Privacy Policy

1. INTRODUCTION

This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have. We process personal data under Law No. 27 of 2022 on Personal Data Protection (UU PDP). By using our service, you agree to the practices described on this page.

2. INFORMATION WE COLLECT

We only collect the data needed to run the service:

• Account data: username, email address, and password. Passwords are stored as bcrypt hashes and are never kept in plain text.
• Optional profile data: first and last name, which you provide yourself and we use for billing and communication.
• Third-party login data: if you sign in with Google, Discord, or GitHub, we receive the provider user ID, email address, username, and avatar URL. We never receive your password for that provider.
• Session and security data: IP address, browser User-Agent, and login and session activity timestamps. We use this to secure your account and detect suspicious access.
• Billing data: order history, amounts, payment status, payment method, transaction references, and wallet credit balance.
• Server data: server activity logs (who did what, when) and file operation records. Console command contents are not stored.

3. WHAT WE DO NOT COLLECT

We never ask for or store your card number, PIN, OTP, or banking credentials. We also do not use advertising or behavioral tracking cookies for marketing purposes.

4. PAYMENTS AND OUR PAYMENT LINK PROVIDER

Payments are processed through Pakasir, a payment link service operated by PT. Geksa. Pakasir is a stateless payment link provider: it issues a QRIS code or Virtual Account number along with the amount, and the funds are processed by an official Payment Gateway licensed by Bank Indonesia. We only send the order ID and transaction amount to Pakasir. We do not send your name, email address, or other personal data to Pakasir. Data such as the first name, last name, and email you enter for billing is stored in our own database, not in Pakasir. Pakasir has its own privacy policy and terms of service that govern processing on their side.

5. HOW WE USE YOUR INFORMATION

We use the data we collect to:

• Create and manage your account
• Provide, operate, and maintain your servers and hosting services
• Process payments and billing
• Send service-related notifications, such as email verification, billing reminders, and outage notices
• Respond to support requests and tickets
• Keep the service secure, prevent abuse, and enforce our terms of service
• Improve the quality and reliability of our services

6. DATA SHARING

We do not sell or rent your personal data. We only share data with parties required to operate the service:

• Pakasir (PT. Geksa): receives the order ID and amount to issue a payment link. It does not receive your name or email.
• Resend: our transactional email provider, which receives your email address to deliver verification and service notifications.
• Third-party login providers (Google, Discord, GitHub): only involved when you choose to sign in through those accounts.
• Cloudflare Turnstile: when enabled, verifies requests to prevent bots and receives your IP address.
• Google Fonts and YouTube: our public pages load fonts from Google Fonts and may display YouTube videos. Both can receive your IP address when the page loads.
• Server infrastructure providers: supply the compute capacity where your server and data run.

7. COOKIES AND LOCAL STORAGE

We use essential cookies to manage login sessions and security tokens. We also use browser local storage to remember interface preferences, such as sidebar width and file view mode. We do not use tracking or advertising cookies. You can clear cookies and local storage at any time through your browser settings, with the consequence that you will be signed out of any active session.

8. DATA RETENTION

We retain account data for as long as your account is active. Server activity logs are kept for a maximum of 30 days before automatic deletion. After account deletion, your personal data is removed within 30 days, unless we are required by law to retain it longer, for example for accounting and tax purposes. To request account deletion, contact us at contact@esempe.id.

9. DATA SECURITY

We apply reasonable technical measures to protect your data, including bcrypt password hashing, hashed token storage, encrypted storage credentials, and restricted database access. However, no method of transmitting data over the internet is completely secure. We cannot guarantee absolute security.

10. YOUR RIGHTS

As a data subject, you have the right to:

• Receive information about our identity, the legal basis, and the purposes of processing your data
• Access and obtain a copy of the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Withdraw your consent to processing at any time
• Object to certain processing activities
• Request transfer of your personal data to another controller where our systems allow

11. CHILDREN'S PRIVACY

Our services are intended for users aged 13 and above. We do not knowingly collect personal data from children under 13. If you become aware that a child under 13 has provided us with personal data, contact us so we can delete it.

12. CHANGES TO THIS POLICY

We may update this policy from time to time. We will notify you of material changes via email or a panel notification. The latest version is always available on this page. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

13. CONTACT

For privacy questions, data access requests, or complaints, contact us at contact@esempe.id or +62 851-8554-7060. We will respond within a reasonable period in accordance with UU PDP.