Privacy Policy
PT GLOBAL RAYA ORIS WIJAYA, Yogyakarta, Indonesia, is the controller of personal data described here. Questions and requests go to support@nucifra.com.
Effective 6 September 2026 · version 1.2
01. What we collect
Account data. Your email address, the provider you sign in with, your plan, your country, and the IP address you signed up from. We also keep a one-way hash of your email address. The hash lets us stop one person from opening many free accounts; it cannot be read back into an address.
Authentication data. One session cookie. We store each API key as a hash, never in readable form, and the dashboard shows only its first characters.
Billing data. Your plan, your subscription status, and the customer identifier our merchant of record returns. We never receive or store your card number. Our merchant of record collects your name and billing details directly from you at checkout, as its own controller; we do not receive them.
Usage data. The number of bytes and objects you store, the name, size and upload time of each object, and monthly totals. We also log the service email we send you, and whether it arrived.
Your Content. The files you send us. Your Content may itself contain personal data. Where it does, you are the controller and we act as processor under the Data Processing Addendum.
02. Why we process it
To provide and secure the Service and perform our contract with you; to bill you and meet tax and accounting obligations; to prevent abuse, fraud and denial of service; to provide support; and to send service notices such as maintenance, security and billing messages. We process on the bases of contract, legal obligation, legitimate interest and, where required, your consent. Marketing email is sent only with consent and each message includes an unsubscribe link.
03. What we do not do
We do not sell personal data. We do not use your Content or usage data to train machine learning models. We do not scan Content for advertising purposes. We do not read the contents of your objects except where you ask us to for support, where automated abuse detection flags a file, or where the law requires it.
04. Sharing and transfers
We share data with two sub-processors, both named in the Data Processing Addendum: Cloudflare, Inc. for hosting, storage, delivery and service email, and Armitage Labs OÜ, which operates Creem, for billing. We also share with professional advisers under confidentiality, and with authorities where a valid legal request applies.
If you sign in with Google or with GitHub, that provider tells us your email address and a stable account identifier. Those providers are not our sub-processors. You choose to authenticate with them, and their own privacy notice governs what they do with your sign-in.
Our sub-processors operate outside Indonesia, so personal data is transferred internationally. Section 05 of the Data Processing Addendum names the safeguard that applies to each one.
05. Retention
Account data is kept while your account is active and for 12 months after closure. Usage logs are kept for 12 months. Billing records are kept for 10 years to meet Indonesian tax and company law requirements. Content is deleted from live systems within 30 days and from backups within 90 days of deletion or account closure.
06. Your rights
Under Law No. 27 of 2022 on Personal Data Protection you may request access to your data, correction of inaccurate data, deletion, restriction of processing, a copy in a portable format, and withdrawal of consent. You may also object to processing based on legitimate interest. Write to support@nucifra.com; we may ask for proof of identity. Where Law No. 27 of 2022 sets a deadline, we meet it: we correct inaccurate data and give you access to the data we process about you within 3 x 24 hours of your request, and we act on a withdrawal of consent or a request to restrict processing within the same period. For a request with no deadline in the law, we respond within 30 days. If you are unsatisfied you may complain to the Indonesian authority responsible for personal data protection; until the authority established under Law No. 27 of 2022 begins work, the Ministry of Communication and Digital Affairs handles those complaints.
07. Security
Data is encrypted in transit with TLS and at rest by our storage provider. Access to production systems is limited to named personnel, requires multi-factor authentication and is logged. API keys are stored hashed and can be rotated by you at any time. Public URLs are presigned and expire; they are not permanent addresses.
08. Data breach
This section covers the account, authentication, billing and usage data described in section 01, for which we are the controller. If a breach affects that data we will notify you and the competent Indonesian authority within 3 x 24 hours of becoming aware, as Law No. 27 of 2022 requires, and describe what happened, what data was involved and what we are doing about it.
Where a breach affects personal data inside your Content, you are the controller and we are the processor. We notify you under section 06 of the Data Processing Addendum, in time for you to make your own notification.
09. Cookies and children
The web application sets one strictly necessary cookie, which keeps you signed in. The sign-in page runs a bot check that sets its own short-lived cookie, to tell a person from a script. We run no advertising tracker, no third-party analytics and no cross-site profiling. You can block cookies in your browser, but sign-in will not work without the necessary one. The Service is not intended for anyone under 18 and we do not knowingly collect their data.
10. Changes
We will publish any new version here with its effective date and, for material changes, email the address on your account at least 30 days in advance.