- We only collect what the service needs. Your account, the content you send, and technical logs.
- Your data is never sold, never used to train models, and never shared between accounts.
- Infrastructure and language model providers process data on our behalf under written agreements.
- You can request a copy, a correction, or deletion at any time under Indonesian Law 27/2022.
- Account deletion completes within 30 days, backups included.
Scope and data controller
This policy covers jagahukum.com, the JagaHukum workspace, the installable web app, and the programming interfaces we provide. The data controller is PT Sarana Keadilan Nasional, a company registered at Blok 04 RT 001 RW 004, Kebonturi, Arjawinangun, Kabupaten Cirebon, Jawa Barat 45162, Indonesia.
If you use JagaHukum on behalf of a law firm or company, your firm is the controller of the content it uploads and we act as processor for that content. This policy still applies to your own account data.
Data we collect
Account data
When you sign in with Google we receive your name, email address, and profile picture from your Google account. We never receive your password and cannot see the rest of your Google account.
Content you send
Questions in Legal Chat, documents uploaded to Document Review, drafts in Legal Drafting, figures entered in the Calculator, and results you save. This content is yours. We store it so you can open it again.
Technical logs
IP address, browser type, pages opened, request time, and error codes. Used to keep the service running, detect abuse, and fix bugs.
Billing data
Payments are processed by a third party payment provider. We keep only invoice status, plan, and the last four digits of the payment method. Full card numbers never reach our servers.
What we do not ask for
- National ID numbers or identity documents.
- Biometric data.
- Precise device location.
- Contact lists or other Google account content.
Purposes and legal basis
Every processing activity has a legal basis under Article 20 of Indonesian Law 27/2022 on Personal Data Protection. This table summarises them.
| Data | Purpose | Basis |
|---|---|---|
| Name, email, profile picture | Create and secure your account, contact you about the service | Performance of contract |
| Content you send | Run the feature you asked for and store the result | Performance of contract |
| Technical logs | Security, abuse prevention, bug fixing | Legitimate interest |
| Aggregated usage data | Understand which features are used and improve them | Legitimate interest |
| Analytics cookies | Measure site traffic | Consent, withdrawable at any time |
| Invoice status | Billing and tax obligations | Legal obligation |
What we do not do
- We do not sell or rent your personal data to anyone.
- Content you send is not used to train language models, ours or any provider’s.
- Content from one account never appears in another. The regulation corpus everyone uses consists of public documents, not user content.
- We show no advertising and share nothing with ad networks.
- We do not build automated profiles that produce legal decisions about you.
Third party processors
We rely on the providers below to run the service. Each is bound by a data processing agreement that forbids using your content for their own purposes, including model training.
| Provider | Role | Location |
|---|---|---|
| Sign in with Google and site analytics | United States, European Union | |
| Supabase | Authentication and account database | Singapore |
| Railway | Application servers and the agentic engine | Singapore |
| Cloudflare | Content delivery, attack protection, and site pages | Global, nearest edge |
| Anthropic, Google, OpenAI via OpenRouter, routed only to Zero Data Retention providers, e.g. Google, Amazon Bedrock, Microsoft Azure | Language models that compose answers and drafts, read documents (OCR), and search files | United States |
| Payment provider | Processes paid plan invoices | Indonesia |
If we replace or add a provider that processes user content, this list is updated and the document version increases.
Transfers outside Indonesia
Some providers above process data in Singapore and the United States. These transfers follow Article 56 of Law 27/2022, with written agreements guaranteeing an equivalent level of protection, and only for the purposes named in this document.
Documents you upload are sent to language model providers only as far as needed to answer your request and are not retained there.
Retention and deletion
| Data | Retention |
|---|---|
| Account and saved content | While the account is active |
| Content you delete yourself | Gone from live systems at once, from backups within 30 days |
| Whole account after a deletion request | Completed within 30 days, backups included |
| Technical logs | 90 days, then deleted or aggregated |
| Invoice records | 10 years under bookkeeping obligations |
Account deletion can be requested from Settings or by email. Once deleted, data cannot be restored.
Security
- All traffic is encrypted in transit with TLS.
- The database enforces row level access policies, so one account technically cannot read another’s content.
- Staff access to production data is restricted, logged, and used only to resolve incidents.
- Service keys live in the provider’s secret vault, not in code.
- If a breach involves your personal data, we notify you and the authority within 3 x 24 hours as required by Article 46 of Law 27/2022.
Your rights as a data subject
Under Law 27/2022 you have the rights below. Submit a request from Settings or by email. We respond within seven working days at no charge.
- Receive a copy of your personal data in a machine readable format.
- Correct inaccurate data.
- Delete data or your whole account.
- Withdraw consent for processing based on consent.
- Object to specific processing.
- Complain to the personal data protection authority if our response is unsatisfactory.
Minors
JagaHukum is intended for users aged 18 and over. We do not knowingly collect data from children. If you learn that a child has created an account, tell us and we will delete it.
Changes to this policy
Material changes are announced by email and in the workspace at least 30 days before they take effect. The version number and dates at the top of this document always identify the text in force.
Questions about this document, data subject requests, or problem reports can be sent to the address below. We reply within seven working days.
- Registered office
- PT Sarana Keadilan Nasional
Blok 04 RT 001 RW 004, Kebonturi, Arjawinangun, Kabupaten Cirebon, Jawa Barat 45162
The Indonesian text is the binding version. Other languages are provided as convenience translations.