Privacy Policy
This policy explains which personal data we process when you use kolabaja.com, scan reports, the dashboard and the Kolabaja pixel: why we process it, for how long, and how to exercise your rights. It follows Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP).
In short
- No tracking cookies and no ads. Our visitor statistics are anonymous: IP addresses are used briefly in memory and never stored.
- Data you type yourself (pilot form, class sign-up) is only used to contact you and follow up, and is deleted no later than 24 months after the last interaction.
- We do not sell personal data.
- Questions or requests about your data: [email protected].
1. Who we are
The data controller for kolabaja.com is Kolabaja, based in Jakarta, Indonesia ("we"). Contact for all personal data matters, including our data protection officer: [email protected].
2. What we process, why, and on what legal basis
a. When you visit kolabaja.com
Our own pixel records visit statistics: pages opened, referring site, campaign source (such as utm_source), device type, operating system and browser, country (from Cloudflare), time on page, scroll depth, and which call-to-action buttons or links were clicked. To count unique visitors we derive a random code from the IP address and user agent with a key that changes every day and is then deleted. IP addresses are not stored, and yesterday's codes can no longer be linked to anyone.
Purpose: measuring and improving the site. Legal basis: legitimate interest (Article 20(2)(f) UU PDP).
b. When you use the free Scan
We store the address of the site you scan, its score, the language and where you came from. We do not store your IP address; it is used only briefly to limit the number of scans. Public content from the scanned site (title, description, headings and an excerpt of the page text) is sent to Google PageSpeed Insights to measure speed and to Anthropic (Claude) for the AI analysis. Reports are stored and can be opened by anyone who has the link; links are random and not indexed by search engines.
Scan public pages only. Do not scan pages that contain personal data or confidential information. Legal basis: fulfilling your request (Article 20(2)(b)) and legitimate interest.
c. When you fill in the pilot form
Name, company and product, work email or WhatsApp number, the goal you write, language and visit source. Purpose: contacting you and assessing whether our programme fits. Legal basis: your consent when submitting and steps prior to a contract at your request (Article 20(2)(a) and (b)).
d. When you sign up for a class or programme we run
On our class pages (such as satuorang.kolabaja.com, endmarketing.kolabaja.com, sisisebelah.kolabaja.com) we store your name, WhatsApp number, form answers, device, country and visit source (for example the ad campaign you clicked). Where a form offers an AI recommendation, your name and answers (not your WhatsApp number) are sent to Anthropic to write it. Purpose: following up on your sign-up and measuring campaigns. Legal basis: consent and steps prior to a contract.
e. When you use the dashboard
Username, name, role, the sites you can access, and your password stored as a hash (scrypt), never in plain form. When you sign in we set one strictly necessary session cookie (pt_session, valid for 12 hours and at most 7 days). Legal basis: performing our agreement with you.
f. Visitors of client sites that install the Kolabaja pixel
When a company installs the Kolabaja pixel on its site, that company is the controller for its visitors' data and we process it on its behalf as a processor under section 6 of the Terms. The data is the same as in (a): anonymous statistics without cookies and without storing IPs, plus any form data that site sends. For questions about data on such a site, contact the site owner; we will help them answer.
3. Cookies and browser storage
We use no advertising or tracking cookies, so there is no cookie consent banner. The only cookie is pt_session for signed-in dashboard users, which is required for sign-in to work. The pixel stores one value in localStorage (pt_ignore) only when our own team switches off counting in their browser.
4. Other parties that process data
We use the following providers, each only for the stated purpose:
- Cloudflare: content delivery, DNS and security. All traffic passes through Cloudflare, including IP addresses.
- Tencent Cloud: the servers that host the application and data.
- Anthropic: AI analysis for scan reports and recommendations in class forms.
- Google: PageSpeed Insights to measure the speed of scanned sites (only the site address is sent).
- Fontshare: web fonts; your browser downloads them directly from their servers, so they see your IP address.
Some of these providers process data outside Indonesia, for example in the United States or Singapore. We only use providers that offer data protection equal to or higher than UU PDP and are bound by data processing agreements, in line with Article 56 UU PDP. We do not sell or rent personal data, and only disclose it to authorities when required by law.
5. How long we keep data
- Visit statistics: kept as aggregate numbers. Daily visitor codes become anonymous once that day's key is deleted.
- Pilot form and class sign-ups: at most 24 months after the last interaction, or sooner if you ask us to delete them.
- Scan history: the latest 3,000 scans. Scan reports: the latest 5,000 reports; older ones are deleted automatically.
- Sign-in sessions: at most 7 days. Dashboard accounts: while your account is active.
- Technical server logs: kept briefly for security and rotated automatically.
6. Your rights
Under Articles 5 to 13 UU PDP you have the right to:
- be informed about the processing of your data, and to access and obtain a copy of it;
- correct inaccurate or incomplete data;
- have your data deleted or destroyed;
- withdraw consent you have given;
- object to decisions based solely on automated processing that significantly affect you;
- suspend or restrict processing;
- obtain and transfer your data in a commonly used format;
- file complaints and claim compensation for violations in the processing of your personal data.
Send your request to [email protected] from the email address or number you used when submitting data. We respond within the time limits of UU PDP, generally no later than 3 x 24 hours after receiving a complete request. You may also complain to the personal data protection authority designated by the government.
7. Security and incidents
Data is sent over HTTPS and stored on servers with access limited to authorised team members. Passwords are hashed, and dashboard clients only see their own sites, without lead personal data. If a personal data protection failure occurs, we notify you and the relevant authority in writing no later than 3 x 24 hours, in line with Article 46 UU PDP.
8. Children
Kolabaja is intended for businesses and adults. Class sign-ups for children are made by parents or guardians, and we only process children's data with their consent.
9. Changes to this policy
When this policy changes we update the date above. For material changes we notify dashboard users and, where needed, ask for consent again.
10. Contact
Kolabaja · Jakarta, Indonesia · [email protected]