In short
- We collect what Planora needs to work: your account, what your team writes in it, and billing details when you pay.
- We don't sell your data, show ads or use tracking cookies.
- Card and e-wallet details go to Xendit or Paddle, never to us.
- You can see, correct, export or delete your data. Write to [email protected].
Who is responsible for your data
PT OCTARA ARTHA DIGITAL, Cluster Lausanne Park - Lebrassus, Desa/Kelurahan Mekar Bakti, Kec. Panongan, Kab. Tangerang, Provinsi Banten, is the controller of the personal data processed in Planora, as meant by Indonesia's Personal Data Protection Law (UU No. 27 of 2022). For anything about your data, email [email protected].
What we collect
- Account: your name, email address, password (stored only as a one-way hash, never in readable form), preferred language, and whether your email is confirmed.
- Sign-in with Google or GitHub (if you choose it): from that service we receive your name, email address, whether the service has confirmed it, and your account ID there. We don't store your profile photo or the access keys the service issues, and Planora can't read or post anything in your Google or GitHub account.
- Sign-in sessions: the IP address and browser of each signed-in session, to keep you signed in and spot misuse.
- Abuse protection and error records: to stop automated attacks, we count recent requests per IP address (and, for sign-in and password emails, per email address). The counters hold only a scrambled, one-way code of the address, never the address itself. When something breaks, we record technical details of the error (what failed, where in the code, which page or feature) with names, email addresses, passwords and other personal data removed.
- Workspace content: workspace and project names and images, tasks, descriptions, due dates, assignees, and the email addresses of people invited. Images are shrunk in your browser before upload, which also removes their location data.
- Billing: the billing name, email, address and tax ID (NPWP) you enter at checkout, and a record of each payment (amount, period, status, invoice number). We don't receive or store card numbers or e-wallet credentials.
- Messages: what you write to us, for example a support or refund request.
Why we use it, and on what basis
- To provide Planora: your account, workspaces, invitations, and the emails the Service sends (confirmations, invitations, receipts, reminders). Basis: performing our agreement with you.
- To take payments, issue invoices and keep financial records. Basis: our agreement, and our legal obligations under tax law.
- To keep Planora secure, prevent fraud and abuse, and fix problems. Basis: our legitimate interest in a safe, working service.
- To answer your messages and requests. Basis: our agreement, or your request.
How long we keep it
- Account data: while your account exists. When it is deleted, your personal data is deleted with it.
- Workspace content: until the owner deletes the workspace (or the item). Deleting a workspace deletes its projects, tasks and files.
- Payment records and invoices: 10 years, as Indonesian tax law requires, even after a workspace or account is deleted.
- Backups that may still contain deleted data are overwritten within 30 days.
- Request counters for abuse protection: deleted within 2 days after their time window ends. Error records and server logs: kept by our hosting and error-monitoring providers for a limited period, then deleted automatically.
Your rights
Under UU PDP you can ask us to:
- tell you what data we hold about you and how we use it, and give you a copy;
- correct or update data that is wrong or incomplete;
- delete your data, or stop or limit processing it;
- withdraw consent you have given;
- send your data to you in a commonly used format, so you can take it elsewhere.
Email [email protected] from the address on your account. We reply within the time UU PDP sets (for access, correction and limiting processing: 3 × 24 hours). Some data we must keep by law (such as invoices), and data a workspace owner controls (such as tasks you wrote in their workspace) may need their action too. You may also complain to the personal data protection authority.
Security
Connections to Planora are encrypted, passwords and invitation links are stored only as hashes, and every request checks that you belong to the workspace you are opening. Inside our team, only the people who run Planora can see account and billing data, through an internal tool, and only for support, billing and security; every change they make there is recorded with its reason. They see how many projects and tasks a workspace has, not what is written in them. If a breach of personal data happens, we will tell the people affected and the authority in writing within 3 × 24 hours, as UU PDP requires.
Children
Planora is not meant for anyone under 18, and we don't knowingly collect their data.
Changes
When this policy changes, we update the date at the top of the page. For important changes we also email account holders before they apply. See also our Terms of Service.