Your Privacy is Our Priority

We collect information you provide directly and information collected automatically:

The information we collect is used solely for the following purposes:

• Providing, operating, and improving Cloudsphere services in accordance with the agreed contract
• Responding to inquiries, information requests, and business communications
• Sending service updates, policy changes, and important notifications
• Analyzing platform usage patterns to improve features and user experience
• Detecting, preventing, and responding to security incidents or abuse
• Fulfilling legal and regulatory obligations applicable in Indonesia and other relevant jurisdictions
• Billing and financial administration related to services provided

We do not use your data for third-party marketing purposes or sell it to anyone.

We process your personal data based on Law Number 27 of 2022 on Personal Data Protection (UU PDP) with a clear legal basis:

We do not sell, rent, or trade your personal data. Information is only shared under the following conditions:

• Infrastructure Service Providers — hosting, database, email, and analytics partners (data processors) bound by data processing agreements (DPAs) and prohibited from using your data for other purposes
• Legal Obligations — if required by law, court order, or authorized regulatory authority
• Rights Protection — to protect the safety of users, platform integrity, or Cloudsphere's legal rights
• Your Consent — in any other situation, only with your explicit consent

Every third-party service provider we use is rigorously vetted and bound by data protection obligations equivalent to our standards, including a Data Processing Agreement as required by Article 28 of the GDPR.

Key Sub-Processors

We currently rely on the following key sub-processors to operate our services:

The current list of sub-processors and their roles is available on our Trust Center page. Material changes to this list will be communicated in accordance with Section 10.

Your personal data may be stored or processed on servers and service providers located outside your country of residence — including Indonesia and other jurisdictions where our infrastructure partners operate. Any such transfer is protected by one of the following mechanisms:

For data subjects in the EEA and the UK, transfers outside those regions only take place with appropriate safeguards under Chapter V of the GDPR. You may request a copy of the safeguards we apply by contacting our privacy team.

As a company operating in the information security field, we apply the highest data protection standards:

That said, no system is completely immune. In the event of a personal data breach that poses a risk to your rights, we will notify you and the competent authorities within the timeframes set out by UU PDP and the GDPR (within 72 hours of becoming aware, as required by the GDPR). If you suspect a security vulnerability, please report it to [email protected].

We retain your personal data only as long as necessary to fulfill the processing purpose or as required by applicable legal obligations:

• Active account data — retained for the duration of the business relationship and up to 12 months after it ends
• Consulting engagement data — minimum 3 years per ISO 27001 audit requirements
• Financial records and invoices — 5 years per Indonesian tax regulations
• Security logs and audit trails — minimum 1 year for incident investigation needs

After the retention period ends, data will be securely deleted or anonymized so it can no longer be linked to your identity.

Under UU PDP No. 27/2022 and the GDPR, you have the following rights over your personal data:

We use cookies and similar tracking technologies to enhance user experience and analyze website usage:

You can manage cookie preferences through your browser or by clicking the settings button on our cookie banner. Disabling certain cookies may affect website functionality.

We may update this policy periodically to reflect changes in our services, technology, or regulations. For material changes, we will:

• Notify you by email to your registered address at least 30 days before the change takes effect
• Display a clear notice on our platform
• Update the “Last updated” date at the top of this document

Continued use of the service after a change takes effect constitutes acceptance of the revised policy. If you disagree with a change, you have the right to stop using the service and request deletion of your data.

For questions, data subject rights requests, or privacy concerns, please contact our Data Controller at:

You also have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction if you believe your rights have not been upheld.

For specific security questions, please visit our Trust Center page.