Privacy Policy · Jago Code

This Privacy Policy explains how PT Jago Code Digital ("Jago Code", "we", "us") handles personal data when you visit jagocode.id, contact us, commission software from us, or use a product we build and run. We process personal data in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022, the "PDP Law") and, where they apply to you, the data protection laws of the country you live in.

1. Who we are

Jago Code is the trading name of PT Jago Code Digital, a software company based in Jombang, East Java, Indonesia. We design, build and run our own software products, and we build software for clients. Under the PDP Law, PT Jago Code Digital is the personal data controller for the processing described in this policy, except where section 2 says otherwise.

You can reach us about anything in this policy at help@jagocode.id.

2. What this policy covers

This policy applies to:

The website: jagocode.id and any page that links to this policy.
Enquiries and commissions: messages, briefs and calls with us, including the commission form on our website.
Client projects: the software design, development, hosting and maintenance work we do for clients.
Our products: each product we run, such as SendKuy, has its own privacy policy (for SendKuy, see sendkuy.com/kebijakan-privasi). Where a product's policy covers a topic, it prevails for that product; this policy covers anything it does not.

When we build or run software for a client, the client decides why and how its users' personal data is processed. The client is then the controller and we act as its processor: we process that data only on the client's documented instructions, under the project agreement. If your data is in a client's product, please contact that client first; we will help them answer you.

3. Personal data we collect

Data you give us: your email address, your name if you share it, your project brief, and anything else you include when you use the commission form, email us or talk to us. Clients also give us billing details, such as company name, address and tax number, and the contact details of the people we work with.
Project materials and access: content, files, designs, and access to accounts or systems (such as hosting, domain, app store or API accounts) that a client shares so we can do the agreed work.
Account data in our products: name, email address, password (stored only as a hash), team and plan details, and billing history. Card and e-wallet details are handled by the payment provider; we do not store full card numbers.
Data from accounts you connect: if you connect a third-party account, such as Google, Meta, TikTok or X, to one of our products, we receive the data described in section 5.
Technical data: IP address, browser and device type, pages requested, referring page and timestamps, recorded in server and security logs when you use our website or products.

We do not ask for specific personal data as defined in the PDP Law, such as health, biometric, genetic or criminal record data, through our website. If a client project needs it, we only process it under written terms agreed with the client.

4. Why we use it and our legal basis

We only use personal data for a stated purpose and on one of the legal bases in Article 20 of the PDP Law:

To answer enquiries and prepare proposals, because you asked us to (steps before a contract) and in our legitimate interest in responding to business enquiries.
To deliver client projects and run our products, including support, because it is necessary to perform our contract with you or your organisation.
To invoice, keep accounts and meet our tax and legal obligations, because the law requires it.
To keep our services secure, including detecting abuse, fraud and attacks and fixing errors, in our legitimate interest and yours.
To improve our website and products, using aggregated or de-identified usage information, in our legitimate interest.
To send news about our products and services, only with your consent. Every such email has an unsubscribe link.

Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, including profiling.

5. Data from Google and other connected platforms

Some of our products let you connect accounts on other platforms, for example to sign in with Google or to publish content to social media on your behalf. When you do:

We only receive the data covered by the permissions (scopes) you approve on that platform's consent screen. Depending on the features you use, this can include your basic profile (name, email address and profile picture), the pages, channels or accounts you choose to connect, the content you ask us to publish, and performance data about that content.
We use that data only to provide and improve the features you can see and have asked for, such as signing you in, showing your connected accounts, publishing or scheduling the content you create, and reporting its results.
Access tokens are encrypted at rest and used only by the systems that need them.
We do not sell this data, transfer it to data brokers or information resellers, or use it for advertising, including personalised, retargeted or interest-based advertising.
We do not use it to develop, improve or train generalised artificial intelligence or machine learning models.
Our staff do not read it unless you give us permission for specific data (for example, in a support request), it is needed for security purposes such as investigating abuse, it is required by law, or it has been aggregated and anonymised for internal operations.

Jago Code's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We also follow the developer terms of every other platform you connect, such as the Meta Platform Terms, the TikTok developer terms and the X Developer Policy.

You can disconnect an account at any time from the product's settings, or revoke our access at the platform itself, for example in your Google Account permissions or in Facebook under Settings & privacy > Settings > Apps and websites. When an account is disconnected, we delete its access tokens and stop accessing it, and we delete the data we received from it within 30 days, except content you have chosen to keep in the product and records the law requires us to keep.

