Privacy policy

This policy explains what Tahap collects about you, why, who else sees it, and how you stay in control. We collect only what we need to run the service, and we never sell your data.

Who is responsible

Tahap is responsible for your personal data under Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022).

What we collect

• Account details: your name, email address and password, which is stored only as a secure hash. If you sign in with Google, we receive your name, email address and profile picture from Google.
• What you create: boards, cards, checklists, notes, resources, your learning goals and answers to planning questions, study conversations, quiz answers and marks.
• Credits and purchases: your credit balance and its history, and for each purchase the pack, price, status and time. Card, bank and e-wallet details go straight to BorderPay. We never see or store them.
• Technical data: your IP address and browser type, kept with your sign-in sessions and used to stop abuse, plus short-lived server logs.

Why we use it

• To run your account and the features you use (our agreement with you).
• To send emails you need, such as verifying your address or resetting a password.
• To process payments and keep the records the law requires.
• To keep the service secure and stop abuse (our legitimate interest).

We don't show ads, use advertising trackers or sell your data.

Who else processes it

We use a few trusted providers. Each gets only what it needs to do its job:

• Vercel hosts the app, and Neon hosts our database.
• OpenRouter and the AI model providers it routes to receive the content needed to answer you: your learning goal, the relevant parts of your board, and your study messages. They don't receive your name or email address.
• BorderPay processes payments. It receives the order from us, and collects payment details from you directly.
• Resend delivers our emails, so it receives your email address.
• Google, only if you choose to sign in with Google.

Some of these providers store data outside Indonesia. We pick providers that protect data to a standard at least as high as Indonesian law requires. We'll also share data if the law requires it.

Cookies

We use only the cookies needed to keep you signed in and to remember the language you chose. There are no analytics or advertising cookies.

How long we keep it

• Your account and content: until you delete your account.
• Sign-in sessions: until they expire or you sign out.
• Purchase records: as long as Indonesian tax and bookkeeping law requires (up to 10 years), even after your account is deleted. Once it is, they're no longer linked to your name or email.

Your rights

You can ask us to show you the data we hold about you, correct it, give you a copy, stop using it, or delete it. To delete your account, choose Delete account in the account menu: your account and content are deleted straight away, apart from records we must keep by law. You can also email us from the address you signed up with, and we'll delete it within 14 days. We'll answer every request within the time Indonesian law sets.

Security

Everything is sent over HTTPS, passwords are hashed, and access to the database is limited to running the service. If a breach ever puts your data at risk, we'll tell you and the authorities as the law requires.

Children

If you're under 18, you need a parent or guardian's permission to use Tahap.

Changes

If we change this policy in a way that matters, we'll tell you by email or in the app first.

Contact

Questions? Email hello@tahap.example.