Acceptable Use Policy

Maleo Sites is a website builder for small businesses. Most people who use it are running a warung, a clinic, a laundry, a barbershop, or a small workshop, and these rules will never trouble them. This policy exists because of the small number who would use it for something else, and because of what their sites would do to everyone else's.

1. Scope, and why these rules are strict

This policy applies to everything published through the Service and to your own conduct as an account holder. It covers pages, text, images, files, links, form messages, and domain names. It applies whether your site is published at a maleosites.com subdomain or at a custom domain you have connected yourself. Connecting your own domain does not put your site outside these rules: we still host it, so we are still answerable for it.

Here is the part that explains the rest of this document. Every customer site published on a subdomain sits under one shared parent domain. Your site might betokobunga.maleosites.com and your neighbour'skliniksehat.maleosites.com, but to a regulator, a browser vendor, or an email provider, these are all one domain with one reputation.

That has a hard consequence. If a single site here operates as an online gambling front, an illegal lending operation, or a phishing page, the response is usually not aimed at that one site. Indonesian authorities can block the parent domain. Browser safe-browsing lists can flag the parent domain, so visitors to every site under it see a red warning screen. Email providers can start refusing mail that mentions it. One abusive site can take down hundreds of honest businesses at once, and it can happen within hours, before anyone tells us.

So the strictness is not moral posturing. It is the only way to keep your website reachable. It is also a legal duty: under Government Regulation 71 of 2019, an electronic system operator must remove prohibited content from its systems, and Law 11 of 2008 on Electronic Information and Transactions, as amended, defines much of what is prohibited.

You are responsible for everything on your site, including content added by anyone you give access to, and content you copied from somewhere else. Not knowing that something was illegal does not make it allowed.

2. Content you may not publish

Do not publish, host, link to, or drive traffic to any of the following. The examples are there because these categories are sometimes misread, not because the list is exhaustive.

Online gambling

Gambling in any form is prohibited in Indonesia and is prohibited here without exception. This includes slot sites, sportsbooks and betting exchanges, casino games, private lotteries and togel, card and dice games played for money, and anything described as "gacor", "maxwin", or similar. It also includes sites that do not host the gambling themselves but exist to funnel people to it: landing pages, affiliate or referral pages, review or "recommended site" listings, link pages, and pages hiding a redirect. A business site that quietly carries a gambling link or banner falls under this rule too. This is the single fastest way to get a domain blocked in Indonesia, and it is removed immediately.

Unlicensed lending and debt collection

Do not offer loans, cash advances, or credit unless you hold the licence the activity requires from the Financial Services Authority. Illegal online lending — pinjol ilegal — is prohibited, including sites that collect applicant data on behalf of an unlicensed lender. Predatory collection practices are prohibited: threats, publishing a debtor's photograph or personal data, contacting a debtor's family or employer to shame them, or impersonating a court or the police.

Investment fraud and unlicensed financial offers

No Ponzi schemes, pyramid schemes, money games, or money-doubling ("penggandaan uang"). No promises of fixed or guaranteed returns, no "profit harian" investment programmes, no binary options or copy-trading schemes dressed up as investment. Do not offer securities, funds, or crypto assets to the public without the licence or registration Indonesian law requires. A multi-level marketing site is allowed only if the money comes from selling a real product, not from recruiting.

Phishing, malware, and technical deception

No pages built to harvest credentials, OTP codes, PINs, card numbers, or e-wallet details. No imitation login screens for banks, e-wallets, marketplaces, government services, or any other provider. No distributing malware, spyware, ransomware, or "mod" applications carrying it. No fake virus warnings, fake courier or customs notices, or technical-support scams. No pages that exist to hide the real destination of a link.

Impersonation and fake official notices

Do not present yourself as a person, business, bank, or institution you are not. Do not use another company's name, logo, or branding in a way that suggests you are them or are authorised by them. Do not imitate a government agency, a ministry, the police, a court, or a tax office, and do not publish fake official announcements, fake permits, or fake registration numbers. Parody and criticism are allowed when no reasonable reader would think it is the real thing.

Restricted and illegal goods

Do not sell or advertise counterfeit or replica branded goods; illegal drugs and the equipment for using them; prescription medicines, abortifacients, or medical devices without the distribution licence Indonesian law requires; unregistered supplements and cosmetics that require BPOM registration; firearms, ammunition, explosives, and sharp weapons sold outside the law; protected wildlife, whether alive or as parts, skins, ivory, or scales; stolen goods; forged documents, diplomas, identity cards, or seals; and hacked, stolen, or "premium shared" accounts. If a good needs a permit in Indonesia to be sold, you need that permit.

