Privacy Policy
Version 1.0 · effective 16 October 2026
1. About this policy
This policy explains what personal data we process when you use agere/org, the www.agereorg.com website, and our emails, and your rights over that data. It is prepared with reference to Law No. 27 of 2022 on Personal Data Protection (PDP Law).
2. Who we are and our roles
agerelab ("we") provides agere/org. Our role depends on the type of data:
| Data | Our role | Where to send questions |
|---|---|---|
| Account, security, billing, website visits, correspondence with us | Personal data controller | support@agereorg.com |
| Organization workspace content and membership data | Processor on behalf of your Organization | Your Organization's Owner or Admin; we help when asked |
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, profile photo, password in hashed form, linked third-party sign-in account, job title if provided, language, time zone, theme | You; the account provider if you sign in with a third-party account |
| Security | Sign-in sessions, IP address, browser and device type, sign-in attempt records, security activity | Your device |
| Organization and membership | Organization name and logo, role, member status, invited emails | You, the Owner, or an Admin |
| Workspace content | Spaces, projects, tasks, comments, uploaded icons and images | You and Organization members |
| AI | Goals you type, generated suggestions, AI Credit usage | You; model providers |
| Billing | Legal name, address, billing email, invoices, payment status and references. We never receive card numbers | Owner or Admin; payment provider |
| Usage | Records of actions in the app, such as tasks created or moved, and Organization audit records | Use of the Service |
| Correspondence | Content of emails to support@agereorg.com | You |
| Early bird registration | Name, email, Organization name, team size, and notes from the introductory call | You |
| Feedback | Notes from feedback sessions and survey answers. Recordings are made only with your permission | You and Organization members |
4. Purposes and legal bases
| Purpose | Data used | Legal basis under the PDP Law |
|---|---|---|
| Providing the Service: accounts, Organizations, spaces, projects, tasks, notifications | Account, membership, workspace content | Performance of a contract (Terms of Service) |
| Sending service emails: verification, invitations, password resets, trial and billing reminders | Account, membership | Performance of a contract |
| Running AI features at your request | AI, relevant workspace content | Performance of a contract |
| Billing, invoicing, and bookkeeping | Billing | Performance of a contract and legal obligation |
| Keeping the Service secure and preventing abuse, including repeated trials | Security, account, email domain | Legitimate interest and the legal obligations of an electronic system operator |
| Recording Organization audit logs | Usage, security | Performance of a contract |
| Improving the product with aggregate figures, such as the number of active organizations per week | Usage | Legitimate interest |
| Answering your questions and requests | Correspondence, account | Performance of a contract |
| Selecting and contacting early bird applicants | Early bird registration | Performance of a contract, including your requests before a contract is made |
| Improving the product from participant feedback | Feedback | Legitimate interest |
We do not send marketing emails. If we ever do, we will ask for your consent first.
5. What we do not do
- We do not sell your personal data.
- We do not use advertising trackers or build profiles for advertising.
- We do not use your workspace content to train AI models, and we use only model providers that do not retain the data sent to them.
6. Who receives data (sub-processors)
We use providers in the following categories to run the Service. Each provider receives only the data it needs for its task.
| Provider category | Function | Data received | Processing location |
|---|---|---|---|
| Hosting and file storage | Running the app and storing files (icons, logos, profile photos) | All Service data | Singapore |
| Database | Storing Service data | All Service data | Singapore |
| Sending service emails and forwarding incoming email to support@agereorg.com | Name, email, email content | United States; global network | |
| Third-party sign-in | Signing in with a third-party account | Name, email, profile photo from that account | Global network |
| Payments | Processing payments | Name, email, bill amount, payment details you enter on the payment page | Indonesia |
| AI models | Running AI features through a model intermediary and model providers that do not retain the data sent to them | AI request text and necessary project context, without email or account identity | United States; varies by model |
| Error monitoring | Detecting application errors | Error codes and technical IDs, without names, emails, or content | United States |
The Owner or an Admin can request the list of provider names at support@agereorg.com. We may also disclose data when required by law or by an order of a competent authority, or to a successor of our business in a merger or acquisition, with notice to you. We notify the Owner at least 30 days before adding a new sub-processor.
7. Transfers outside Indonesia
Service data is stored in Singapore, and some of the providers above process data in the United States or on global networks. Before transferring data, we make sure the provider offers equivalent or adequate protection through its service agreements and security measures, in line with the PDP Law. If those conditions are not met for a transfer, we ask for your consent first.
