# DBenk privacy policy **Version 1.0, effective 1 November 2026.** Versi bahasa Indonesia: [Kebijakan privasi](https://dbenk.com/privasi). This policy explains which personal data we collect, why, how long we keep it, with whom we share it, and how you exercise your rights, under Indonesian Law No. 27 of 2022 on Personal Data Protection ("PDP Law"). Section 4 covers the **Google user data** we receive when you use "Sign in with Google". ## 1. Who we are - **DBenk** ("DBenk", "we") makes and sells the **DBenk Hub** software and its modules (attendance and 3D office, server/DevOps console, Vita AI workers). DBenk Hub is installed on the customer's own server. - Services we operate ourselves and that this policy covers: the [dbenk.com](https://dbenk.com) website (including the trial form at [/en/try](https://dbenk.com/en/try), contact and demo requests), the license server and **customer portal** at [lisensi.dbenk.com](https://lisensi.dbenk.com/portal), the DBenk **vendor console** (used by DBenk staff), the download channel [get.dbenk.com](https://get.dbenk.com), and the public demo [demo.dbenk.com](https://demo.dbenk.com). - Privacy contact: [halo@dbenk.com](mailto:halo@dbenk.com) or the contact form at [https://dbenk.com/en/#kontak](https://dbenk.com/en/#kontak). ## 2. Who controls which data - **License, contact, trial, portal/console account, and billing data** you send us is processed by **DBenk as Personal Data Controller**. This policy covers that data. - **Employee and user data in your company's DBenk Hub** (accounts, attendance, laptop agent status, module content) is stored **on your company's own server**. For that data **your company is the Controller**. DBenk does not receive it in normal operation. If your company's Hub offers "Sign in with Google", that Hub uses a Google OAuth client set up by your company and the Google data goes to your company's server, not to DBenk. - When you ask for support that lets us see data on your server (e.g. a shared screen session or a Diagnostics file you send us), we act as a **Personal Data Processor** on your behalf, only for that request, under the [Data Processing Agreement](https://dbenk.com/en/dpa). ## 3. Data we collect 1. **Trial sign-up**: company name, your name, work e-mail, phone/WhatsApp (optional), number of employees, modules of interest, language, and network prefix (/24 IPv4 or /48 IPv6, never the full IP address) to prevent abuse. 2. **Contact and demo request forms**: name, company, e-mail, phone (optional), number of employees, message, the demo time you choose, and network prefix. 3. **Customer portal and vendor console accounts**: name, e-mail, sign-in method (e-mailed sign-in link, password and authenticator code, or Sign in with Google, see section 4), sign-in times, and an audit trail of actions (without secret values). 4. **Customers and billing**: name and legal entity, tax ID, address, billing/technical contacts, invoices, payments, portal requests. 5. **License renewals from your Hub (license telemetry)**: install id, license number, Hub version, and the **number** of active people, servers and Vita slots (counts only), renewal time, and network prefix. **No** user names, employee e-mails, attendance data, or module content. 6. **Page visits**: a count of visits per page per day on our own server, **without cookies, without storing IP addresses, and without any third-party analytics or advertising service**. 7. **Technical logs**: web server and application logs (time, requested address, status code, IP address, browser type) for security and troubleshooting. We do not ask for specific (sensitive) personal data such as health, biometric, or personal financial data. ## 4. Google user data ### 4.1 Where we use Sign in with Google "Sign in with Google" (Google Sign-In, OpenID Connect) is an optional sign-in method in services operated by DBenk: the **customer portal** at lisensi.dbenk.com, the **trial sign-up** started from dbenk.com, the DBenk **vendor console** (DBenk staff only), and the sign-in page of **Vita** (vita.dbenk.com) and DBenk Hubs operated by DBenk itself. Other sign-in methods (an e-mailed sign-in link, or a password with an authenticator code) remain available. ### 4.2 Google data we access We request only the **`openid`, `email`, and `profile`** scopes (some services only `openid` and `email`). From Google we receive at most: - your **Google account ID** (unique identifier, the `sub` claim); - your **e-mail address** and **whether Google has verified it** (`email_verified`); - your **name** (the Google account display name); - your **profile picture URL** (part of the `profile` scope; we do not use or store it). We do **not** request access to Gmail, Google Drive, Calendar, Contacts, or any other Google data, and we do **not store** Google access tokens or refresh tokens. The ID token from Google is used once at sign-in to verify who you are. ### 4.3 How we use Google data Only to: (a) **sign you in and create or match your account** in the portal/console (the Google-verified e-mail is matched with the account or trial sign-up e-mail); (b) show your name in the portal; and (c) **contact you about your license, trial, or invoices** at that e-mail address. For no other purpose. ### 4.4 What we never do - We do **not** use Google user data for advertising, including personalized, retargeted, or interest-based advertising. - We do **not sell** Google user data and do not give it to data brokers, advertisers, or anyone else. - We do **not transfer** Google user data to others, except as necessary to provide the service you asked for (our servers and e-mail provider in section 7), for security, to comply with the law, or as part of a merger or acquisition with prior notice to you. - We do **not** allow humans to read that data, except with your consent, for security purposes (e.g. investigating abuse), to comply with the law, or when the data is anonymized and aggregated for internal operations. - We do **not** use Google user data to train artificial intelligence or machine learning models. ### 4.5 Limited Use disclosure DBenk's use and transfer of information received from Google APIs to any other app will adhere to [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. ### 4.6 Storage and security Google data is stored with your account in a database on servers we manage **in Indonesia**. All connections