Sexual content

No pornography, no sexual services, no escort or prostitution advertising, and no sites presenting sexual content as an adult service. Anything involving a minor is reported to the authorities immediately. There is no warning, no grace period, and no appeal for that category. The account is terminated and the material is preserved for law enforcement.

Violence, terrorism, and SARA

Do not incite or glorify violence or terrorism, recruit for or finance a violent organisation, or publish instructions for weapons or attacks. Do not attack or incite hatred against a group or an individual on the basis of religion, race, ethnicity, or belief — what Indonesian law treats as SARA. Do not publish threats against a named person.

Intellectual property

Do not publish work that is not yours to publish. This includes photographs taken from Google, Instagram, or another business's website; stock images used outside their licence; fonts, templates, and designs used without a licence; another company's copy or product descriptions; pirated films, music, books, software, or courses, and links to them; and another business's trademark or logo. Law 28 of 2014 on Copyright applies, and a rights holder can report your site to us directly.

Health and medical claims

People build clinic, pharmacy, herbal, and therapy sites with Maleo Sites, so this deserves its own rule. Do not claim to cure, treat, or prevent a disease without the evidence and the permits that claim requires. Do not promise outcomes ("100% sembuh", "pasti hamil", "turun 10kg dalam seminggu"). Do not discourage people from seeking real medical care, and do not advertise unlicensed practitioners or unregistered treatments. Do not publish patient photographs, testimonies, or records without that patient's consent. Describing a service you genuinely provide, with honest expectations, is fine.

Personal data and private images

Do not publish another person's personal data without a lawful basis under Law 27 of 2022 on Personal Data Protection: identity numbers, addresses, phone numbers, family details, or photographs published to expose or harass someone. No doxxing. No intimate images published without the consent of the person in them, ever. No sharing of leaked databases.

Misinformation presented as news

Do not publish false information deliberately presented as news or as fact, particularly about health, disasters, elections, or public safety, and do not imitate the appearance of a news outlet in order to make it convincing. Publishing your own opinion, clearly as opinion, is not what this rule is about.

3. Conduct and technical abuse

Regardless of what your site says, do not do any of the following.

• Spam. Sending bulk unsolicited email, WhatsApp, or SMS that points to a site hosted here, or publishing a site that exists to support such a campaign.
• Deceptive SEO. Cloaking, hidden text, doorway or gateway pages, keyword stuffing, link schemes and paid link networks, private blog networks, and parasite pages hidden inside an otherwise legitimate site. These practices are also what get a shared domain penalised as a whole.
• Scraping and automated extraction. Harvesting content, contact details, or data from the Service or from other people's sites by automated means.
• Resource abuse. Deliberately consuming bandwidth, storage, or processing far beyond ordinary use of a small-business website, including using your site to serve traffic for another application.
• Cryptocurrency mining of any kind, including scripts that mine in a visitor's browser.
• Proxies and file lockers. Using a site as an open proxy, VPN endpoint, URL shortener for third parties, or as storage for files that have nothing to do with the site.
• Circumventing limits. Working around plan quotas, removing or hiding the free-plan watermark, or splitting one business across multiple accounts to avoid paying for the plan it needs.
• Attacking our systems. Probing, scanning, or penetration-testing the Service without our written permission; attempting to access another customer's account, site, or data; interfering with our infrastructure or with another customer's use of it. Report security findings to abuse@maleosites.com instead.
• Reselling. Reselling, sublicensing, or white-labelling the Service without our written agreement. Building sites for your own clients on their own accounts is fine.
• Automated account creation. Creating accounts by script, or in bulk, or with false identity or contact details.

4. Booking forms and visitor data

If you publish a booking or contact form, visitors give you their name, WhatsApp number, and a message. That is their personal data, and under Law 27 of 2022 you are the party responsible for it. We only store it for you. The split of responsibilities is set out in ourData Processing Agreement.

The rules for forms are short.

• Do not collect sensitive data through a form. No national identity numbers (NIK), no KTP or family card photographs, no payment card numbers, CVVs, or bank credentials, and no health or medical details. If you need a patient's medical information, take it in the consulting room, not through a website form.
• Only ask for what you need, and have a lawful basis for it. A booking form needs a name, a contact number, and a time. It does not need a date of birth.
• Tell visitors what happens to their data, in plain language, on the page where you ask for it.
• Honour visitor requests. If someone asks you to delete their message or correct their details, do it. Requests that reach us about your site's form will be passed to you.
• No unsolicited marketing. A number given to book an appointment was not given to receive promotional broadcasts. Do not add form contacts to a marketing blast, and do not sell, rent, or share the list.

