Privacy Policy

1. About this policy

This Privacy Policy explains how PT SCND Digital Kreatif ("SCND.Digital", "Tumra", "we" or "us") collects, uses, stores, shares and protects personal data when you visit tumra.id or use the Tumra application.

It is written with reference to Law No. 27 of 2022 on Personal Data Protection ("PDP Law"), the Electronic Information and Transactions Law and its amendments ("ITE Law"), and Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions.

Our address: Komp. Deplu 76 Pondok Aren, Jl. Caraka 6 Blok C No. 23, Tangerang Selatan, Banten, Indonesia.

2. Scope

• The tumra.id website: an information site about Tumra, including the blog and help centre. The site does not ask you to fill in personal data.
• The Tumra app (app.tumra.id): a service for managing clients, projects, tasks, time entries, invoices, payments, expenses, bookkeeping, stock and point of sale, including the AI assistant and the client portal.

This policy does not cover third-party services you connect yourself, for example an AI provider of your choice, AI apps connected through MCP, or your online store. Those services are governed by their own privacy policies.

3. Our role: controller and processor

Our role under the PDP Law depends on the type of data:

• We are the controller for your account data, subscription and billing data, sign-ups, the reports and feedback you send us, and the technical data we use to keep the service secure.
• We are the processor for the data you and your team enter into a workspace about your business and other people, for example clients, contacts, suppliers and transactions. For this data, you as the workspace owner are the controller. We process it only to run the service, following your instructions and the Terms of Service.

As the controller of your clients' and contacts' data, you are responsible for having a lawful basis to record that data in Tumra and for informing the people concerned where required. If your clients, contacts or team members contact us about their data in your workspace, we will pass the request on to that workspace's Owner and tell the sender that it has been passed on. We do not change or delete data in your workspace at another party's request without your instruction, unless required by law.

4. Data we collect

4.1 Account data

• Name, email address, role in the workspace, preferred language, and profile photo if you upload one.
• Your password, which we store only as a hash and never in its original form.
• If you sign in with Google: your Google account ID, email address and name, sent by Google after you consent. We only request basic permissions (openid, email and profile). We never receive your Google password.
• Time of email verification, time of last sign-in, and technical session data.
• Workspace name, business type and time zone.

4.2 Business data in your workspace

Data you and your team enter, including:

• Clients and contacts: name, legal entity name, email, phone, address, website, logo, tax identification numbers (for example NPWP or NIK), notes, interaction history and follow-ups.
• Suppliers: name, contacts, tax identification number and bank account details.
• Projects, tasks, comments, file links, and team members' time entries.
• Transactions and bookkeeping: quotes, invoices, payments, expenses, journals, financial reports, products, stock, purchasing and point of sale.
• Your business profile: legal entity name, address, contacts, logo, tax details, and the bank accounts printed on invoices.
• WooCommerce store if you connect one: product and order data from that store. The store's API keys are stored encrypted, and buyers' email addresses are stored only as hashed values, not the original addresses.

4.3 Client portal user data

If you invite a client contact to the portal, we store their sign-in email, password hash, preferred language, time of last sign-in, and the access rights you give them.

4.4 Activity records and technical data

• Audit trail: who created, changed, posted, voided or corrected financial documents, when, and the state of the data before and after.
• AI assistant usage records: time, user, provider and model, number of characters, names of the tools used, and credits used. The content of questions and answers is not stored in these records (see Section 7 on conversation history).
• MCP connection records: the name of the tool called, the connection, the time and the result (success, refused or error), without the content of the data requested or returned.
• IP addresses, used temporarily to limit sign-in attempts and excessive requests.
• Standard server logs produced by our infrastructure, kept for 30 days.

