PT Tautly Digital Indonesia ("Tautly", "we") values your privacy. This policy explains what data we collect, how we use it, and your rights under Law No. 27 of 2022 on Personal Data Protection (UU PDP).

1. Data We Collect

Account data: name, email, password (hashed), profile photo.
Billing data: billing name, address, and transaction history. Card details are never stored by us — they are processed directly by Midtrans, which is PCI-DSS certified.
Usage data: the links you create, activity logs, IP address, user agent.
Link visitor analytics: country, city, device type, browser, referrer. Visitor IPs are hashed before storage to protect their privacy.
Cookies: essential cookies for login sessions and preferences. We do not use third-party advertising cookies in the dashboard.

2. How We Use Data

To provide and improve the Service.
To process payments and issue invoices.
To send product, billing, and transactional emails.
To detect and prevent fraud, phishing, and legal violations.
To meet legal obligations.

3. Legal Basis for Processing

We process personal data based on your consent, performance of a contract (the Terms of Service), our legitimate interests, and/or legal requirements.

4. Sharing Data with Third Parties

We do not sell your personal data. We share data only as necessary with:

Midtrans — payment processing.
Infrastructure providers (cloud and email) bound by confidentiality agreements.
Law enforcement — where required under a valid legal order.

5. Storage & Security

Data is stored in data centres with encryption at rest (AES-256) and in transit (TLS 1.2+). Internal access is role-restricted and recorded in an audit log. We support 2FA (TOTP) for user accounts.

6. Data Retention

Account data is retained while the account is active. After an account is deleted, data is permanently removed within 30 days, except data we must keep for tax or legal compliance.

7. Your Rights as a Data Subject

Under the UU PDP you have the right to access your personal data, correct inaccurate data, request erasure, restrict or object to processing, request data portability, and lodge a complaint with the authorities. Send requests to privacy@tautly.to; we respond within 30 days.

8. Children

The Service is not intended for children under 17. We do not knowingly collect children's data. If you become aware of such data, please contact us for removal.

9. Cross-Border Data Transfers

Some of our infrastructure providers are located outside Indonesia. Transfers are carried out with equivalent safeguards and in line with the UU PDP.

10. Changes to This Policy

Material changes will be announced 14 days in advance by email or via an in-app notification.

11. Contact the DPO

Data Protection Officer: privacy@tautly.to — PT Tautly Digital Indonesia, Jl. Sudirman Kav. 52-53, South Jakarta 12190.

Privacy Policy