Nontonio

Privacy Policy

Last updated: 2026-10-20

Nontonio

Effective Date: 1 November 2026
Last Updated: 20 October 2026

This Privacy Policy explains how Nontonio collects, uses, shares, and protects your personal data, and describes the rights and choices available to you. Please read it together with any additional notices we provide for specific features or programs.

About This Policy

Nontonio ("Nontonio", "we", "us", or "our") is a short-drama streaming service available through our website at nontonio.com, our mobile application, and related websites, programs, and services that link to this Policy (together, the "Service"). Nontonio is operated from Indonesia. For the purposes of data protection law, the operator of Nontonio is the controller responsible for your personal data.

By creating an account or otherwise using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

What This Policy Covers

  • Definitions

  • Who We Are and How to Contact Us

  • Applicable Laws

  • Age Requirement

  • Personal Data We Collect

  • Information Visible to Other Users

  • How We Use Your Data and Our Legal Bases

  • Personalization and Recommendations

  • Account Integrity and Abuse Prevention

  • Advertising

  • Cookies and Similar Technologies

  • How We Share Your Data

  • International Data Transfers

  • Data Retention

  • Your Rights and Choices

  • Data Security

  • Data Breach Notification

  • Children's Privacy

  • Mobile Application

  • Promotional Programs

  • Third-Party Services

  • Additional Information for Users in the EEA and UK

  • Additional Information for California Residents

  • Additional Information for Users in Indonesia

  • Governing Law

  • Language

  • Changes to This Policy

  • Contact Us

Definitions

  • Personal data means any information relating to an identified or identifiable individual. We use "personal data" and "personal information" interchangeably.

  • Processing means any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.

  • Controller means the party that determines the purposes and means of processing. For the Service, the controller is the operator of Nontonio.

  • Service provider or processor means a third party that processes personal data on our behalf and in accordance with our instructions.

  • Profiling means automated processing of personal data to evaluate or predict personal aspects, such as viewing preferences.

Who We Are and How to Contact Us

The Service is operated from Indonesia. For any question about this Policy, to exercise your rights, or to submit a complaint, please contact us at [email protected] or through the Support page. We currently perform the data protection function directly and will appoint a Data Protection Officer where required by applicable law.

Applicable Laws

We handle personal data in accordance with the data protection laws that apply to us, in particular Law No. 27 of 2022 on Personal Data Protection ("UU PDP") and the laws and regulations of the Republic of Indonesia on electronic information, transactions, and systems. Where we process the personal data of users in the European Economic Area ("EEA"), the United Kingdom, or California, we also observe the General Data Protection Regulation and UK GDPR ("GDPR") and the California Consumer Privacy Act, as amended ("CCPA"), to the extent they apply.

Age Requirement

The Service is intended only for users aged 18 years or older. Please see "Children's Privacy" below.

Personal Data We Collect

Information you provide to us

  • Account and profile information, such as your email address, password (stored in protected form), display name, and, if you choose to provide them, a username, profile picture, short biography, telephone number, language, and time zone.

  • Preferences, such as the genres and titles you select when setting up your account and, if you choose to provide them, your age range and how you heard about Nontonio.

  • Security settings, such as two-factor authentication and passkeys, if you enable them.

  • Payment and transaction information, such as the plan purchased, amount, currency, payment method, transaction status and reference, coupon codes, and, for bank transfers, the proof of payment you upload. Card and wallet details are entered directly with our payment partners and are not stored by us.

  • Referral and payout information, such as your referral code, referral relationships, rewards, and the bank or e-wallet details you provide to receive a payout.

  • Content you submit, such as comments, likes, content requests, reports, support messages, live-chat messages, and attachments.

  • Forms and correspondence, such as copyright notices, advertising inquiries, contact forms, and other communications with us.

Information collected automatically

  • Viewing and usage information, such as watch history and playback progress, saved titles, offline downloads, searches, interactions with titles and recommendations, and pages viewed.

