Privacy Policy

01 Who we are

INSYNTIVE Academy at learn.insyntive.com is operated by PT Orang Beruntung dan Sejahtera under the INSYNTIVE brand (“we” or “us”). When processing members' personal data, we act as the Personal Data Controller as defined in the PDP Law. Questions or requests about personal data can be sent through the contact details at the end of this policy.

02 Data we collect

Data you provide

• Identity & contact: name, email address, WhatsApp number (optional), and country.
• Account credentials: your password (if you create one), stored only as a one-way hash, so we cannot see your actual password. Accounts created with Google have no password until you create one in the Account menu.
• Communications: the content of your messages when you contact us via WhatsApp or email.
• CV content: the data you write in the CV Builder (for example education and work history, skills, contact details). Your CVs can only be accessed from your account; we do not open them unless needed to help with a technical issue at your request.
• Affiliate data (if you join): affiliate code, bank name, account number, and account holder name for commission withdrawals.
• Email preferences: the types of notification emails you want to receive, including consent to tips & offers emails (optional, not pre-ticked) and when you gave it.
• Testimonials (if you write one): rating, story, profession/job title and city (optional), your chosen display name, and two separate permissions (shown on the site, and quoted on social media/ads) along with when they were given and withdrawn. See Testimonials.

Data from Google (if you choose Sign in / Sign up with Google)

• When you sign in or sign up with Google, or connect a Google account in the Account menu, Google sends us: the name on your Google profile, your email address, your Google account ID (a unique identifier used to recognize your account the next time you sign in), and whether that email has been verified by Google. We request only the basic openid, email, and profile access.
• We never receive or store your Google account password. You enter it directly on Google's page. We do not request access to Gmail, Google Drive, contacts, or other Google data, and we do not store your Google profile photo.
• We also record when ownership of your email has been proven (signing in with Google using the same email, or using a password reset link sent to your email). This is used to protect your account from being registered by someone else with your email.
• The connected Google account (and its email address) is shown in the Account menu, and you can disconnect it there (with your account password); each time a new Google account is connected, we send a notification email to your account's email address.

Transaction data

• Order number, amount, currency, payment status, payment method (QRIS, a specific bank's Virtual Account, or PayPal), the order's price type (Rupiah for Indonesia or US dollars for outside Indonesia), the transaction ID from Pakasir, the QRIS code, Virtual Account number, or PayPal payment link created for your order and its validity period, and the times of creation and payment.
• We never receive or store your PIN, password, OTP code, card number, or bank account details. You make the payment in your own e-wallet or mobile banking app, or on PayPal's page; we only receive the payment status (paid or not yet paid) from Pakasir.

Data recorded when you use the Service

• Download log: the product downloaded, the time of download, and IP address, to enforce licenses and download limits.
• Sign-in sessions: IP address and device/browser information (user agent) for each session, to apply device limits and keep accounts secure.
• Security: records of failed sign-in attempts per IP address and email, to prevent break-in attempts.
• Learning & license activity: class progress, issued license certificates, and membership history.
• Library: the books you open in the reader along with the last page, number of pages, and the last time you read, so you can continue reading from the same page. We do not record what you read on each page and do not share this data with authors/publishers.
• Referrals & coupons: the affiliate code that brought you to sign up (if any), coupons used on orders, and the number of affiliate link clicks per day (without visitors' personal data).
• Email log: the type of email sent to you, the time, and its delivery status, to prevent duplicate emails and trace delivery problems.
• First visit source: campaign parameters in the link you opened (utm_source, utm_medium, utm_campaign, etc.), the referring site's name (without its full address), and the first page you opened on this site. These are stored in the ia_utm cookie for 30 days and recorded to your account when you sign up. We use them in aggregate to learn which content or channels help people find the Academy.
• Learning paths & final projects: the path you choose, the steps & modules completed (including quiz scores), the final project file or link you submit along with your explanation and rubric check, and review notes from our team. Project files are stored privately; only you and admins can open them.
• Sign-up follow-up: whether our team has contacted you (e.g. via WhatsApp) after you signed up or started a payment.
• Ad measurement (Meta Pixel & Conversions API): when you start a payment, we store the Meta cookies in your browser (_fbp, and _fbc if you came from a Meta ad), your IP address, and browser information (user agent) on your order, and when the purchase was sent to Meta, so the purchase can be matched to the ad you clicked even after the payment tab is closed. See Third parties.
• Approximate country: the country code of your IP address (provided by Cloudflare) is used to decide the currency of the prices shown and which payment methods to offer: Rupiah with QRIS / Virtual Account, or US dollars with PayPal for visitors outside Indonesia. We do not store that country code; only the price type of your order is stored.

