Privacy policy

Who we are

VERALUME LABS is a web development agency based in Indonesia. Our team designs, builds and hosts each client’s website by hand; we do not generate or create websites automatically. Client websites connect to the VERALUME LABS platform through our API, so the business data behind them is managed through VERALUME LABS: customers, leads, orders, bookings, loyalty points, website content, form responses and marketing email. Our clients’ teams work in the client dashboard, and our own team uses a separate staff admin.

Our two roles

• Data we are responsible for: enquiries you send us through this website, client dashboard accounts, and the quotations, invoices and payments between us and our clients. We decide why and how this data is used.
• Data we process for our clients: the personal data a client’s website and team collect about the client’s own customers and visitors. The client decides why it is collected and is responsible for it; we process it on the client’s behalf.

What we collect

• Contact and quotation requests: the contact form opens your own email app with your name, email address, optional phone number and business name, the industry, services, budget and timeline you choose, and your message filled in. We receive them only when you send that email, and we keep the email so we can reply.
• Client dashboard accounts: your name, email address, a one-way hash of your password, your two-step sign-in settings if you turn them on, and for each signed-in session the browser it was started from. When someone invites you to their team, we keep your email address with the invitation.
• Billing: your business name and legal name, the quotations and invoices we send you, and the payments we record against them with their date, amount and bank reference. Billing emails go to the members of your account who can see billing.
• Security records: a keyed, one-way hash of your IP address so we can detect abuse and investigate incidents without storing the address itself, and an audit record of sensitive actions taken in the dashboard, including who opened a customer or lead page.

Client websites

Depending on the features a client uses, their website and dashboard can hold their customers’ names, email addresses, phone numbers and addresses; enquiries and form responses; orders, bookings, tickets, waiting-list places and gift cards; loyalty points; newsletter sign-ups and marketing choices; and customer account sign-ins. The client decides what their website asks for.

We process this data on the client’s behalf, to provide the service they engaged us for. If you are a customer of one of our clients, contact that business first; we will help them respond to your request.

Why we use it

• To reply to your enquiry and prepare a quotation, based on the consent you give when you submit the form.
• To provide our services to clients, give their team access to the dashboard, and invoice them, under our agreement with them.
• To run the features of our clients’ websites on their behalf, such as orders, bookings, customer accounts and marketing email.
• To keep our services secure, including rate limits on sign-in and forms, and to look into problems.

We do not sell personal data and we do not use it for advertising. Our emails do not track whether they are opened or which links are clicked.

Who else handles it

We use a small number of services to run the platform, and each receives only what it needs:

• Mailgun sends our email, including emails to our clients’ customers such as order and booking messages and marketing campaigns. It receives each address and message and keeps its own logs for a limited time. Mailgun handles email in the United States or the European Union, so this data is transferred outside Indonesia.
• Object storage (an S3-compatible service) holds uploaded images and customer export files. Images are public to anyone with their link, as they appear on websites. Export files are encrypted before they are stored, are kept private and are only handed out to the people allowed to download them.
• Payment gateways (Xendit, Midtrans or Stripe) are used only when a client turns on online payments, through the client’s own account. With each payment link Xendit and Midtrans receive the customer’s name, email address and phone number, and Stripe receives the email address only. Customers pay on the gateway’s own page, so card and bank details go to the gateway, not to us, and the money goes to the client.
• Cloudflare Turnstile protects a client’s form against spam when the client switches the check on for that form. The check runs in your browser when you fill in the form, and Cloudflare receives your IP address and signals about your browser and device so it can tell people from automated programs. Cloudflare handles this data in the United States and other countries, so it is transferred outside Indonesia. Our servers send Cloudflare only the result token from the check, not your IP address or your answers.
• Google Analytics measures visits to this website’s public pages, and only after you accept analytics cookies. It receives the address of each page you open, the page you came from, your browser, device and screen size, your approximate location and a random identifier kept in a cookie. Google does not store your IP address, and we have turned off its advertising features. Google handles this data in the United States and other countries, so it is transferred outside Indonesia. It never runs in the client dashboard or our staff admin.
• Hosting: the platform, its databases and its backups run on servers from our hosting provider.