  • Device and technical information, such as IP address, browser and device type, operating system, language, app version, device and installation identifiers, and session information.

  • Approximate location, such as country, region, or city, derived from your IP address. We use it for regional pricing, regional content and trends, and security. We do not collect precise geolocation.

  • Security and integrity information, such as sign-in activity, security verification results, and signals that help us detect fraud, abuse, and automated activity.

  • Notification information, such as notification preferences, push-notification tokens, and records of messages sent to you.

  • Advertising information, such as advertisement impressions and interactions and, in our mobile application, the advertising identifier of your device.

Information from third parties

  • Sign-in providers. If you sign in with Google or Facebook, we receive basic profile information such as your account identifier, name, email address, and profile picture.

  • Payment partners and app stores, which provide payment and subscription status.

  • Platform and security services, which may provide app-installation, device-integrity, and security verification information.

Information Visible to Other Users

  • Comments and replies are shown publicly together with your display name and profile picture.

  • Content requests may be shown in the community request list together with your display name and the details you provide. Your email address is not shown.

  • Reports and support communications are not published.

Please do not include sensitive personal information in content that you share publicly. Public content may remain visible in anonymized form after your account is deleted.

How We Use Your Data and Our Legal Bases

We process personal data only where we have a lawful basis under Article 20 of UU PDP and, where applicable, the GDPR. These bases include your consent, the performance of our agreement with you, compliance with legal obligations, and our legitimate interests, which we balance against your rights and interests.

  • To provide the Service, including account management, authentication, streaming, regional pricing, saving your progress and library, processing payments, subscriptions, rewards, and payouts, offline viewing, and customer support. Basis: performance of an agreement.

  • To keep the Service safe, including preventing fraud, abuse, unauthorized access, and automated activity, enforcing our Terms, and maintaining security records. Basis: legitimate interests and legal obligations.

  • To understand and improve the Service, through usage measurement that we conduct ourselves. Basis: legitimate interests, or consent where required by law.

  • To personalize content, as described in "Personalization and Recommendations." Basis: performance of an agreement and legitimate interests, subject to your settings; consent for visitors who are not signed in.

  • To display advertising and measure our marketing. Basis: legitimate interests for non-personalized advertising; consent for marketing cookies and personalized advertising.

  • To communicate with you, including service messages, security alerts, payment confirmations, content suggestions, and, where you have agreed, promotional messages and push notifications. Basis: performance of an agreement, legitimate interests, or consent.

  • To comply with law, including financial record-keeping, responding to lawful requests, handling copyright notices, and establishing or defending legal claims. Basis: legal obligations and legitimate interests.

Personalization and Recommendations

We personalize the titles and recommendations shown to you based on your viewing activity, saved titles, selected preferences, feedback such as "Not interested," and general popularity and trends in your region. For visitors who are not signed in, personalization takes place only after analytics cookies are accepted; otherwise, recommendations are based on region and popularity.

This processing is used solely to operate and improve the Service and does not produce legal or similarly significant effects for you. You may adjust personalization through the privacy settings available in the Service or by contacting us.

Account Integrity and Abuse Prevention

To protect our community, promotions, and payment flows, we use security and activity signals to assess whether accounts are operated genuinely and in accordance with our Terms. Automated assessment alone does not restrict an account. Any restriction on account features is decided by an authorized Nontonio reviewer and does not affect your ability to sign in, make payments, or watch content. If you believe a restriction was applied in error, you may contact us to request a review, present your point of view, and obtain an explanation.

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you, within the meaning of Article 10 of UU PDP and Article 22 of the GDPR.

Advertising

Advertising helps us offer part of the Service without charge. Plans that include ad-free viewing do not display advertisements in the features covered by that plan.

  • We display our own promotions as well as advertisements from third-party advertising partners. These partners may receive technical information such as your IP address and device information, and may use cookies or similar technologies in accordance with their own policies.

