Privacy Policy

PT Wastu Peladen Nusantara ("we", "us", "our", or "Company"), operating as Cloudnan, is committed to protecting your privacy. This policy describes what information we collect, how we use it, and what choices you have. By using the Service, you agree to the collection and use of information described here.

1. Information We Collect

We collect only what is necessary to provide and improve the Service:

Account information

• Name and email address
• Hashed password (we never store plaintext passwords)
• Phone number (for two-factor authentication via WhatsApp)
• Organization name and billing address

Payment information

• Payment transactions are processed by our payment providers. We store transaction IDs and plan status, but never raw card numbers or bank credentials.

Operational metadata

• Agent connection status and version for each registered server
• System resource metrics (CPU, memory, disk, network) — aggregated and displayed in your dashboard
• Command execution logs (command type, timestamp, exit status — not content of output unless you explicitly view it)
• IP addresses of connecting agents and dashboard sessions

Usage and analytics

• Feature usage patterns (which sections of the dashboard you use)
• Error logs and crash reports to help us improve stability
• Browser type, OS, and session duration for support purposes

2. Your Files in Cloudnan Storage — Encrypted at Rest

Cloudnan Storage allows you to upload and retain files on Cloudnan infrastructure — including database dumps, source code archives, configuration backups, and other sensitive data. When you use Storage, we do hold those files. Here is exactly how:

Outside of Storage, the Cloudnan agent operates the same way: it relays commands you initiate and streams operational metrics (CPU, memory, disk, network). It does not transmit file contents, database records, or application data to our control plane during normal operation.

You are solely responsible for safeguarding your encryption key. If a key is lost, the associated stored data cannot be recovered by Cloudnan or any third party. We strongly recommend keeping a secure, offline copy of your encryption key.

3. How We Use Your Information

We use the information we collect solely to:

• Create and manage your account and organization
• Provide, maintain, and improve the Service
• Process subscription payments and send receipts
• Send security alerts, service status updates, and important notices
• Respond to support requests and inquiries
• Detect and prevent fraud, abuse, and unauthorized access
• Analyze aggregate usage patterns to improve product features

We do not use your information to serve targeted advertisements, build behavioral profiles, or sell to data brokers. We do not sell your personal information under any circumstances.

4. Data Storage and Security

We apply multiple layers of protection to the data we do hold:

• All stored data is encrypted at rest using AES-256
• All network traffic — including agent-to-control-plane communication — is encrypted with TLS 1.3
• Passwords are stored as salted hashes (bcrypt); plaintext is never retained
• Access to production systems is restricted to authorized personnel only, protected by multi-factor authentication
• We perform regular security reviews of our infrastructure
• Backup files are encrypted with client-controlled keys before storage — even our storage infrastructure cannot read them

If you believe you have found a security vulnerability, please report it responsibly to [email protected].

5. Data Sharing

We do not sell, trade, or rent your personal information. We may share limited data only with:

• Service providers — trusted vendors who process payments, send transactional emails, or provide infrastructure. They are contractually bound to process data only as directed by us.
• Legal authorities — when compelled by law, court order, or to protect the safety of users. We will notify you of any such request where permitted by law.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will provide prominent notice before this occurs.

Any sharing is limited to account-level data (name, email, subscription status). We have no server data or file content to share.

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your account and associated personal data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to certain types of processing, including direct marketing
• Restriction — request that we restrict processing while a dispute is resolved

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

7. Cookies and Local Storage

We use minimal cookies and browser storage:

• Authentication tokens — stored in secure, HttpOnly cookies to keep you logged in
• Preferences — stored in localStorage to remember settings like your selected currency or theme
• Session data — temporary data used during your session, cleared on logout

We do not use third-party advertising cookies or tracking pixels. You can clear cookies through your browser settings; doing so will log you out.

8. Data Retention

We retain your data for the following periods:

• Account data is retained while your account is active and for 30 days after deletion
• Billing records are retained for 7 years as required by financial regulations
• Security and access logs are retained for up to 90 days
• Encrypted backup files are deleted within 30 days of account deletion

After retention periods expire, data is securely deleted or anonymized.

9. International Data Transfers

Cloudnan is based in Indonesia. If you access the Service from outside Indonesia, your account data may be transferred to and processed in Indonesia or other countries where our infrastructure or service providers operate. We ensure appropriate safeguards — such as contractual clauses with service providers — are in place for any international transfer, consistent with applicable data protection laws.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be communicated via email and a notice on the platform at least 14 days before taking effect. We encourage you to review this policy periodically.

12. Contact Us

For questions, concerns, or requests related to this Privacy Policy: