Privacy Policy

At PT Winsera Teknologi Nusantara ("Winsera", "we", "us", or "our"), data sovereignty, operational security, and confidentiality guide our product development. This Privacy Policy serves as the unified privacy standard for Winsera and all Winsera products, platforms, and services.

1. Scope & Products Covered

This Policy governs the collection, processing, and protection of information across all digital products created, operated, or provided by PT Winsera Teknologi Nusantara, including:

• Winsera Websites & Portal: winseratech.com and related digital domains.
• Winsera's Products: All software products, software-as-a-service (SaaS) platforms, mobile applications, and web services developed or provided by Winsera.
• AI Automations & Workflows: Agentic routines, automated workflows, and intelligence pipelines.
• Custom Client Engineering: Bespoke web, mobile, and cloud software developed for enterprise clients.

2. Information We Collect

We collect only the minimum information necessary to deliver, maintain, and secure our products:

2.1 Account & Contact Data

When registering an account, submitting project briefs, or requesting consultations, we collect identifiers such as your full name, work email address, phone number, company name, and authentication credentials.

2.2 Product Workspace Content & Assets

When interacting with Winsera's products, we process customer data entered into the system:

• Task names, descriptions, priorities, statuses, tags, dates, and organizational structures.
• Uploaded files, attachments, document notes, and execution logs.
• Team membership, access roles, and audit trails.

2.3 Technical Telemetry & System Logs

Our servers automatically record operational telemetry: IP address, user agent, session timestamps, diagnostic error logs, and performance metrics, solely for security monitoring, abuse prevention, and infrastructure reliability.

3. Third-Party Cloud & API Services Compliance (Including Google API Services)

For any user-connected third-party cloud integration:

• Explicit Scope: Third-party storage APIs are accessed strictly to allow users to store, inspect, and retrieve project assets and task attachments.
• Zero Advertising: Data obtained via third-party APIs is never used, sold, or shared for advertising, retargeting, or behavioral profiling.
• No Generalized AI Model Training: Files and content obtained via third-party APIs are never used to train, retrain, or improve generalized AI models.
• Human Access Safeguards: Winsera personnel do not inspect user files unless explicitly requested by the customer in writing for technical debugging, or required by law.
• Encrypted Credentials: OAuth tokens and API secrets are stored encrypted at rest using AES-256.

4. How We Use Information

We process data solely for legitimate business purposes:

• To provision, maintain, and support Winsera products, workspaces, and client applications.
• To execute user-requested automations, AI task workflows, and project cost estimates.
• To handle billing, subscription management, and system notifications.
• To defend our systems against unauthorized access, malicious payloads, and cyber threats.

5. AI Safeguards & Zero Training on Customer Data

Winsera builds high-velocity AI products with strict data privacy:

• Customer Data Remains Yours: Winsera claims no ownership over your inputs, prompts, tasks, or codebases.
• Zero Model Training: We do not train, fine-tune, or improve generalized machine learning or foundational AI models using your customer data or workspace contents.
• Enterprise API Isolation: Third-party LLM inference is conducted exclusively through enterprise endpoints bound by zero-data-retention (ZDR) terms.

6. Third-Party Sub-Processors & Infrastructure

We deploy our systems on certified, enterprise cloud infrastructure:

• Supabase: Managed relational database (PostgreSQL), row-level security (RLS), and authentication infrastructure.
• Vercel: Edge routing, web hosting, and TLS termination.
• Google Cloud Platform: Cloud infrastructure, serverless compute, and Drive API storage gateways.
• Resend: Secure transactional email delivery.
• Payment Gateways (Midtrans & DOKU): Licensed payment service providers regulated by Bank Indonesia. Used for secure settlement of invoices, subscriptions, Virtual Accounts, QRIS, and credit/debit card processing. All payment gateways are certified PCI-DSS Level 1 compliant. Winsera never captures, transmits, or stores raw payment card numbers or CVV codes on our servers.

We never sell, broker, or rent your personal data to any third parties.

7. Security, Encryption & Tenant Isolation

• In Transit: All communication enforces HTTPS with TLS 1.3 encryption.
• At Rest: Databases, persistent storage, and access tokens are encrypted with AES-256.
• Multi-Tenant Isolation: Logical separation is enforced at the database level using Row-Level Security (RLS) policies.

8. Data Retention & Permanent Deletion

• Active Accounts: Workspace data is maintained for the duration of your active subscription.
• Permanent Purging: Upon workspace or account cancellation, your data is permanently deleted from production databases within thirty (30) days.
• Project & Inquiry Submissions: Retained for 24 months for scoping continuity, or deleted immediately upon written request.

9. Your Privacy Rights (GDPR, CCPA & Indonesian UU PDP)

You hold rights to access, correct, export, or permanently erase your personal data under applicable data protection laws. To make a request, contact the Winsera Team at solutions@winseratech.com. We will fulfill valid requests within thirty (30) days.

10. Cookies & Browser Storage

We use only essential cookies required for session authentication, security, and local storage tokens for UI preferences (such as dark/light theme). We do not deploy third-party advertising tracking cookies.

11. Contact the Winsera Team

For questions, data requests, or privacy inquiries regarding Winsera or any Winsera product: