Privacy Policy

1. Who we are

PT. Konsultan Inovasi Digital ("we", "us", or "our") is the data controller for the personal data processed through the Nexum Ventora service. Our registered office is in Indonesia.

2. What data we collect

We collect and process the following categories of personal data:

• Account data: email address, display name, and securely hashed password.
• Site data: domain names you register for monitoring.
• Visitor analytics and device data: a pseudonymous browser fingerprint and signals derived from canvas, audio capability, WebGL vendor/renderer, installed-font count, screen characteristics, timezone, language, browser and operating-system versions, device type, CPU cores, and device memory.
• Network and navigation data: IP-derived country and VPN/proxy indicators, page URL, referrer, traffic source, user agent, and visit time. Depending on context and applicable law, fingerprints and these signals may constitute personal data.
• Usage data: timestamps of dashboard access and feature usage.
• Support data: messages you send to our support team.

3. How we use your data

We use your personal data for the following purposes and legal bases:

• Account creation and service provision — to register your account, authenticate you, and provide the Nexum Ventora analytics dashboard. Legal basis: contract performance.
• Visitor analytics and bot detection — the Nexum Ventora tracker starts this processing only after the visitor accepts its notice or a customer consent manager passes an explicit consent signal. Customers must determine and document the appropriate lawful basis for their deployment.
• Security and fraud prevention — to detect suspicious activity and protect sites and accounts. The applicable lawful basis can vary by jurisdiction and use.
• Customer support — to respond to your inquiries and resolve issues. Legal basis: contract performance.
• Marketing — only if you explicitly opt in. Legal basis: consent.

4. Fingerprinting consent and customer responsibilities

Device fingerprinting is not treated as exempt merely because it does not rely on advertising cookies. The built-in tracker therefore asks before collecting fingerprint and analytics signals. A customer may connect its own consent manager by setting data-consent="granted" or data-consent="denied" on the tracker script, or by dispatching the documented consent event. Customers are responsible for their notices, consent records, purposes, retention settings, and other duties in every country where they deploy Nexum Ventora.

5. Data sharing

We do not sell your personal data. We share data only with the following categories of recipients:

• Service providers: hosting and analytics providers who process data on our behalf under strict confidentiality agreements.
• Merchant of Record (Paddle): for payment processing, subscription management, tax compliance, and invoicing. Paddle acts as an independent data controller for payment-related data. See Paddle's Privacy Policy.
• Professional advisers: legal and accounting professionals, when necessary.
• Authorities: when required by applicable law or court order.

6. International transfers

Your data is stored and processed on servers located in various regions. Where data is transferred outside Indonesia, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, to protect your data in accordance with applicable data protection laws.

7. Data retention

We retain your personal data for as long as your account is active or as needed to provide you with the service. If you delete your account, we will erase or anonymise your personal data within a reasonable period, except where retention is required by law or for legitimate business purposes (such as fraud prevention or legal claims).

8. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten").
• Restriction: request limitation of processing under certain circumstances.
• Portability: request transfer of your data to another service.
• Objection: object to processing based on legitimate interests or direct marketing.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@trafficguard.app. We will respond within one month.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Cookies and local storage

The account application uses essential session storage for authentication and preferences. The embedded tracker does not need an advertising cookie, but it does use local storage to remember whether a visitor accepted or declined fingerprinting. Fingerprinting itself may still be regulated similarly to cookies. Clearing site data removes the saved choice and causes the notice to appear again.

11. Applicable privacy laws

We design our controls with data-protection obligations in mind, including Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP). We do not claim that use of Nexum Ventora automatically makes a customer GDPR, ePrivacy, or UU PDP compliant. Compliance depends on each deployment, purpose, configuration, notices, consent mechanism, contracts, and legal assessment.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the service. The updated policy will be posted on this page with a revised date.

13. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us at support@trafficguard.app.