Privacy policy

1. In short

We do not store your conversation content. We store account data and billing metadata needed to charge you, count quota, and meet accounting obligations.

This policy follows Indonesia's Personal Data Protection Law No. 27 of 2022.

2. What we collect

• Account identity: email, name, hashed password, and the IP address used at signup.
• Billing metadata: model, token counts, cost, request timestamp, and API key ID.
• Payment data from Midtrans: transaction status, amount, and payment method. Never card numbers or PINs.
• Technical preferences: your chosen language and currency.
• Messages you send to support, if you contact us.

3. What we do not store

• Prompt content and model responses. They are processed and released, not written to our database.
• The contents of files or images you send through the API, beyond size and token metadata.
• Your chat history in any app built on NusaGate. That stays on your side, not ours.

4. Where data travels

• Midtrans, to process payments and transaction status.
• Upstream model providers, which receive request content in order to produce an answer. Their policies apply on their side.
• The server and CDN providers running this service, under restricted operational access.

5. Why we process it

To deliver the service you paid for, meter usage and billing, prevent abuse and fraud, provide support, and meet legal obligations such as accounting and tax.

6. How long we keep it

• Billing metadata: while the account is active, then up to 24 months after closure for accounting and tax purposes.
• Account data: while the account is active. After closure, identity data is deleted or anonymised within 30 days, except where law requires retention.
• Prompt content and responses: never stored.

7. Cookies

We use only what the service needs: login session, language preference, and currency choice. No advertising cookies, no third-party trackers building a profile of you.

8. Security

Passwords are stored with scrypt, API keys are not stored in readable form, and database access is limited to operations. No system is risk-free, so guard your own credentials too.

9. Your rights

• See the personal data we hold about you.
• Ask for inaccurate data to be corrected.
• Ask for deletion, where it does not conflict with a legal retention duty.
• Ask for a copy of your data in a machine-readable format.
• Withdraw consent and lodge a complaint with the data protection authority.

10. Children and policy changes

This service is not for anyone under 18. If we learn an account belongs to a child, we close it.

This policy may be updated. The current version always lives on this page with its date, and we announce material changes by email or in the dashboard.

Data questions: nusagate@nusagate.com.