  • Our mobile application uses Google's advertising services, which may use your device's advertising identifier. Advertisements are non-personalized unless you enable personalized advertising in the application settings. You may reset or delete your advertising identifier in your device settings.

  • Where you accept marketing cookies on our website, we use Google's measurement tools to evaluate the effectiveness of our advertising campaigns.

We do not provide advertisers with your name, email address, or watch history.

Cookies and Similar Technologies

We use cookies, local storage, and similar technologies for the following purposes:

  • Essential: to keep you signed in, remember your settings and cookie choices, apply referrals, keep the Service secure, and manage how often advertisements appear. These are always active.

  • Service measurement: to measure use of the Service in aggregate for reliability, improvement, and abuse prevention. This measurement is carried out by us and is not shared with third-party analytics providers.

  • Analytics (optional): to personalize recommendations for visitors who are not signed in.

  • Marketing (optional): to measure our advertising campaigns and, for signed-in users who have enabled it, to support personalized advertising.

You can manage optional categories through our cookie banner. To review your choice later, you may clear the site data for nontonio.com in your browser, after which the banner will be shown again. You may also control cookies through your browser or device settings, although disabling essential cookies may affect the operation of the Service. The Service does not currently respond to Do Not Track or Global Privacy Control signals; please use the cookie banner and your privacy settings instead.

How We Share Your Data

We do not sell your personal data. We share personal data only to the extent necessary for the purposes described in this Policy, with the following categories of recipients:

  • Service providers that support our operations, such as hosting, storage, content delivery, network security, communications, and notification services. They act on our instructions and are subject to confidentiality and data protection obligations.

  • Payment partners, such as PayPal, Midtrans, and banks, to process payments and payouts. Some of them act as independent controllers under their own privacy policies.

  • Sign-in providers, such as Google and Facebook, when you choose to use them.

  • Advertising and measurement partners, as described in "Advertising."

  • Content and rights partners, to the extent required to deliver content or to process copyright notices.

  • Authorities and other parties, where required by law, in response to lawful requests, or where necessary to protect the rights, safety, or property of Nontonio, our users, or others.

  • Successors, in connection with a reorganization, transfer, or sale of the Service, subject to applicable law and notice to you where required.

International Data Transfers

Our infrastructure and some of our service providers are located outside Indonesia, including in the European Union and the United States. Where personal data is transferred outside Indonesia, we ensure that the recipient provides a level of protection equivalent to or higher than UU PDP, or we put in place appropriate and binding safeguards, or we rely on your consent, in accordance with Article 56 of UU PDP. For transfers from the EEA or the United Kingdom, we rely on adequacy decisions or appropriate safeguards such as Standard Contractual Clauses. You may request further information about these safeguards by contacting us.

Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. In determining retention periods, we consider the nature and sensitivity of the data, the purposes of processing, and applicable legal requirements. In general:

  • account information is retained while your account is active and is deleted or anonymized after the account is deleted;

  • financial and transaction records are retained for the period required by applicable law;

  • usage, security, and technical records are retained for limited periods and are then deleted, aggregated, or anonymized; and

  • support, moderation, and request records are retained as long as reasonably necessary to handle them and maintain appropriate records.

We may use aggregated or de-identified information that no longer identifies you for any lawful purpose.

Your Rights and Choices

Subject to applicable law, including Articles 5 to 13 of UU PDP, you have the right to:

  • obtain information about the processing of your personal data;

  • access and obtain a copy of your personal data;

  • correct inaccurate or incomplete personal data;

  • request the deletion or destruction of your personal data;

  • withdraw consent where processing is based on consent;

  • object to processing based on legitimate interests and to decisions based solely on automated processing;

  • request the restriction or suspension of processing;

  • receive your personal data in a commonly used, machine-readable format, where applicable;

  • seek compensation for violations in accordance with applicable law; and

  • lodge a complaint with the competent data protection authority.

