Privacy Policy
This Privacy Policy details how Humalyze AI collects, processes, protects, and disposes of personal data across our public simulation platform, APIs, and client portals.
Data Controller & Data Protection Officer (DPO)
Humalyze AI operates as the Data Controller (“Pengendali Data Pribadi”) for registered user profile and billing data under Indonesian Law No. 27 of 2022 (UU PDP) and Regulation (EU) 2016/679 (GDPR).
Data Protection Officer (DPO / PPDP): Office of Data Governance
Email: humalyzeofficial@gmail.com
Security & Privacy Escalation: humalyzeofficial@gmail.com
Lawful Bases & Categories of Data Collected
We process personal data strictly under recognized lawful bases (UU PDP Pasal 20; GDPR Art. 6):
- Identity & Account Data: Email address, name, authentication IDs, and optional verification data. Basis: Contractual Performance (UU PDP Pasal 20(2)(b)).
- Billing & Transactional Records: Tax identifier, subscription tier, credit consumption history, and payment gateway tokens. Basis: Legal & Statutory Tax Obligations (UU PDP Pasal 20(2)(c)).
- Telemetry & Security Logs: IP address, browser headers, request timestamps, and threat mitigation telemetry. Basis: Legitimate Security Interest (UU PDP Pasal 20(2)(f)).
- Simulation Queries & Context Documents: Ephemeral prompt text and uploaded background PDFs processed in real-time. Basis: Explicit User Consent and Contractual Instructions.
Zero AI Model Training Disclosure
Customer Data Privacy Commitment
Humalyze AI operates strict zero-retention model gateways. Your private scenario inputs, proprietary policy texts, and simulation outputs are NEVER used to train, retrain, or improve foundational AI models. Enterprise customer inputs remain strictly confidential and isolated to the executing runtime.
Your Statutory Data Rights (UU PDP Pasal 5–13 & GDPR)
As a data subject, you hold comprehensive rights enforceable at any time:
Right of Data Portability (Art. 40 / Pasal 13)
Download a complete, machine-readable JSON export of your profile, simulations, and consent records via Privacy Settings.
Right to Erasure (Art. 43 / Pasal 8)
Initiate permanent cryptographic deletion of your account and historical simulations with a 30-day grace safeguard.
Right to Rectification (Pasal 6)
Update, modify, or correct your personal account records immediately within your profile dashboard.
Right to Object to Automated Profiling (Pasal 10)
Request human review or dispute automated simulation scoring decisions affecting your profile.
Cross-Border Data Transfers (UU PDP Pasal 56)
Humalyze AI infrastructure operates across distributed serverless regions. In full compliance with Indonesian UU PDP Article 56, cross-border transfers occur only to jurisdictions with equivalent statutory protection, or under binding Data Processing Agreements and Standard Contractual Clauses (SCCs) enforcing strict confidentiality and encryption standards.
Security Safeguards & Mandatory 72-Hour Breach Protocol
We apply TLS 1.3 in-transit encryption, AES-256 at-rest database encryption, DNS-pinned SSRF-safe transports, and sandboxed PDF processing. In compliance with UU PDP Pasal 46 and GDPR Article 33, any verified data breach posing risk to user rights will be officially reported to competent supervisory authorities and affected individuals within seventy-two (72) hours (3 x 24 hours).