6. Cookies and similar technologies

jagocode.id does not use advertising or analytics cookies and does not track you across other websites. Our hosting provider may process strictly necessary technical data, such as security and load-balancing signals, to deliver the site. Our products use cookies and local storage to keep you signed in and remember your settings; each product's privacy policy describes the ones it uses. If we ever add optional cookies to this website, we will update this policy and ask for your consent first where the law requires it.

7. Who we share personal data with

We do not sell personal data. We share it only with:

Service providers that host, deliver and support our website and products, under contracts that limit their use of the data to the services they provide us. For this website, they include Vercel (hosting), Sanity (content and image delivery) and Formspree (delivery of the commission form). Each product's privacy policy lists the providers it uses, such as payment, messaging and AI providers.
Clients, when we act as their processor, and anyone you ask us to share your data with.
Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
Authorities, when Indonesian law or a valid legal order requires it, or when it is needed to protect the rights, safety or property of our users, the public or us.
A successor business, if we are involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy.

8. International transfers

Some of our service providers store or process data outside Indonesia, for example in Singapore, the United States or the European Union. Before we transfer personal data abroad, we make sure, as Article 56 of the PDP Law requires, that the receiving country offers protection at least equal to the PDP Law, or that adequate and binding safeguards are in place, such as contractual commitments. Where neither is possible, we ask for your consent.

9. How long we keep it

Enquiries that do not become a project: up to 24 months after our last contact.
Project access and credentials: access to client systems is removed or handed back, and credentials we stored are deleted, within 30 days after the project or maintenance period ends, unless the client asks us in writing to keep them.
Contracts, invoices and accounting records: 10 years, as required by Indonesian tax and company document laws.
Product accounts: for as long as the account is active, then as described in that product's privacy policy.
Server and security logs: for a limited period, generally no more than 90 days, unless they are needed to investigate an incident.

When a period ends, we delete or anonymise the data. Copies in backups are removed as the backups are overwritten on their normal cycle.

10. How we protect it

We use technical and organisational measures that fit the risk, including:

Encryption in transit (HTTPS) on our website and products.
Passwords stored only as hashes, and access tokens and credentials encrypted at rest.
Least-privilege access, two-factor authentication on internal accounts, and removal of access when someone leaves a project.
Regular backups and timely security updates.
Confidentiality obligations for everyone who works with us.

No system is completely secure. If a failure of personal data protection occurs, we will notify the affected people and the relevant authority in writing within 3 × 24 hours, as Article 46 of the PDP Law requires, explaining what data was affected, when and how it happened, and what we are doing to contain it and recover.

11. Your rights

Under the PDP Law, you have the right to:

Be told who is processing your data, why, and on what legal basis.
Access your personal data and get a copy of it.
Correct or update data that is inaccurate or incomplete.
Ask us to stop processing, delete or destroy your data.
Withdraw consent you have given.
Object to decisions based solely on automated processing, including profiling, that have legal or significant effects on you.
Ask us to delay or restrict processing.
Receive your data in a structured, commonly used, machine-readable format, and have it sent to another controller.
Bring a claim and receive compensation if your data is processed in breach of the law.

If you live outside Indonesia, for example in the European Union or the United Kingdom, you may have similar rights under your local law, and we will honour them.

To use any of these rights, email help@jagocode.id from the address linked to your data, with the subject "Privacy request". We may ask you to verify your identity. Requests are free, and we respond within the time limits set by law, which under the PDP Law can be as short as 3 × 24 hours. Some rights have legal exceptions, for example where we must keep records by law. If you are not satisfied with our answer, you can complain to the Indonesian personal data protection authority or to the data protection regulator where you live.

12. How to delete your data

You can ask us to delete your data at any time:

In a product: delete your account in the product's settings, or disconnect individual connected accounts as described in section 5.
By email: write to help@jagocode.id with the subject "Data deletion request", naming the product or service and the email address or connected account involved.

We confirm your request, delete the data within 30 days, and tell you when it is done. We may keep data the law requires us to retain, such as invoices.

13. Children

Our website and services are meant for adults and businesses. They are not directed to children, meaning anyone under 18 under Indonesian law, and we do not knowingly collect their personal data. If you believe a child has given us personal data without the consent of a parent or guardian, contact us and we will delete it.

14. Links to other websites

Our website and products link to sites and services we do not operate. Their own privacy policies apply, and we are not responsible for their practices.

15. Changes to this policy

We may update this policy as our services, our products or the law change. The date at the top shows when it last changed. If a change materially affects how we use your personal data, we will tell account holders and active clients by email or in the product before it takes effect.

16. Contact

PT Jago Code Digital, Jombang, East Java, Indonesia. Email: help@jagocode.id. Please write "Privacy" in the subject line so your message reaches the person responsible for data protection.