Privacy Policy

This Privacy Policy explains how PT Sawah Cyber Security processes personal data in the SiberWisata portal and Email Protection service, in line with Indonesia’s Personal Data Protection Law (UU PDP No. 27/2022).

1. What we process

• Portal users: name, email address and profile picture from Google sign-in; actions taken in the portal (audit log).
• Monitored accounts: security event metadata such as user names and email addresses, IP addresses and approximate location, device/browser details, mailbox rule and forwarding settings, third-party app names and permissions, and provider security alerts.
• We do not read or store the content or attachments of email messages. For Gmail accounts we only read the metadata of Google’s own security notification emails.

2. Why we process it

To detect and investigate account takeover, fraud and misuse of the Customer’s email accounts, and to operate, secure and improve the Service. The Customer is the data controller for monitored-account data; we act as processor.

3. Where it is stored

[Placeholder — hosting location, sub-processors and cross-border transfer safeguards to be inserted.]

4. Security

Access credentials are encrypted at rest (AES-256-GCM); access to data is restricted per organisation and every administrative action is logged.

5. Retention

Security events are deleted automatically after 400 days. Portal account data is kept while the account is active.

6. Your rights

Data subjects may request access, correction or deletion of their personal data through the Customer or by contacting us at [email protected].