Privacy Policy — Ambisius

Operating Entity (Data Controller): PT. AMBISIUS LAB INDONESIA (doing business as "Ambisius Lab")
Digital Product & Platform: Ambisius (Web Application: https://app.ambisius.com, Website: https://ambisius.com, Native iOS and Android Mobile Applications)
Governing Jurisdiction: Republic of Indonesia (UU PDP No. 27/2022)
Last Updated: October 16, 2026
Effective Date: October 16, 2026

1. Our Privacy Commitments

At Ambisius Lab ("we", "us", or "our"), we believe that business software should be clear, honest, and respectful of your privacy. This Privacy Policy explains what information we collect when you use Ambisius, why we collect it, how we keep it secure, and how you stay in complete control of your data.

We operate under three core principles:

You own your business data. Everything you enter into your databases belongs to you.
We never sell your data or use it for ads. We make money solely from paid plans, not from advertising or data brokers.
We never use your private data to train public AI models. Your prompts and records stay strictly within your workspace.

2. Privacy Policy Details

Section 1 — Who Controls Your Data

Under data protection laws:

Your Account & Billing Data: We act as the Data Controller for basic information needed to run your account (such as your name, login email, password hash, and payment records).
Your Business & Workspace Data: Your Organization (led by the Owner) acts as the Data Controller for all records, client lists, numbers, and notes stored inside your databases. We act strictly as a Data Processor, hosting and syncing that data on your behalf.

Section 2 — Information We Collect

We collect only what is necessary to run a reliable, fast service for your team:

1. Account Information

Profile: Name, business email, profile picture (optional), and display preferences.
Credentials: Passwords are cryptographically hashed using modern industry standards (such as bcrypt/Argon2). We never store or see your plaintext password.
Sign-In with Google / Apple: If you use Google or Apple to log in, we receive your name, verified email, and an authentication token.
Team Setup: Your Organization name, business vertical (e.g., salon, auto shop, retail), and member role (Owner, Admin, or Member).

2. Your Workspace & Operational Records

Database Records: The tables, text, quantities, currency amounts, dates, and relationships you build.
Photos & Attachments: Receipts, product pictures, audio notes, and documents your team uploads.
Activity History: A timestamped audit log of who added, updated, or removed a record, so your team always knows who did what.

3. Payment & Billing Records

Invoices & Status: The plan you choose (Free, Starter, Growth), prepaid term length (1, 3, 6, 12 months), Admin seats, and payment confirmation IDs.
Payment Processing: Bank Virtual Account numbers and QRIS payment identifiers. We do not collect or store credit card numbers or private banking credentials.

4. Device & Performance Diagnostics

Device Details: Phone or computer model, operating system, app version, and screen size.
Connection & Logs: IP address, city-level location, real-time sync socket status, and crash logs to help us fix bugs quickly.

Section 3 — Mobile Device Permissions

Our mobile app asks only for permissions that are directly needed for your team’s daily work:

Camera: Used only when your staff snaps a photo (such as a finished service or proof of delivery) or scans a barcode into a form. We never access the camera in the background.
Photos / Media Library: Used only when you choose to attach an existing picture or file to a record.
Microphone: Used only if you choose to record an audio note or use voice input.

You can turn off any of these permissions at any time in your phone's settings.

Section 4 — Why We Process Your Data

Under Indonesian Law No. 27/2022 (UU PDP), we process data based on clear legal grounds:

To run the service: Creating your account, syncing databases in real time, calculating formulas, and processing prepaid invoices.
To keep things secure: Detecting unauthorized logins, preventing fraud, and keeping our servers stable.
To meet legal duties: Keeping required tax and transaction invoices under Indonesian regulations.
With your consent: When you grant camera access or choose optional settings.

Section 5 — How We Handle AI & Your Privacy

Ambisius includes an AI Agent to help you design tables, structure relations, and write formulas:

No Public AI Model Training: We do not use your private business records, customer names, or operational data to train or improve public AI models.
Context-Only Requests: When you ask the agent for help, it only looks at the necessary table structure to fulfill your request.
Strict Partner Rules: AI requests are handled through enterprise endpoints that do not retain your data after the turn is finished.

