1 · Short summary
The details are below, but this is the part that matters most:
Conversation content and documents you upload are forwarded to third-party model providers outside Indonesia for processing. That is unavoidable for a service like this, and it is stated up front.
There is no admin interface for reading your conversation contents, and no feature for logging in as another user.
Deleting a conversation is permanent. Conversations idle for 30 days are deleted automatically, unless pinned.
Data is not sold and not used for advertising. The only cookies are the session cookie and your language preference.
2 · Who runs this
The data controller for this service is digi4our; privacy questions are answered directly by the operator at support@digi4our.net.
This policy covers the app (Chat, Assistants, Notebook), the admin panel, and this public page. Accounts may be created by self-registration while sign-up is open, or set up by an admin while it is closed.
3 · Data processed
Only the data the service needs in order to work:
- Account
- Email, username, hashed password, 2FA settings, language preference, and the list of active sessions. If you sign in with Google (OIDC), Google is used only as a login method — your account still lives in this system.
- Content you create
- Conversation contents, documents uploaded to Notebook together with their passages and embeddings, chat attachments, and the Assistant configurations you write.
- Usage records
- Token counts, model used, and computed cost — without conversation contents. This is what the credit system is based on.
- Technical logs
- IP address, request time, browser type, and errors — for security and troubleshooting.
The files are stored on infrastructure outside Indonesia.
4 · Basis for processing
Under Indonesian Law No. 27/2022 on Personal Data Protection, processing rests on: performing the service you asked for (conversations, documents, credit), meeting bookkeeping obligations (usage records), and a limited legitimate interest in system security (technical logs).
Anything beyond that — for example opening a specific conversation to follow up a problem report — rests on your consent, asked case by case, and you can refuse.
5 · Third parties & transfers out of Indonesia
Each model provider’s own retention terms apply to them. The list of active models and providers is visible inside the app and changes as models are added or retired.
6 · What is not done
This section is deliberately specific, because these are the claims you can check:
There is no admin interface for reading user conversation contents. The admin panel handles accounts, quotas, models, and usage figures.
There is no feature for logging in as another user.
Data is not sold, not traded, and not used for advertising or marketing profiling.
Your conversation contents are not used by us to train any model.
If following up a problem report requires looking at conversation content, that happens only after you agree to it.
7 · Retention & deletion
Deleting a conversation is permanent: no trash bin, no undo, and related files are removed from storage too. Conversations idle for 30 days are deleted automatically by the system; pinning a conversation exempts it from that automatic deletion.
Usage records — token counts and cost, without conversation contents — are kept even after the conversation is deleted, because they are the basis of credit accounting and bookkeeping.
One honest note: deleted data can still sit in a daily backup until that backup expires, at most 30 days. Backups are not used to restore conversations you deleted.
8 · Your rights
Some of these you can do yourself inside the app, without asking anyone:
Download all of your data at any time.
Delete conversations at any time, permanently.
Change your password, enable 2FA, and view and end active sessions.
Beyond that, under the PDP Law you may request access, correction, restriction, or deletion of your account and everything in it, and withdraw consent. Send requests to support@digi4our.net; answered within a reasonable time, usually under 14 days.
9 · Security
Passwords are stored hashed, connections are encrypted, session cookies are HttpOnly, 2FA is available to every account. Sessions last 30 days and you can end them yourself.
This service is run by one person, not a security team. No system is immune; if an incident touches your data, you will be told, together with what is known at the time.
11 · Changes & contact
If this policy changes, the effective date and a summary of the change are recorded at the top of the document. Changes with significant impact are announced inside the app before they take effect.
Privacy questions, data requests, or objections: support@digi4our.net.