of differences, the German version applies.
Controller
Melanie Ginting Lau Jambu, Inhaberin Melanie Ginting, Eichenweg 4, 21357 Wittorf, Deutschland, info@berape.com. See also the imprint.
Visiting the website
berape runs on its own server in Germany. When you visit, technical data (IP address, time, page, browser) is processed to deliver the site and protect it from abuse, and kept only as long as needed for secure operation. There are no third-party analytics or advertising tools (only our own cookie-free visitor statistics, see below); fonts and scripts are not loaded from third-party servers.
Visitor statistics
We count page views without cookies and without browser storage. For the number of visitors per day, the IP address and browser are combined with a random value that changes daily and hashed; the random value and hashes are deleted after two days at the latest. Only daily totals are kept (e.g. per page type, city, category, source, device, language, country), which cannot be traced back to anyone. The country is determined on our own server from the IP address using a local list (IP Geolocation by DB-IP, CC BY 4.0); no third-party service is contacted and the IP address is not stored. If your browser sends “Do Not Track” or “Global Privacy Control”, you are not counted.
Cookies
Only strictly necessary cookies: chosen language (berape_bahasa, 1 year), seller session (berape_sesi, 90 days), login by WhatsApp message in progress (berape_masuk_wa, 10 minutes) and the partner dashboard session.
Seller account and ads
You log in with your WhatsApp number. We store the number, your display name, your ads with photos, price and location (village, postcode) and view and click counts. Name, ads and location are public; the number is not shown on the page and buyers only see it when they open WhatsApp via the chat button. Login codes and IP addresses are stored only as hashes to prevent abuse.
WhatsApp (Meta)
Login codes and login messages go through the WhatsApp Business Platform (Cloud API) of Meta Platforms Ireland Ltd. Meta processes the phone number and message content; data may be transferred to the USA (EU-US Data Privacy Framework). The buyers' chat button opens WhatsApp directly; WhatsApp's privacy policy applies there.
Messages between users
When you send a message through berape, we store its content (text and photos), time, sender and the related ad on our server so the conversation can take place. Phone numbers are not shown to the other person. If a conversation is reported, the berape team may review it. Conversations are deleted 12 months after the last message, and on request together with your account. For new messages we send a short WhatsApp notice via Meta (ad title and link only, not the message text); you can switch it off under “My ads”.
Reports
When you report an ad, we store the reason, note and a hash of your IP address or your seller account to check for abuse.
Passkeys
When you add a passkey (fingerprint, Face ID, screen lock), we only store its public key, a device label and dates. Fingerprint or face data never leaves your device; the passkey itself is kept by your password manager (e.g. Google, Apple).
Reviews
After exchanging messages on berape, you can review each other. Reviews appear publicly on the reviewed person's profile, with the author's first name and initial, role, date and ad title. Reviews can be reported and are deleted when either account is deleted.
Maps (OpenStreetMap)
Maps are only loaded when you click them (or choose the map view). Your browser then loads map tiles from the OpenStreetMap Foundation (Cambridge, UK), which receives your IP address. Legal basis: your consent by clicking (Art. 6(1)(a) GDPR).
Partner websites
Partners embed berape on their sites via widget or API. Your browser then loads data directly from berape.com (IP and browser processed as above). A login through a partner widget is kept in your browser storage on that partner site. For partner accounts we store email, name, website and a password hash.
Retention
Ads expire after 30 days. Deleted ads are no longer shown; on request we delete your account with all ads completely (email info@berape.com). Login codes are valid for 10 minutes. Private accounts that are not used: after 90 days they are marked inactive (profile hidden, no new messages), after 180 days we delete messages, old ads and lists, after 24 months the account. You get a warning first; every login makes the account active again. Reason: in Indonesia unused phone numbers are reassigned by carriers, and a new owner of the number must not see your data.
Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection. Contact info@berape.com. You may also complain to a data protection authority, e.g. the Data Protection Commissioner of Lower Saxony (Germany).
Stand: Oktober 2026