We never sell your data. We work only with reliable infrastructure partners ("Sub-processors") who help us run Ambisius securely:

Cloud Infrastructure & Hosting: Secure data centers for hosting servers, databases, and file attachments with encryption at rest (AES-256).
Sign-In Providers: Google and Apple, strictly for verifying your login identity.
Indonesian Payment Processors & Banks: Licensed payment gateways to process Virtual Account and QRIS payments.
AI Infrastructure Providers: Enterprise model APIs to process agent requests on demand without saving your prompt data.
Email & Notifications: Secure delivery services for critical account alerts, password resets, and plan notices.

All partners are legally bound to protect your data with standards that meet or exceed our own.

Section 7 — Security Measures

We protect your information using modern security practices:

Encryption in Transit: All traffic between your browser or phone and our servers uses TLS 1.3 / HTTPS and secure WebSockets.
Encryption at Rest: All stored databases, file attachments, and backups are encrypted using industry-standard AES-256.
Isolated Workspaces: Each Organization's data is strictly partitioned so that only authorized team members can access it.
Role Permissions: Clear boundaries between Owner, Admin, and Member roles.
Breach Notifications: If any confirmed data incident affects personal information, we will notify the authorities and affected users within 72 hours (3 x 24 hours) as required by Indonesian law.

Section 8 — How Long We Keep Data

Active Organizations: We keep your data as long as your Organization remains active.
Export Anytime: The Owner can export your full data to Excel (.XLSX) at any time.
Grace Period & Free Plan: When a paid term ends, you have a 14-day grace period. After that, you move to the permanent Free plan.
Restricted Mode: If your records exceed Free limits after downgrading, the Organization enters Restricted Mode for up to 90 days. During this time, the Owner can still export everything. After 90 days without action, the Organization is permanently deleted, with warning emails sent at 30, 7, and 1 day prior.

Section 9 — Your Privacy Rights

Under Indonesian Law No. 27/2022 (UU PDP), you have clear rights over your personal data:

Right to Access: You can ask to see and receive a copy of your personal data.
Right to Correct: You can update or correct inaccurate profile details at any time.
Right to Delete: You can delete your account and personal data (see Section 10).
Right to Data Portability: You can download all your data in standard Excel (.XLSX) format.
Right to Withdraw Consent: You can turn off device permissions or withdraw consent for optional features.

To exercise any of these rights, email us at privacy@ambisius.com. We respond promptly to all verified requests.

Section 10 — How to Delete Your Account

You can delete your account directly inside the app:

On Mobile (iOS & Android): Go to Profile → Account Settings → Delete My Account.
On Web (app.ambisius.com): Go to Profile (bottom-left) → Account Profile & Security → Delete My Account.
Deleting an Entire Organization (Owner only): Go to Organization Settings → General Settings → Delete Organization.
By Email: You can also email privacy@ambisius.com to request deletion.

When an account is deleted, your credentials and personal info are removed immediately, and cloud backups are overwritten within 30 days.

Section 11 — Children's Privacy

Ambisius is built strictly for businesses and working professionals. We do not knowingly offer accounts or collect data from anyone under 18 years of age.

Section 12 — Changes to This Policy

When we update this policy, we will update the date at the top of the page. If there are major changes, we will notify Owners via email or an in-app banner at least 14 days in advance.

Section 13 — Contact Us About Privacy

If you have any questions or feedback about privacy or security, please contact our team:

Company: PT. AMBISIUS LAB INDONESIA (Ambisius Lab)
Product: Ambisius
Location: BSD City, Tangerang, Indonesia
Privacy Email: privacy@ambisius.com
General Support: support@ambisius.com
Security Reports: security@ambisius.com
Privacy Web Page: https://ambisius.com/privacy-policy

Privacy Policy and Data Security