Privacy Policy

PT Pikir Jernih Teknologi (“thinkclarITy”, “we”, “us”) operates the website thinkclarity.id and the software-as-a-service products clarITy DEX and clarITy ITSM (together, the “Services”).

This policy explains how we handle personal data under the laws of the Republic of Indonesia, including Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”). You can reach us about privacy at hello@thinkclarity.id.

For data about our own customers and website visitors, such as account details, enquiries and billing records, we decide how the data is used and act as the personal data controller.

For data that a customer organization puts into clarITy DEX or clarITy ITSM, such as device telemetry and service-desk tickets about its own staff, the customer organization generally decides how that data is used. In that case we process it on the customer’s behalf and under its instructions, as set out in our agreement with that customer. If you are a user at one of our customers, please contact your organization first about that data.

Account and contact details. When you create an account or send us a request, we collect what you enter, such as your name, email address, company and message. Passwords are stored as a one-way hash, not as the original text.

Sign in with Google. Where Google sign-in is offered, such as in the clarITy DEX app, and you choose to use it, we receive only your name, email address and basic profile information from Google. We do not request other permissions on your Google account.

clarITy DEX device telemetry. The clarITy DEX agent runs on devices that a customer organization chooses to manage, so that the customer can see and improve device health. Depending on the agent version, the operating system and the customer’s settings, it can collect:

• device identifiers: hostname, the signed-in username, serial number, model, operating system and hardware details;
• network identifiers: MAC address, IP addresses, and the Wi-Fi network name (SSID) and access-point identifier (BSSID), with signal quality;
• installed applications and how they are used, including which application is in the foreground, for how long and how often;
• performance, battery, security and update status, running processes and their resource use, and records of application crashes and hangs (metadata, not memory contents);
• remediation records: the scripts run, who requested and approved them, their output, and an audit trail;
• employee sentiment survey scores and any free-text comments; and
• diagnostic logs, when a customer requests them for a device.

The clarITy DEX collectors do not read browser history, the web addresses (URLs) people visit, or the content of chat messages. Text that people write themselves, such as survey comments or support requests, and diagnostic logs can still contain such information. clarITy DEX does record application usage, as listed above.

AI features. clarITy DEX contains optional AI features. They are switched off, and no external AI provider currently receives data from the Services. If they are switched on, text is first filtered by pattern-based redaction, which removes some identifiers but is not complete anonymization, and the provider will be named in this policy.

clarITy ITSM content. Where a customer uses clarITy ITSM: the tickets, requests, comments and attachments that its users submit, and the names and contact details of the people involved.

Billing. Plan, quantity, invoices and payment status. We do not store payment card details on our systems.

Technical data. Cookies needed for sign-in and security, settings kept in your browser (such as theme and cart), and request logs (such as IP address and browser type) that our servers keep for operation and security. The website thinkclarity.id does not use analytics or advertising trackers.

We use personal data to:

• provide, secure and support the Services and your account;
• respond to demo, proposal and support requests;
• manage trials, subscriptions, invoices and payments;
• send service and account emails, such as sign-in, billing and trial notices;
• meet our legal, tax and accounting obligations; and
• protect the Services, our customers and us against misuse.

We rely on the bases available under the PDP Law, which include performing our contract with you, meeting legal obligations, our legitimate interests, and your consent where consent is required. Where we rely on consent, you can withdraw it at any time. That does not affect processing that already took place.

We do not sell personal data.

We use service providers that process personal data on our behalf, under contract and only for the purposes above:

• Hosting: Biznet, an Indonesian hosting provider, hosts the servers that run the website and the Services. clarITy DEX data is stored in a database on those servers.
• Website database: website accounts, requests and orders are stored in the thinkclarITy site database, a managed cloud database provided by Turso. It is separate from the Biznet servers that run the website, and Turso may process this data outside Indonesia.
• Domain, edge protection and incoming email: Cloudflare provides the domain name service for thinkclarity.id, edge protection for the website, app, sign-in and download services where it is enabled, and routes email sent to our thinkclarity.id addresses, such as hello@ and security@.
• Email delivery: the Services are configured to send email, such as sign-in, account, billing and trial notices, through Resend, an email delivery provider, which may process this email outside Indonesia.
• Payments: online payment is not active yet. When it is, payments will be processed by Xendit under its own terms, and we will receive the payment status, not your full card details.
• Sign-in: Google, when you choose to sign in with Google, under Google’s own terms.

We may also disclose personal data when the law requires it, or in connection with a merger or sale of our business, subject to this policy.

Some of the providers above may process personal data outside Indonesia: Turso for the website database, Resend for email delivery, Cloudflare and Google on their own networks, and Xendit once online payment is active. When personal data is transferred outside Indonesia, we take the steps the PDP Law requires for such transfers.

We keep personal data only as long as we need it for the purposes above, or as long as the law requires us to.

• When a free trial ends without a paid subscription, the workspace becomes read-only.
• When a paid subscription is cancelled, access continues until the end of the paid period. The workspace then becomes read-only. If a renewal is not paid, a 7-day grace period applies first.
• A read-only workspace is kept for about 30 days. It is then deleted from the Services: access is turned off and the workspace stops working, but its data is not yet physically erased.
• Physical erasure of a deleted workspace happens when the customer asks for it, or under our retention schedule. We do not promise automatic erasure after a fixed period.
• Routine database backups are normally kept for 14 days. Backups made for maintenance, for example before an update, may be kept longer until they are deleted. Data erased from the live system can remain in backups until then, and we do not commit to a fixed time for restoring or erasing data in backups.
• Invoices and payment records are kept for as long as tax and accounting law requires.

A customer organization can ask us to export or delete its data. See the next section.

Subject to the PDP Law, you can ask us to:

• tell you about, and give you access to, the personal data we hold about you;
• correct or complete inaccurate data;
• delete data, or end or restrict processing;
• provide your data in a commonly used format, or export a customer workspace;
• withdraw consent you gave; and
• object to decisions based only on automated processing that significantly affect you.

Send your request to hello@thinkclarity.id. If you have an account, you can also use the support portal. We may need to confirm your identity first, and we will respond within the time the law requires. If the data is held for one of our customers, we will pass your request to that customer or help it to respond.

You may also complain to the authority responsible for personal data protection in Indonesia.

We use technical and organizational measures that are appropriate to the risk, such as access control, encrypted connections and hashed passwords. No system is completely secure, and we cannot guarantee that data will never be accessed without authorization. If a personal data breach occurs, we will notify the affected people and the authority as the PDP Law requires.

More about how we approach security is on the security page.

The Services are for businesses and are not directed at children. We do not knowingly collect personal data from children.

We may update this policy, for example when the Services or our providers change. We will publish the new version on this page with its date and, where the change is significant, tell customers by email or in the Services.

This policy is also available in Bahasa Indonesia. If the two versions differ, the English version prevails, unless the law requires otherwise.

PT Pikir Jernih Teknologi, trading as thinkclarITy. Email: hello@thinkclarity.id.