When something goes wrong, we record the error in our own database with personal data removed. We do not send error reports to an outside error-tracking service, and our team can delete these records.

Cookies

This website does not use advertising cookies. Apart from the analytics cookies described below, which are only set if you accept them, it sets cookies that are strictly necessary:

• a security token that protects forms and sign-in against cross-site request forgery, set when you send a form or sign in, which lasts up to two hours;
• a session cookie when you sign in to the client dashboard, which ends when you sign out or your session expires.

Neither can be read by scripts on the page. Our staff admin uses the same two kinds of cookie for our team. The showcase demos keep a sample cart in your browser’s session storage while the tab is open; it holds only the demo items you add. Our clients’ websites may set their own cookies, and the business behind each website is responsible for them.

On the public pages we ask before using Google Analytics. Nothing is loaded until you choose, and declining means it never runs. If you accept, Google Analytics sets a cookie named _ga and one beginning with _ga_, which last up to two years and let it recognise a returning visit. Your choice is kept in your browser’s local storage. You can change it at any time with “Analytics cookies” at the bottom of each page; declining then removes these cookies.

How we protect it

• Names, email addresses, phone numbers, postal addresses, messages, form answers and most notes are encrypted before they are stored, and the keys are kept apart from the data. Some shorter fields are stored without this extra encryption: company names, the name, title and text of product and booking reviews, and some short notes and reasons. They are protected by the same access controls as everything else.
• Passwords are stored only as one-way hashes. Password reset, invitation and other single-use links are stored only as hashes, API keys only as keyed fingerprints, and IP addresses only as keyed hashes.
• Two-step sign-in is required for our staff and available to every client user.
• Every page, form and dashboard request uses an encrypted connection.
• Permissions are checked on our servers for every request, and sensitive actions are recorded in an audit trail. Our staff admin does not show a client’s customers, orders, bookings or form responses. A business can give members of our team access to its dashboard, for example for support; they then see what that access allows, and the business can remove it at any time.
• Server logs leave out passwords, tokens, email addresses, phone numbers and the content of requests.
• Uploaded images are accepted only as JPEG, PNG or WebP, checked by their content rather than their name, and refused if they are damaged or hold anything besides the picture. We then make new image files from them, with hidden details such as the location a photo was taken removed, and never keep the file that was uploaded. Product spreadsheets are accepted only as plain CSV text and are not kept after they are read.

How long we keep it

There are no automatic periods after which records about people, such as customers, leads, orders, bookings and form responses, are deleted or anonymised. The personal data a client’s website and team collect is kept while the client uses our service, and it is not deleted automatically when the service ends either: an archived website’s records are kept. Records are kept rather than deleted. The personal details in them are anonymised when the person asks the business to erase them, or the business decides to: names, contact details and typed notes are cleared, and records of money, such as amounts, payments and refunds, are kept.

Once a website is archived, its team can no longer open it, so our team does the erasing. When the client asks, including at the end of the contract, we anonymise that website’s customers’, leads’ and website visitors’ personal data in the same way. This does not cover the business’s own details, such as its supplier contacts, alert addresses, the authors of its content or the staff named on its resources. When a customer of an archived website asks, we anonymise that customer’s details. Our team does this by customer number or email address, without seeing the customer’s name or contact details.

A few working copies expire on their own, because they are only needed for a short time:

• Customer export files: removed 24 hours after they are ready.
• Emails waiting to be sent: removed once sent, or after about two days if they cannot be delivered.
• Carts: the contact details on a cart are cleared when the cart expires, within 30 days.
• Sessions and single-use links: a signed-in session ends when you sign out or after a period without use, and sign-in, password reset, confirmation and invitation links stop working when they expire.