8. AI processing
- AI features run only when you ask for them. The result is a suggestion that takes effect only after you approve it.
- What is sent to the model is the goal you type and the necessary project context. Email and account identity are not sent.
- Model providers do not retain that data and do not use it to train models.
- We keep the request text and the model's raw response for 30 days to calculate AI Credits, check for errors, and answer your questions, and then delete them. Tasks you approve become part of the Organization's workspace content.
9. Cookies and browser storage
We use only the cookies and browser storage needed for the Service to work. We do not use advertising cookies or third-party trackers.
| Name or type | Function | Duration |
|---|---|---|
| Session cookie (HttpOnly, Secure) | Keeps you signed in | Until you sign out or the session ends |
agere-theme-d125 | Remembers the light or dark theme before you sign in | Until removed from the browser |
| Language cookie | Remembers your choice of Bahasa Indonesia or English before you sign in | Until removed from the browser |
| Unsent drafts (local browser storage) | Keeps text you are writing so it is not lost if the connection drops or the page reloads. Kept separately per user and Organization | Removed when saved or discarded, when the dialog is closed, when you sign out, or when the sign-in page opens |
10. How long data is kept
| Data | Retention | After that |
|---|---|---|
| Account data | While the account exists | Name, email, photo, credentials, and linked sign-in account are deleted within 30 days of an account deletion request. Work history shows "Deleted user" |
| Sign-in sessions | Until they expire or are revoked | Deleted |
| Sign-in attempt records | 24 hours | Deleted |
| Invitations | 90 days after being accepted, declined, canceled, or expired | Deleted |
| Items in Trash | Free 7 days, Team 30 days, based on the plan when the item was discarded | Permanently deleted |
| Organizations requested for deletion | 30-day waiting period | All Organization data deleted within 7 days after that |
| Audit records | 1 rolling year | Deleted |
| Notifications | 90 days | Deleted |
| Security activity records | 30 days | Deleted |
| Raw AI requests and responses | 30 days | Deleted |
| Invoices, payments, and billing profile | 10 years, in line with applicable financial record-keeping obligations. Kept even if the Organization is deleted, limited to billing identity and amounts | Deleted |
| Support correspondence | As long as needed to handle the request, at most 2 years | Deleted |
| Database backups | At most 30 days | Deleted data disappears as old backups are replaced |
| Early bird registrations not selected | 90 days after registration closes | Deleted |
| Feedback notes | At most 2 years | Deleted |
Application logs contain only technical IDs, without names, emails, or passwords.
11. Security
- All connections use HTTPS. Passwords are stored in hashed form, never in plain text.
- You can view and revoke sessions, including signing out of all devices.
- Access within an Organization is controlled by role, space, and project, and every important change is recorded in the audit log.
- Our team's access to production systems is limited to those who need it, and every action is recorded.
- The database is backed up and restores are tested. Secret keys are stored separately from the code.
No system is completely immune. If you find a security vulnerability, tell us at support@agereorg.com.
12. Your rights
Under the PDP Law, you have the right to:
- be informed about the processing of your data;
- access and obtain a copy of your personal data in a commonly used format;
- correct inaccurate or incomplete data;
- request deletion of your data, and withdraw consent you have given;
- request that processing be postponed or restricted;
- object to decisions based solely on automated processing;
- sue and receive compensation for violations in the processing of your personal data.
How to exercise your rights. You can do many things yourself: change your profile or delete your account in Settings. For other requests, email support@agereorg.com from your account email address with the subject "Personal data". We may ask you to sign in again to confirm your identity.
Response time. We respond within 3 × 24 hours of a verified request, and complete it within the time limit set by regulation.
Organization workspace content. Requests about data inside a workspace go to that Organization's Owner or Admin. We help them fulfil the request.
If you are not satisfied with our response, you can complain to the competent personal data protection authority.
13. Personal data breaches
If your personal data is disclosed, lost, or accessed without authorization, we notify you and the competent authority in writing within 3 × 24 hours of becoming aware of it. The notice covers the data affected, when and how it happened, and the handling and recovery steps we have taken.
14. Children
The Service is intended for users aged 18 and over. If we learn that an account belongs to a child, we delete it.
15. Changes to this policy
Every version of this policy has a version number and an effective date. Meaningful changes are announced at least 30 days before they take effect, by email and in the app, and you are asked to accept them the next time you sign in.
16. Contact
| Purpose | Contact |
|---|---|
| Personal data requests and questions | support@agereorg.com |