03 Purposes & legal bases

04 Public certificate verification

Anyone who knows a License Certificate code can check it on the Verification page. Only the following is shown: the certificate code, the holder's name in masked form (for example “D**** I******”), the product title and type, the issue date, and the license terms. Email, WhatsApp number, and other data are not shown.

The same applies to learning path Completion Certificates (code JLR-…): only the code, name (masked by default), path name, learning hours (JP), number of materials completed, path competencies, completion date, and status (valid / revoked along with the reason) are shown. You can choose to show your full name on the verification page, for example so recruiters can match it, and change that choice at any time from the certificate page in the member area.

05 Testimonials

• Purpose: to help prospective users assess the Academy from the experience of real users, and to help us improve the service. Every testimonial is tied to the account that sent it, is read by our team before it is published, and is never made up by us or changed in meaning. Admins may only fix typos, and your original text is kept.
• Basis: explicit consent. There are two separate permissions that you tick yourself: (a) shown on the learn.insyntive.com site, (b) quoted on INSYNTIVE Academy social media & ads. Without permission, a testimonial is read only by our team.
• What is shown: rating, story, the name you choose (full name, first name + initial, or anonymous), profession/city if you fill them in, the month it was sent, the sender's actual status (“Member” or “Free account user”), and a “Verified member” label if your account has ever paid for a membership. Email and WhatsApp number are never shown.
• How to withdraw: open Account → Testimonial and turn off the permission, or delete your testimonial. The testimonial disappears from the site within minutes; the withdrawal is recorded in our audit trail. Social media material that has already been published is taken down as soon as possible after the permission is withdrawn.
• Testimonial requests are shown at most once every 30 days after certain moments (e.g. your 3rd template download or your first CV download), with “Maybe later” and “Don't ask again” options. By email only if you have agreed to tips & offers emails.

06 Sharing data with third parties

We do not sell or rent out your personal data. Data is shared only as needed with processors that help us run the Service:

• Pakasir (operated by PT Geksa): the payment gateway for QRIS, Virtual Account, and PayPal. When you create a payment code or link, we send only the order number, amount, and the method you chose (for PayPal, plus the address of our payment page to return to after paying); your name, email, and WhatsApp number are not sent. The bank or e-wallet provider you use to pay processes your data according to its own privacy policy.
• PayPal: if you pay from outside Indonesia with PayPal (through Pakasir). You sign in to your PayPal account or enter your debit/credit card details directly on PayPal's page, so your PayPal account, card, and billing details are received and processed directly by PayPal under its own privacy policy. We do not receive that data, and we do not send your name, email, or WhatsApp number to PayPal.
• Cloudflare: hosting for the application, database, and file storage.
• Meta Platforms (Facebook & Instagram): to measure and optimize our ads. The Meta Pixel in your browser sends page visits, account sign-ups, payment starts, and purchases (plan name & amount), the page address, your IP address, browser information, and Meta cookies (_fbp / _fbc), without your name, email, or WhatsApp number. When a payment is completed, our server sends the same purchase event through the Meta Conversions API: order number, amount, plan, payment time, your email and account ID in hashed (SHA-256) form, a hashed country code (if set in your profile), IP address, browser information, and the Meta cookies stored on the order. Test payments, free orders, and payments recorded manually by an admin are not sent. Meta processes this data under the Meta Privacy Policy; you can control the ads you see in the Ad Preferences of your Facebook/Instagram account, or block the pixel with your browser's privacy settings / tracker blocker. The Service keeps working normally.
• Google (if you choose Sign in / Sign up with Google): the sign-in provider. Google verifies your identity on its own page and then sends us the data described in section 02; Google processes your account data according to the Google Privacy Policy. We do not send your membership or transaction data to Google.
• Resend (email delivery provider, when enabled): receives your email address, name, and the email content in order to send payment receipts, password reset links, and notification emails.
• Video providers (YouTube, Vimeo, Google Drive, Cloudflare Stream, or Bunny): when you play a class video, these providers may process data according to their own privacy policies.
• WhatsApp: if you contact us via WhatsApp.
• The affiliate who referred you: if you sign up through an affiliate link or coupon, that affiliate only sees your name in masked form (for example “Bu*** S***”), the date, and the purchase amount on which their commission is based. Your email and contact details are not shown.
• Banks: affiliates' account names and numbers are used to transfer commission withdrawals.
• Competent authorities: when required by law or by a lawful order.

