Version 1.0 — effective 2026-07-08.
Profitina (“we”) is committed to protecting your Personal Data in accordance with Law of the Republic of Indonesia Number 27 of 2022 on Personal Data Protection (“PDP Law”) and its implementing regulations. This document transparently explains what data we collect, why we need it, how it is stored and secured, who can access it, and your rights as a Personal Data Subject. In processing your Personal Data, we act as the Personal Data Controller as defined in the PDP Law.
1. Identity of the Data Controller
Personal Data Controller: Profitina (profitina.com and app.profitina.com).
Data protection contact: [email protected].
2. Personal Data We Collect
- Account data: the email address and password you create at registration. Passwords are never stored in their original form (see Section 6).
- Data you voluntarily submit: name/display name, comments, and the brand/site data you register for visibility analysis.
- Technical data: IP address, browser/device type, and access logs required for security and abuse prevention.
- Functional cookies: cookies required for login sessions, language preference, and recording that you have seen the privacy notice. We do not use third-party advertising cookies.
We apply the principle of data minimisation: we only collect data that is genuinely necessary to provide the service.
3. Purposes and Legal Bases of Processing
We process your Personal Data for the following purposes and legal bases (Article 20 of the PDP Law):
- Authentication and account management — basis: performance of the service agreement and your explicit consent at registration.
- Provision of the AI-visibility/GEO service (analysis, reports, history) — basis: performance of the service agreement.
- Platform security (prevention of unlawful access, login rate limiting, auditing) — basis: legitimate interest and our legal obligation to safeguard Personal Data (Article 35 of the PDP Law).
- Service communications (important notices regarding your account, security, or policy changes) — basis: performance of the agreement and legitimate interest.
We do not sell and do not share your Personal Data with third parties for commercial purposes without your consent.
4. Consent
We ask for your consent explicitly via a checkbox that is not pre-ticked on the registration form and any other form collecting Personal Data. Consent requests are presented in clear language, distinguishable from other matters, in accordance with Articles 21 and 22 of the PDP Law. You may withdraw consent at any time (see Section 7); withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Storage and Retention
Personal Data is stored on servers with access restricted to authorised personnel only. Account data is retained for as long as your account is active. When an account is deleted, your Personal Data is deleted or anonymised from production systems within no more than 30 (thirty) days, except for specific data we are legally required to retain longer. Encrypted backups expire under our backup rotation cycle of no more than 90 (ninety) days.
6. Data Security
- Passwords are stored as one-way hashes using modern algorithms (Argon2id/bcrypt), so they cannot be viewed by anyone, including our internal team (a zero-knowledge approach).
- Encryption in transit: all traffic between your browser/app and our servers is encrypted using HTTPS (SSL/TLS).
- Login rate limiting to prevent brute-force and credential-stuffing attacks.
- Internal access restrictions, logging, and regular security updates.
7. Your Rights as a Data Subject
Under Articles 5 through 13 of the PDP Law, you have the right, among others, to:
- obtain clear information about the processing of your Personal Data;
- complete, update, and/or correct your Personal Data (e.g. change your email or password via account settings);
- obtain access to and a copy of your Personal Data (data portability);
- end processing, delete, and/or destroy your Personal Data — including permanently deleting your account (the right to be forgotten) via account settings or by contacting us;
- withdraw consent you have previously given;
- object to decisions based solely on automated processing;
- postpone or restrict processing proportionally;
- claim and receive compensation for violations of Personal Data processing under applicable law.
Requests can be made via the account settings menu in the app or by email to [email protected]. We will follow up within the timeframes stipulated by applicable regulations.
8. Sharing Data with Third Parties (Processors)
To operate the service we may use infrastructure providers (e.g. hosting/servers and email services) acting as Personal Data Processors, who process data only on our instructions and are bound by confidentiality and security obligations. Where Personal Data is transferred outside Indonesia, we ensure the destination provides an equivalent level of protection, or that adequate safeguards and/or your consent are in place, per Articles 55–56 of the PDP Law.
9. Children
Our services are not directed at children. Processing of children’s Personal Data is only carried out with parental/guardian consent as required by the PDP Law. If you believe a child has provided Personal Data to us without such consent, please contact us so the data can be promptly deleted.
10. Data Breach Notification
In the event of a failure to protect Personal Data, in accordance with Article 46 of the PDP Law we will provide written notification no later than 3×24 hours to you and to the personal data protection supervisory authority, stating the data disclosed, when and how the incident occurred, and our handling and recovery efforts.
11. Cookies
We use functional cookies necessary for the site and app to operate (login sessions, language preference, privacy-notice acknowledgement). You can manage or delete cookies via your browser settings; disabling functional cookies may affect the service.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be announced via the site/app and, where required, we will ask for your renewed consent. The version and effective date are always shown at the top of this document.
13. Contact and Complaints
Questions, rights requests, or complaints regarding Personal Data may be submitted to [email protected]. You also have the right to lodge a complaint with the personal data protection supervisory authority under the laws of the Republic of Indonesia.