Every night, some working records are deleted for good once they are old enough. Records of money, customers, leads and bookings are never among them:

• Carts: deleted with their contents 90 days after they expire. A cart whose reminder email had an unsubscribe link is kept, so that link keeps working.
• Notifications sent to a business’s own systems (webhooks): deleted 90 days after they were delivered or given up.
• Used or expired sign-in, password reset, two-step and invitation links: the records behind them are deleted 30 days later.
• Booked time slot records: deleted 90 days after the slot ended. The booking itself is kept.
• Customer export and personal data copy records: deleted 90 days after they expired or failed. The files themselves are removed earlier, as above.
• Team invitations: deleted, with the address they were sent to, 90 days after they were accepted, cancelled or expired.
• Error logs: deleted 90 days after the error was last seen.
• Payment gateway notifications: deleted after 12 months. The payments themselves are kept.
• Records of someone opening a customer’s or lead’s page: deleted after 12 months.

Other records we keep:

• Enquiries to us and client dashboard accounts: kept while they are needed for your enquiry or our work together, and anonymised when you ask. A dashboard account can be anonymised once it no longer belongs to any business, and the team invitations sent to its address are anonymised with it. If you were invited but never set up an account, the invitations sent to you are anonymised when you ask us.
• Security records: audit records, with the IP address hash and browser they were made from, are kept, apart from the records of opening a customer’s or lead’s page listed above.
• Quotations, invoices and payments with our clients: kept as financial records.

A marketing opt-out outlasts anonymising: we keep a keyed hash of the email address, not the address itself, so that address is not sent marketing email again unless the person subscribes again. Backups keep what they held until they are replaced, and Mailgun and payment gateways keep data under their own retention rules.

Your rights and requests

Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and other applicable laws, you can ask to access, correct or delete your personal data, withdraw your consent, and ask us to limit how we use it. For enquiries, client dashboard accounts and billing, email [email protected] and we will respond within the time the law requires. We anonymise rather than delete, and we keep invoices and payment records.

If you are a customer of one of our clients, the business is responsible for your request. Where its website offers customer accounts, you can:

• correct your name, phone number and email address, and switch marketing email off, in your account settings;
• ask for your account to be deleted. This signs you out everywhere, stops marketing email straight away and tells the business, which is reminded until your details are erased.

The business’s team then erases your details. A person does this, not an automatic process. Open orders, upcoming bookings and active repeat orders normally need to be finished or cancelled first, except while the website is suspended or the business’s account with us is closed. Erasure anonymises your details across that website’s records; order and booking numbers, amounts, payments, refunds, loyalty point history and your consent history are kept. It does not reach the payment gateway or Mailgun’s logs, which keep data under their own retention rules. A business can also erase people who have no account, such as a lead, a form response or the contact details on an order or booking.

While a website is paused, or the business’s account with us is closed, you can still ask for your account to be deleted and the business’s team can still erase your details. If the website has been archived, ask the business or email [email protected], and our team erases your details.

To answer a request for a copy of your data, the business can download what its website holds about you: your profile, current and removed addresses, orders, bookings, loyalty points, consent history, enquiries, form responses, tickets you bought or are named on, your product and booking reviews, gift cards and store credit you hold or were sent, passes, waiting-list places, booking quotes, repeat orders, and the notes the business wrote about you.

Marketing email

• Marketing email is only sent to people who agreed to receive it and have not opted out.
• Newsletters use double opt-in. When you sign up, or tick a box agreeing to marketing on a form, at checkout, when booking or on a waiting list, we first send a confirmation email, and you are only subscribed after you confirm. Cart reminders go only to confirmed subscribers.
• Every marketing email has an unsubscribe link, and customers with an account can switch marketing email off in their account settings.
• Once you opt out, the business cannot switch marketing email back on for you; only you can, by subscribing again.

Changes

If we change how we handle personal data, we will update this page and the date at the top.