# Privacy Policy | Linuxteknosia Cloud _Effective from 22 October 2026._ This Privacy Policy explains how **CV Mitratechnosia Intra Solusi** ("Linuxteknosia Cloud", "we") collects, uses, discloses, stores, and protects personal data when you visit our website, sign up for an account, or use our S3-compatible object storage, database backup, API, and MCP server services (together, the "Services"). It is prepared with reference to Indonesian Law No. 27 of 2022 on Personal Data Protection (the "PDP Law") and its implementing regulations. ## 1\. Our role - For account, billing, and website usage data, we act as the **personal data controller**. - For data you store in object storage buckets and the contents of database backups ("Customer Content"), we act as a **personal data processor** on your behalf. You remain the controller of Customer Content and are responsible for its lawful basis. ## 2\. Data we collect **Data you provide** - Account data: name, email address, organization name, and password (stored only as a bcrypt hash). - Contact form data: email, company name, use case, estimated capacity, and message. - Billing data: plan, transaction amount, and payment status. Payments are processed by Duitku; we neither receive nor store your card numbers or banking credentials. **Data generated when you use the Services** - Technical data of servers connected through the agent: hostname, operating system, architecture, agent version, heartbeat time, and IP address. - Backup metadata: job name, schedule, size, checksum, duration, status, and execution logs. - Storage metadata: bucket names, quotas, usage, bucket settings, and access keys (secret keys are shown once and are not stored in readable form). - API tokens are stored as hashes; the original value is shown only once at creation. - Access and security logs: IP address, browser type, time, and endpoint accessed. **Database credentials.** Database connection passwords are sent to the agent on your server over an encrypted channel and stored encrypted on that server. Our control plane does not store your database connection passwords. **Google Drive (optional).** If you connect Google Drive as a backup destination, we request the `drive.file` scope so the app can only access files it creates. Access tokens are stored encrypted and used only to upload, download, and delete your backup files. Use of data received from Google complies with the Google API Services User Data Policy, including the Limited Use requirements. ## 3\. Cookies and similar technologies Cookie Purpose Duration `__Host-lt_session`, `__Host-lt_admin_session` Keep you signed in to the dashboard Until sign-out or session expiry `lt_lang` Remember your language choice 1 year `lt_geo` Remember the country check from your IP address used to choose the language 7 days `lt_theme`, `lt_sidebar` Remember dashboard display preferences 1 year `_ga`, `_ga_*` Website visit statistics (Google Analytics) Per Google's terms, up to 2 years The country check only matches your IP address against a list of Indonesian public IP ranges to choose the display language; the result is not stored outside the cookie in your browser. You can delete or block cookies in your browser settings, but session cookies are required for the dashboard to work. ## 4\. Purposes and legal bases Purpose Legal basis Creating and managing accounts, providing the Services, running backups and restores Performance of a contract Invoicing, payments, and tax records Performance of a contract and legal obligation Sending service notifications (failed backups, servers down, invoices) Performance of a contract Security, abuse prevention, and auditing Legitimate interest and legal obligation Responding to enquiries via the contact form Your consent Website statistics to improve the Services Legitimate interest or consent, as applicable We do not sell your personal data and do not use Customer Content for any purpose other than providing the Services. ## 5\. Third parties that process data We share data only with parties that help us provide the Services, under equivalent confidentiality and security obligations: - **Duitku**: payment processing. - **Google**: Google Analytics for website statistics, and Google Drive if you enable it. - **Data center and infrastructure providers** where the Services run. - **Email delivery providers** for service notifications. - **Competent authorities**, where required by law or court order. Some of these providers may process data outside Indonesia. In such cases, we ensure the transfer complies with the cross-border transfer provisions of the PDP Law. ## 6\. Retention - Account data is kept while your account is active. - After an account is closed or a subscription ends, Customer Content is deleted as described in the Terms of Service; account data is deleted or anonymized within a reasonable period unless needed to meet legal obligations. - Transaction and billing records are kept for the period required by tax regulations. - Backup artifacts are kept according to the retention settings you define for each job. - Security logs are kept for a limited period for investigation and audit purposes. ## 7\. Security We apply reasonable technical and organizational measures, including TLS encryption in transit, bcrypt password hashing, encryption of application secrets at rest, per-organization access separation, platform admin accounts separate from customer accounts, and optional backup encryption on your server before upload with a passphrase only you know. We cannot recover encrypted backups if the passphrase is lost. In the event of a personal data protection failure, we will notify you and the relevant authority as required by the PDP Law. ## 8\. Your rights Under the PDP Law, you have the right to: - obtain information about the processing of your personal data; - access and obtain a copy of your personal data; - correct inaccurate data; - request deletion or destruction of personal data; - withdraw consent you have given; - restrict or suspend processing, and object to certain processing; - obtain and use your personal data in a commonly used format. Most account data can be changed directly in the dashboard. For other requests, contact us using the details below. We may ask you to verify your identity before processing a request and will respond within the period required by law. ## 9\. Children The Services are intended for businesses and adult users. We do not knowingly collect personal data from children. ## 10\. Changes to this policy We may update this Privacy Policy. Material changes will be announced on the website or by email before they take effect. The effective date at the top of this page shows the latest version. ## 11\. Contact CV Mitratechnosia Intra Solusi Email: [halo@linuxteknosia.cloud](mailto:halo@linuxteknosia.cloud) See also the [Terms of Service](/en/terms).