Tools in the Service

  • Download a copy of your account data from your account settings.

  • Edit your profile and change your email address through the verification process.

  • Clear your watch history and search history, and delete your account from your account settings.

  • Manage personalization, analytics, and personalized advertising settings where available in the application, cookie choices through the cookie banner, and notification preferences in the Service or your device.

  • Manage your sessions, passkeys, and two-factor authentication in your security settings.

Making a request

You may submit any request to [email protected]. We may ask you to verify your identity before acting on a request. We respond within the time limits required by applicable law, including UU PDP. Requests are handled free of charge, except where a request is manifestly unfounded or excessive and applicable law permits a fee or refusal. We will not discriminate against you for exercising your rights.

Account deletion

Account deletion takes effect immediately and cannot be undone. We delete or anonymize your personal data, except for information we must retain to comply with legal obligations, prevent fraud, resolve disputes, or maintain security records, such as transaction records. Deleting your account does not automatically cancel a recurring subscription with a payment partner; please cancel your subscription before deleting your account.

Data Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, and alteration, including encryption in transit, protection of credentials, access controls, and monitoring. No system is completely secure, and we cannot guarantee absolute security. We recommend that you use a strong and unique password, enable two-factor authentication or a passkey, and contact us promptly if you suspect unauthorized use of your account. We will never ask for your password by email or chat.

Data Breach Notification

If a personal data breach occurs, we will take prompt steps to contain it and, where required by law, will notify affected users and the competent authority in writing no later than 3 x 24 hours after we become aware of it, in accordance with UU PDP and other applicable law.

Children's Privacy

The Service is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that a child has provided personal data without the consent required by law, we will take steps to restrict the account and delete the data. Parents or guardians may contact us at [email protected].

Mobile Application

Our mobile application collects the device and technical information described in this Policy to operate the application, deliver notifications, secure offline downloads, and prevent abuse. The application requests only the permissions required for its features, which you can manage in your device settings. Offline downloads are licensed temporarily and are linked to your account and device.

Promotional Programs

Certain promotional programs, such as Nontonio Events, have their own terms and privacy notices. Those documents apply to your participation together with this Policy.

Third-Party Services

The Service may contain links to, or features provided by, third parties such as payment partners, sign-in providers, app stores, and advertisers. Their processing of your personal data is governed by their own privacy policies, which we encourage you to review.

Additional Information for Users in the EEA and UK

If the GDPR applies to you, the legal bases, rights, and transfer safeguards described in this Policy apply accordingly. You may withdraw consent at any time and may lodge a complaint with the supervisory authority in your country of residence or work, or in the place of the alleged infringement.

Additional Information for California Residents

If the CCPA applies to our processing of your personal information, you have the right to know, access, correct, and delete your personal information, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising your rights. We do not sell personal information. Our use of advertising and measurement partners, where you have consented to it, may be considered "sharing" under California law; you may opt out by declining marketing cookies and keeping personalized advertising disabled. Requests may be submitted to [email protected], including through an authorized agent.

Additional Information for Users in Indonesia

UU PDP is the primary framework governing our processing of your personal data. Your rights under Articles 5 to 13 of UU PDP are described in "Your Rights and Choices." Complaints may be submitted to us and to the personal data protection authority designated under UU PDP.

Governing Law

This Policy is governed by the laws of the Republic of Indonesia, without prejudice to any mandatory data protection rights you may have under the laws of your country of residence.

Language

This Policy is published in Bahasa Indonesia and English and may be made available in other languages. For users in Indonesia, the Bahasa Indonesia version prevails in the event of any inconsistency. For other users, the English version prevails unless local law requires otherwise.

Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes through the Service or by email before they take effect and will update the "Last Updated" date above. Your continued use of the Service after the changes take effect constitutes acknowledgment of the updated Policy.

Contact Us

If you have any questions or requests regarding this Policy, please contact us at [email protected] or through the Support page.