POLYGONOSS PRIVACY POLICY

Article 1 — Data Controller

Article 2 — Data We Collect

1. 1.Account data — name, email address, password (stored in hashed form, not original text), and your account role and preferences.
2. 2.AI consultation data — questions you ask on the Ask AI feature, images you upload for analysis (for example location photos or documents), and the answers produced. Conversation history is stored on your device (browser local storage) and Q&A records may be stored on the server for service quality and security purposes.
3. 3.Location and mapping data — coordinates and polygon drawings you create (manual, sketch, field GPS, or file import), RDTR check results, and files you upload and generation results (SHP, PDF) that you save in your account.
4. 4.Forum content — your posts, replies, and interactions in the forum, which are displayed to other users in accordance with the nature of the forum.
5. 5.Transaction data — records of Credit top-ups and feature payments (amount, time, method, status, and transaction references from the payment gateway). We do not receive and do not store your card data or payment credentials; payments are processed directly by the payment gateway provider (QRIS).
6. 6.Technical data — IP address, browser and device type, access times, and security and audit logs necessary to protect the service from misuse (for example request rate limiting and recording of administrative actions).

Article 3 — Purposes of Data Use

1. 1.Operate and provide the Service features (account, consultation, mapping, simulation, forum, and payments).
2. 2.Process your questions and images through AI model providers so answers can be produced.
3. 3.Store the land/polygons and result documents you create so you can access them again.
4. 4.Maintain Service security, prevent fraud and misuse, and fulfil legal obligations.
5. 5.Contact you regarding your account, transactions, and important Service changes.
6. 6.Improve Service quality based on aggregate usage patterns.

Article 4 — Processing by Third Parties

1. 1.AI model providers (AI gateway) — questions and images you send to the Ask AI feature are forwarded to artificial intelligence model providers to be processed and produce answers. Do not include sensitive personal data (for example identity numbers, personal financial data, or other parties' confidential documents) in the questions or images you upload.
2. 2.Gistaru ATR/BPN — RDTR checks are performed from your browser to the Gistaru service; the coordinates of the points/polygons checked are sent to that service as necessary for spatial planning checks.
3. 3.Payment gateways — top-up payments and paid features are processed by official payment gateway providers (including Espay and DOKU) in accordance with their respective privacy policies; we only receive payment status verification results.
4. 4.Email and infrastructure providers — service email delivery (activation, account recovery, notifications) and network/server infrastructure provision use third-party providers bound by confidentiality obligations.
5. 5.Google (Sign in with Google) — if you choose to sign in using a Google account, we receive from Google your name, email address, and Google account profile photo. This data is used to create a PolygonOSS account for you or to link it to an existing account (linking is performed only where your Google email address is verified), to display your name and photo on your profile, and to recognize you on subsequent sign-ins. Your Google photo is used only to fill in a profile photo that is still empty, and you may replace it at any time. We do not receive or store your Google password; signing in through Google is also subject to Google's privacy policy. We do not sell the data we receive from Google to any party.

Article 5 — Storage and Retention

1. 1.Account data and land/polygon data (including its coordinate points) are stored while your account is active, or until you request their deletion. Specifically for polygon creation result files (SHP files and PDF documents), files are stored and can be re-downloaded for 90 (ninety) calendar days from when the polygon was created or last generated; after that period ends the files are archived and can no longer be downloaded, while the polygon data remains stored as provided in this paragraph.
2. 2.AI conversation history on your device can be deleted at any time via the delete history button on the Ask AI page; server-side records are stored for a limited period in accordance with the Operator's retention settings for quality and security, then deleted or anonymized.
3. 3.Transaction records and security logs are stored as long as necessary for bookkeeping, dispute resolution, and legal obligations.
4. 4.After the storage period ends, data is deleted or anonymized in a reasonable manner.

Article 6 — Data Security

1. 1.We implement reasonable security measures, including: encrypted connections (HTTPS), passwords stored in hashed form, role-based access restrictions, and audit logging of administrative actions.
2. 2.No system is entirely free of risk. In the event of a personal data protection failure, we will provide notification in accordance with the PDP Law, no later than 3×24 hours after it becomes known, to affected data subjects and/or the competent authority, to the extent required by laws and regulations.
3. 3.You are responsible for maintaining the confidentiality of your own account credentials.

Article 7 — Your Rights as a Data Subject

1. 1.Obtain access to and copies of your personal data that we manage.
2. 2.Correct inaccurate or incomplete data.
3. 3.Request deletion of your personal data, to the extent not contrary to storage obligations under the law.
4. 4.Withdraw consent for processing previously given.
5. 5.Restrict or object to certain processing, and lodge objections.
6. 6.Lodge a complaint with the competent personal data protection authority if your rights are violated.

Article 8 — Children's Data

Article 9 — Cookies and Local Storage

1. 1.The Service uses browser cookies and local storage that are essential and functional, including for login sessions, language and display theme preferences, and AI conversation history on your device.
2. 2.If analytics features are enabled by the Operator, their use is limited to aggregate visit statistics and will be explained in updates to this Policy.
3. 3.You can manage or delete cookies and local storage through your browser settings; deleting local storage will also delete conversation history stored on your device, and some features may not function optimally without essential cookies.

Article 10 — Changes to the Policy

Article 11 — Contact

• Operator: PT Norman Solution Indonesia
• Email: [email protected]
• Address: Jl. Nyiur Melambai III, Koja, North Jakarta 14260