4.5 Subscription and payment data

• Plan, billing cycle, number of seats, AI credit purchases, voucher codes, bills from Tumra and their payment status.
• The identity printed on subscription bills: your workspace's legal entity name, address and tax ID (NPWP), taken from the workspace settings. We also use this data if you request a tax invoice.
• Subscription payments are processed by Midtrans, our payment provider. You enter your card, account or e-wallet details on Midtrans's payment page, not in Tumra, and we do not store them. From Midtrans we receive only the payment status, the payment method used and the transaction reference number.

4.6 Sign-ups, reports and feedback

• Beta programme sign-ups (while the programme was running): name, business name, email, website (optional), the plan requested and answers to a short survey.
• Problem reports: description, page, the reporter's name and email, workspace name, and a screenshot if attached.
• Feedback on AI assistant answers: the question, the improvement expected, role, plan and AI model.

4.7 Free tools, templates and Berkembang bersama Tumra

The calculators at tumra.id/tools run in your browser; the numbers you type are not sent to us. Invoice generator drafts and any logo you add are stored in your own browser.

When you download a template, we receive your email address, your name and business type if you provide them, the templates you chose, and the page language. If you tick Berkembang bersama Tumra, we also record your consent and when you gave it, and add your address, name, and business type to our newsletter contact list.

5. How we use data

• To provide, maintain and run the service's features.
• To authenticate users, keep accounts secure and prevent abuse.
• To send service emails: email verification, password resets, team and portal invitations, subscription reminders and notices, and invoices to your clients when you ask us to.
• To manage subscriptions, issue bills and tax invoices, and reconcile payments.
• To run the AI assistant when a user asks it to.
• To respond to reports, provide support and improve the service. Feedback on assistant answers may be turned into test cases to improve the assistant.
• To meet legal obligations, including tax, and respond to lawful requests from authorities.
• Recording template downloads, and sending the Berkembang bersama Tumra newsletter (business finance tips and Tumra news, at most twice a month) only if you agree to it. You can unsubscribe at any time using the link in every newsletter email.

We do not sell personal data. We do not use your workspace data for advertising, and we do not use it to train AI models.

6. Legal bases for processing

Under the PDP Law, we process personal data on the basis of:

• Performance of our agreement with you: account data, workspace data, subscriptions and service emails.
• Legal obligations: for example keeping billing and tax records, and lawful requests from authorities.
• Legitimate interests: security, abuse prevention, sign-in rate limiting, audit trails and service improvement, with due regard for your rights.
• Consent: for example when you sign in with Google, use the AI assistant, connect an AI app through MCP, or submit a sign-up. Consent can be withdrawn at any time without affecting earlier processing.

For data we process as a processor, the legal basis is determined by you as the controller.

7. AI assistant, BYOK and MCP connections

7.1 How the assistant works

The AI assistant answers questions by reading workspace data through tools that can only read, and only the data the user asking is allowed to see under their role. The assistant does not create or change data on its own. It can prepare drafts (for example tasks, projects, clients or time entries) that are saved only after the user confirms them. Unconfirmed drafts expire after one hour.

Each time a user asks a question, we send the following to the AI provider:

• The user's question and up to eight previous turns of the conversation.
• The workspace name, the user's name and role, today's date, and the name of the page or record currently open.
• Additional instructions written by the workspace admin or by us.
• The results of tools called by the model, for example client names, invoice amounts, project status or financial summaries.

Conversation history is stored so it can be continued, can be read only by the user concerned, and is deleted automatically after 30 days or when it falls outside that person's 20 most recent conversations. An Owner or Admin can turn off the assistant for the whole workspace.

7.2 AI providers

• With AI credits from your Tumra plan: data is sent to DeepSeek, the AI provider we chose. DeepSeek processes and stores data in the People's Republic of China (see Section 9).
• With your own API key (BYOK): data is sent to the provider you choose, namely Google Gemini, OpenAI, DeepSeek, Groq, OpenRouter, or an OpenAI-compatible custom endpoint you specify. Your API key is stored encrypted and is never shown back in full.