5. Your business information must be true

A website is a commercial offer. Law 8 of 1999 on Consumer Protection and Indonesia's electronic-commerce rules require honest information, and so do we.

• Your site must represent a real business or activity that actually exists.
• Prices must be the prices you actually charge. If there are extra fees, shipping costs, or conditions, say so on the same page.
• Contact details must reach you. An abandoned number or a dead address on a site taking bookings is a consumer-protection problem, not a cosmetic one.
• Do not advertise stock, capacity, licences, certifications, awards, or partnerships you do not have.
• If you take bookings or payments, be clear about what the customer gets, when, and what happens if it is cancelled.

6. What happens when a site breaks these rules

For ordinary breaches we would much rather have the problem fixed than lose a customer. The normal path is a ladder, and most cases stop at the first rung.

Removal without prior notice

Some categories skip the ladder entirely, because the damage is done to everyone else before any conversation could finish. We remove these immediately, without prior notice:

• Child sexual abuse material, which is also reported to the authorities.
• Phishing and credential harvesting.
• Malware distribution.
• Online gambling, including sites that only funnel traffic to it.
• Anything else creating immediate legal exposure for the shared domain, or that puts other customers' sites at risk of being blocked or flagged.

In these cases we may preserve logs, content, and account records as evidence, and we may report the matter and hand that evidence to law enforcement or to the relevant regulator, with or without a formal request. Where the law obliges us to act on an order from Komdigi or another authority, we will comply and tell you afterwards unless we are forbidden from telling you.

We may also take narrower measures where they are enough: disabling a single page, disabling form submissions, disconnecting a custom domain, or restoring the free-plan watermark.

No refund on termination for breach

If your account is suspended or terminated because you broke this policy, no refund is due for the remainder of the paid period. That is the one case where our ordinary refund rules do not apply — see the Refund Policy. Termination does not release you from what you already owe, and it does not limit any other remedy available to us.

7. If you think we got it wrong

We are a small operation and we can make mistakes. If your site was unpublished, suspended, or terminated and you believe it was wrong, write tosupport@maleosites.com from the email address on the account.

Include, so we can look at the actual case rather than ask you three more questions:

1. The site address and the account email.
2. The date of the removal and, if you have it, the message we sent.
3. What you believe we misread, and why.
4. What you have already changed or removed, if anything.

We aim to give you a decision within 5 business days. If the review takes longer than that, we will say so and tell you why. A decision after appeal is final on our side; it does not affect any right you have to take the matter elsewhere.

Appeals are not available for child sexual abuse material. Where a removal followed an order from an authority, the appeal has to be made to that authority — we cannot overturn it.

8. Reporting a site that breaks these rules

If you have found a site hosted by us that is fraudulent, infringing, or otherwise harmful, tell us. Reports are the main way we learn about problems, and a report about a gambling or phishing site helps every other customer here.

Use the instructions on Report Abuse, or write directly toabuse@maleosites.com. Give us the full address of the page, a description of the problem, and — for a copyright or trademark complaint — enough detail to identify the work and your right to it. We do not publish the identity of a reporter to the account being reported, unless the law requires it.

9. We do not review sites in advance

We want to be honest about how this works, because it matters both to you and to what we can be expected to do.

Publishing is automated. When you press publish, your site goes live without a human at our end looking at it. We do not pre-screen sites, we do not read your pages, and we do not have a review team. We act after the fact: on reports sent toabuse@maleosites.com, on notices from our infrastructure providers or from an authority, and on signals such as an unusual traffic pattern or a domain reputation warning.

We reserve the right to review any site at any time, but we do not promise to find every violation, and the absence of action does not mean a site has been approved. Nothing here makes us responsible for what a customer publishes; you are. This is also the ordinary position of an electronic system operator that merely hosts content, and it is why acting quickly once we are told matters so much.

10. Changes to this policy

Rules change when the law changes and when people find new ways to misuse a website builder. We may update this policy. When a change is substantive we will raise the effective date and the version shown at the top of this page, and we will tell account holders by email before it takes effect where the change materially restricts what you may publish. Smaller corrections take effect when published.

Continuing to use the Service after a change takes effect means you accept the updated policy. If you do not, you may close your account; the Refund Policy says what happens to money already paid.

This policy forms part of our Terms of Service. It is governed by the laws of the Republic of Indonesia. Where a term used here is defined in the Terms of Service, it carries the same meaning.