use **HTTPS/TLS** (encrypted in transit). Application secrets (keys, OAuth client secrets, SMTP password) are **encrypted with AES-256-GCM** at rest. Access to the database and console is limited to authorized staff with sign-in and two-step verification, and every console action is recorded in an audit log. ### 4.7 Retention of Google data Google data is kept **while your account is active**. After the account is closed or you ask for deletion, it is deleted **within 30 days**, except an e-mail address that appears on invoices we must keep under tax rules (section 9). Technical logs that may contain your e-mail are kept for at most **90 days**. ### 4.8 Revoking access and requesting deletion - **Revoke access**: open your [Google account permissions page](https://myaccount.google.com/permissions), select DBenk, and remove its access. You then cannot sign in with Google until you allow it again; other sign-in methods keep working. - **Request deletion**: e-mail [halo@dbenk.com](mailto:halo@dbenk.com) from your account address, or use the form at [https://dbenk.com/en/#kontak](https://dbenk.com/en/#kontak), with the subject "Delete my data". We confirm receipt within **3 x 24 hours**, complete the deletion **within 30 days**, and let you know. ## 5. How we use data We process the data above to: issue and renew licenses (performance of the agreement), invoice and meet tax obligations (legal obligation), answer questions and schedule demos (your request / consent), sign you in to the portal and console, prevent abuse and keep the service secure (legitimate interest), and send important license and service notices. We **do not sell** personal data, do not use it for advertising, and do not build marketing profiles. ## 6. Cookies and analytics - Public dbenk.com pages use **no tracking cookies** and load **no third-party analytics, advertising, or social media scripts**. The visit counter runs on our server without cookies. - A `lang` cookie is stored only when you choose a language. - The customer portal and console use session cookies needed to keep you signed in (not used for tracking). ## 7. Sharing and processors We share data only as needed to provide the service: - **Hosting**: our servers and databases in Indonesia, and a web hosting provider in Indonesia for the static dbenk.com site and @dbenk.com e-mail. - **Content delivery and site protection**: Cloudflare delivers and protects traffic to dbenk.com; in doing so it processes request data (IP address, browser type) as a processor. - **E-mail**: our mail server (SMTP) to send verification e-mails, sign-in links, license notices, and invoices. - **Google**, only when you choose Sign in with Google (Google processes that sign-in under its own privacy policy). - Banks for the payments you make; tax consultants, auditors, or legal advisers when needed, under confidentiality; and authorities when required by law. Customer data and Google data are stored in Indonesia. Apart from the Cloudflare network traffic above, we do not transfer personal data abroad in normal operation; if that becomes necessary we will ensure equivalent protection under the PDP Law. ## 8. Security HTTPS/TLS encrypted connections; secrets encrypted with AES-256-GCM; console access only for Owners/Admins with sign-in and two-step verification; every change recorded in an audit log; licenses cryptographically signed. If a personal data protection failure occurs, we notify you and the competent authority within **3 x 24 hours** as required by the PDP Law. ## 9. How long we keep data - **Portal/console accounts and Google data**: while the account is active; deleted within 30 days after the account is closed or on request. - **Customers and billing**: while the relationship lasts, then as long as tax rules require (generally 10 years for tax documents). - **Leads and trials that do not continue**: deleted on request or at the latest 24 months after the last contact. - **Technical logs**: at most 90 days. **Visit counter**: only counts per page per day, no personal data. ## 10. Your rights under the PDP Law You have the right to information about the processing, to access and obtain a copy of your data, to correct inaccurate data, to request deletion or destruction, to withdraw consent, to object to processing, and to request that processing be suspended or restricted. Send requests to [halo@dbenk.com](mailto:halo@dbenk.com) or via the form at [https://dbenk.com/en/#kontak](https://dbenk.com/en/#kontak). We may ask you to verify your identity (e.g. by replying from the account e-mail), respond within the periods set by the PDP Law (within 3 x 24 hours for access, correction, and ending processing), and charge no fee. For employee data in your company's Hub, send requests to **the company you work for** (its controller). ## 11. Laptop presence agent (for customers' employees) The DBenk presence agent reports **to your company's Hub, not to DBenk**. It sends: display name, device name, operating system, active/idle/away status (from how long the keyboard/mouse has not been touched, not keystrokes), agent version, and unless turned off: the name of the application in front and for how long. The window description (editor project name, browser page title) is **off by default** and only turns on when the company enables it and informs employees. **Never** sent: screenshots, keystrokes, document content, URLs, file names, browsing history, or location. Employees can see exactly what is sent with `dbenk-presence status` and turn off application tracking with `dbenk-presence track off`. ## 12. Children Our services are meant for businesses and adults. We do not knowingly collect data of children under 18. If you learn that a child's data was sent to us, contact us and we will delete it. ## 13. Changes to this policy The version and effective date are shown above. Material changes are announced on this page and, for customers, by e-mail before they take effect. We will not use Google user data for a new purpose without telling you and asking for your consent. ## 14. Contact DBenk. E-mail: [halo@dbenk.com](mailto:halo@dbenk.com). Form: [https://dbenk.com/en/#kontak](https://dbenk.com/en/#kontak). Indonesian version: [https://dbenk.com/privasi](https://dbenk.com/privasi). See also the [Terms of service](https://dbenk.com/en/terms). If the versions differ, the Indonesian version prevails.