AI providers process data under their own terms, including which country data is processed in and whether data is used to train models. If you use BYOK, you choose the provider and are responsible for checking its terms. If you do not want workspace data sent to an AI provider, an Owner or Admin can turn off the assistant for the whole workspace.

7.3 MCP connections

Some plans let you connect external AI apps that support MCP (Model Context Protocol), for example Claude or ChatGPT, to your workspace. A connection becomes active only after you sign in to Tumra and approve the permission screen. On that screen you choose whether the connection may read financial data and whether it may save drafts as data. Both are off by default.

The tools available through MCP only read data you can already see in Tumra. Data received by the external app is processed by its provider under their terms and is outside our control. You can view and revoke connections at any time from the settings.

8. Who receives data

We share data only as far as necessary, with:

• Infrastructure providers: the servers and database the service runs on, located in Singapore, and Cloudflare as the network and security service in front of the site and the app.
• Email delivery provider: Resend. Resend receives the recipient's address and the content of the email, and keeps the newsletter contact list for people who join Berkembang bersama Tumra.
• Google, if you choose to sign in with Google.
• Midtrans, our payment provider, to process subscription payments.
• AI providers, as described in Section 7.
• Exchange-rate service (Frankfurter). We only send currency codes, without personal data.
• Parties you connect yourself, for example AI apps through MCP or your WooCommerce store.
• Your clients, through the client portal and invoice emails, according to the access you give.
• Competent authorities, when required by law.
• A buyer of our business in a merger or acquisition, with notice to you.

Authorised Tumra staff can see account data, subscriptions, problem reports and feedback on assistant answers through internal administration tools. Those tools do not provide access to the content of your bookkeeping or business data in your workspace. We access that data only when you ask us to for support, when needed to handle a security incident, or when required by law.

9. Transfers of data outside Indonesia

Some of the providers in Section 8 process data outside Indonesia, including:

• Singapore: the servers and database the service runs on.
• United States: Resend (email), Google (sign in with Google) and Cloudflare (global network).
• People's Republic of China: DeepSeek, for the AI assistant with credits from your Tumra plan.

We make these transfers in line with Article 56 of the PDP Law: to countries with an equal or higher level of data protection, with adequate and binding safeguards, or on the basis of your consent. For the AI assistant with Tumra credits, the transfer is based on your consent when you use that feature. You can withdraw that consent by stopping using the assistant, using your own API key, or asking an Owner or Admin to turn it off.

If you choose an AI provider yourself through BYOK or connect an app through MCP, data is sent to the location of the provider you chose.

10. How long data is kept

• Account and workspace data: for as long as the account and workspace are active.
• AI assistant conversation history: at most 30 days, and only the 20 most recent conversations per person.
• Unconfirmed assistant drafts: one hour.
• Team members removed from a workspace: their account is deactivated, not deleted, because work and bookkeeping records still refer to them.
• Audit trail: kept for as long as the workspace exists, including after the "Reset data" feature is used.
• Subscription bills and payment records: 10 years, in line with document retention duties under tax regulations.
• After an account or workspace is closed: you can request a copy of your data within 30 days. After that, data is deleted or anonymised within 90 days, except data that must be kept by law.
• Data backups: database backups are made daily and kept for at most 7 days, then deleted automatically.
• Template download records: 90 days if you do not join the newsletter. If you join Berkembang bersama Tumra, your address stays on the contact list until you unsubscribe, and the consent record is kept as proof until you ask us to delete it.

11. Security

The security measures we apply include:

• Passwords are stored as scrypt hashes with a unique salt. Passwords must be at least 10 characters, and very common passwords are rejected.
• Verification, password-reset and invitation links are stored only as hashes, are single-use and expire.
• AI API keys, integration credentials and other secrets we store on your behalf are encrypted with AES-256-GCM.
• Sign-in sessions use signed cookies that page scripts cannot read and that end after at most 30 days. You can sign out of all other devices, and changing your password ends old sessions.
• Each workspace's data is kept separate, and access is controlled by role. Staff can be limited to the clients and projects assigned to them.
• Sign-in attempts are rate-limited, and requests from other sites that change data are rejected.
• Uploaded images have their type checked from the file content and are served only after an access check.

