Privacy Policy — CyberAgent.id

This Privacy Policy explains how CyberAgent.id ("we", "us") collects, uses, stores, and protects your personal information when you use our platform at cyberagent.id. We are committed to protecting your privacy in accordance with the Indonesian Personal Data Protection Law (UU No. 27/2022) and related regulations in Indonesia.

1. Data We Collect

Category	Type of Data	Purpose
Account Data	Name, email, password (hashed), profile photo (if OAuth), business type	Creating and managing accounts, authentication, OAuth authentication
Audit Data	Target URL/domain, scan results, vulnerability findings, PoCs, security score	Providing audit services, generating reports, verifying domain ownership
Transaction Data	Credit history, purchased packages, payment references	Managing credit balance, processing payments
Technical Data	IP address, user-agent, activity logs, usage data	Security, abuse prevention, service improvement
Webhook Data	Webhook URL, bot token, chat ID (Slack/Discord/Telegram)	Delivering audit result notifications to your channel

2. Data We Do NOT Collect

We do not store: passwords in plaintext form (only cryptographic hashes), your Target's database credentials, the contents of sensitive data from audited websites, private keys, or wallet mnemonics/seeds.

3. How We Use Data

To provide, operate, and maintain the Service.
To process authentication (email/password, Google OAuth, GitHub OAuth).
To run security audits on Targets you authorize.
To send audit result notifications via email/webhook.
To prevent abuse, fraud, and illegal activity.
To analyze usage in order to improve the quality of the Service.
To comply with applicable legal and regulatory obligations.

4. Legal Basis for Processing

We process your personal data on the basis of: (a) your consent at the time of registration; (b) performance of the Service contract; (c) our legitimate interests in providing and securing the Service; and (d) legal obligations.

5. Data Storage & Security

Data is stored on servers with encryption in transit (TLS) and strict access controls.
Internal access to engagement data is limited to the people working on that engagement.
Testing runs on isolated infrastructure we control; test data and engagement artefacts are deleted after the report is handed over.
We implement reasonable technical and organizational security measures to protect your data.

6. Retention Period

Account data: for as long as the account is active, and up to 30 days after account deletion.
Audit data: for as long as the account is active so that you can access your reports.
Technical logs: a maximum of 90 days.
Data required by law: in accordance with applicable regulatory provisions.

7. Sharing Data with Third Parties

We do not sell your personal data. We share data with third parties only in the following situations:

Party	Purpose
LLM providers (AI models)	Running audit analysis — only the target data you submit
Cloudflare (Turnstile)	Anti-bot verification on login/register forms
Google / GitHub	OAuth authentication (subject to their respective policies)
Payment providers (Midtrans, etc.)	Transaction processing (when enabled)
Competent authorities	Where required by law

8. Cookies & Similar Technologies

We use cookies and local storage (localStorage) to: manage authentication sessions, store language preferences, and serve the functional needs of site preferences. You may delete cookies through your browser settings; however, some features may not function without cookies.

9. Your Rights

In accordance with Indonesia's Personal Data Protection Law, you have the right to:

Access your personal data.
Correct inaccurate data.
Request deletion of your data.
Withdraw consent to data processing.
Restrict or object to certain processing.
Transfer your data (data portability).
Lodge a complaint with a supervisory authority.

To exercise your rights, contact us via the email address below. We will respond within 30 days.

10. Children's Security

Our Service is not intended for children under 13 years of age (or the age of majority under your jurisdiction). We do not knowingly collect data from children. If you believe we have collected a child's data, contact us for immediate deletion.

11. International Data Transfers

Your data may be processed on servers located inside and outside Indonesia. By using the Service, you consent to such transfers in accordance with this privacy policy and applicable regulations.

12. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-platform notice. Your use of the Service after a change takes effect constitutes your acceptance of it.

13. Contact

For questions, data access requests, or privacy complaints, contact:

Email: founder@cyberagent.id