No system is completely secure. Keep your password confidential and tell us straight away if you suspect misuse.

If a personal data protection failure occurs, we will notify you and the competent authority in writing within 3 x 24 hours, in line with Article 46 of the PDP Law. The notice will describe the data affected, when and how the incident happened, and the steps taken to handle it and recover. For data we process as a processor, we will notify you as the controller so that you can meet your own obligations.

12. Your rights

Under the PDP Law, you have the right to:

• Be informed of who we are and of the purpose and basis of processing.
• Access and obtain a copy of your data.
• Correct data that is wrong or incomplete.
• Ask for processing to end and for data to be deleted.
• Withdraw consent.
• Object to decisions made solely by automated means that have significant effects.
• Ask for processing to be postponed or restricted.
• Move your data in a commonly used format.
• Sue and receive compensation for breaches in the processing of your data.

Some of these rights you can exercise directly in the app:

• Change your profile, password and language, and sign out of all devices.
• Revoke MCP connections.
• Export data to spreadsheets through Settings → Data Export, including clients, contacts, vendors, projects, tasks, products and stock, invoices, payments, expenses, journals, time entries, stock history and financial reports, one at a time or all together in a single ZIP file. This feature is available to Owners and Admins.
• As an Owner, delete workspace data with "Reset data".

Closing an account or workspace is not yet available as a button in the app and is done on request.

For other rights, send a request to [email protected]. We may need to verify your identity, and we will respond within 3 x 24 hours of receiving the request for rights where the PDP Law sets that deadline.

If your data was recorded by a Tumra customer (for example you are a client of a business that uses Tumra), contact that business first, because they are the controller of your data.

13. Cookies and browser storage

13.1 The tumra.id website

The tumra.id website uses Google Analytics 4 to count visits. Google sets analytics cookies (such as _ga) and receives data such as pages viewed, approximate location, device type and IP address. Apart from that, the site only stores your light or dark theme choice in your browser's localStorage, which is never sent to our servers.

13.2 The Tumra app

The app uses only cookies needed for the service to work and to remember your choices. We do not use advertising or analytics cookies in the app.

• tumra_session and tumra_client_session: keep you signed in (team users and client portal users), for at most 30 days.
• tumra_oauth_state, tumra_oauth_verifier, tumra_oauth_nonce, tumra_oauth_intent and tumra_oauth_signup: secure the sign-in with Google, valid for about 10 minutes.
• tumra_locale and tumra_theme: your chosen language and theme, for up to one year.
• tumra_sidebar_collapsed, tumra_sidebar_group and tumra_dash_tab: the side menu layout and the last dashboard tab.

The app also keeps some preferences in your browser's localStorage, for example page bookmarks, recently opened records, the assistant panel state, receipt paper size and the dashboard currency choice. This data stays in your browser. Some of it is cleared when you sign out, and all of it can be cleared through your browser settings.

14. Children

Tumra is a service for businesses and is not intended for people under 18. We do not knowingly collect children's personal data. If you know of an account belonging to a child, contact us so we can follow up.

15. Changes to this policy

We may update this policy. The effective date at the top will be changed. For important changes, we will notify account owners by email or in-app notice at least 14 days before they take effect.

16. Contact

PT SCND Digital Kreatif (SCND.Digital)
Komp. Deplu 76 Pondok Aren, Jl. Caraka 6 Blok C No. 23, Tangerang Selatan, Banten, Indonesia

• Privacy and questions about Tumra: [email protected]
• Company: [email protected]

If you are not satisfied with our response, you can file a complaint with the personal data protection authority under the PDP Law.