07 Transfers of data outside Indonesia

Some of the providers above may process or store data on servers outside Indonesia. In such cases, we make sure those providers apply an equal or higher level of data protection, in accordance with Article 56 of the PDP Law.

Ad measurement data sent to Meta (see Third parties) is processed by Meta Platforms, which may process or store it outside Indonesia under its own privacy policy.

If you pay with PayPal, your payment data is processed by PayPal, which operates internationally and may process or store that data outside Indonesia under its own privacy policy.

08 Retention

• Account data is kept for as long as your account exists, including after your membership period ends, so that you can renew and your certificates can still be verified.
• Transaction data is kept for as long as required by applicable accounting and tax regulations.
• Download logs are kept for as long as needed to enforce the licenses of the products you downloaded.
• CVs are kept until you delete them or your account is deleted.
• Testimonials are kept until you delete them or your account is deleted; the history of permissions given & withdrawn remains recorded in the audit trail as proof of consent.
• Path progress, final projects, and completion certificates are kept for as long as your account exists. Old project files are deleted automatically when you submit a replacement file; everything is deleted if your account is deleted.
• Library reading progress is kept for as long as your account exists; it is deleted if the book is removed from the catalog or your account is deleted.
• Affiliate, commission, and withdrawal data is kept for as long as required by accounting and tax regulations.
• Email delivery logs are kept for no more than 400 days.
• Sign-in sessions expire after at most 30 days, password reset links expire within 1 hour, and the Google sign-in security cookie (ia_g) lasts at most 10 minutes.
• Google account links (Google account ID) are kept for as long as your account exists, or until the link is removed.

Once no longer needed, data is deleted or anonymized.

09 Data security

• All connections use HTTPS. Passwords are stored as salted PBKDF2 hashes; sign-in sessions use HttpOnly and Secure cookies.
• Product files are kept in private storage and can only be downloaded by active members. Access to the admin panel is restricted and recorded in an audit trail.
• No system is 100% secure. If a personal data protection failure occurs, we will notify you and the competent authority in writing no later than 3 × 24 hours, in accordance with Article 46 of the PDP Law.

10 Your rights as a data subject

Under the PDP Law, you have the right to:

• Obtain information about our identity and about the purposes and legal bases for processing your data.
• Complete, update, and correct your data; you can change your name, WhatsApp number, and country directly in the Account menu.
• Access and obtain a copy of your personal data.
• Request that we stop processing, delete, or destroy your personal data.
• Withdraw consent you have given, including revoking INSYNTIVE Academy's access to your Google account at any time in Google Account settings → Your connections to third-party apps & services (after that, sign in with email & password, or ask us to remove the link to your Google account).
• Delay or restrict processing proportionally.
• Object to decisions based solely on automated processing.
• Obtain and/or use your personal data in a commonly used format that can be read by an electronic system.
• Sue and receive compensation for violations in the processing of your personal data.

Submit requests through the contact details below, stating your account email. We may ask you to verify your identity before acting on a request, and will respond within the time limits set by law.

11 Cookies

We use the essential cookie ia_session to keep you signed in (HttpOnly, Secure, valid for at most 30 days). If you open an affiliate link (?ref=…), we store an ia_ref cookie containing that affiliate code for the affiliate program's attribution period (30 days by default) so that the referral is recorded when you sign up; this cookie contains no personal data. We also store an ia_utm cookie (30 days) containing the source of your first visit (campaign parameters in the link, the referring site's name, and the first page) without personal data; its content is recorded to your account only if you sign up. When you use the Google button, we set a temporary ia_g cookie (HttpOnly, Secure, valid for at most 10 minutes, only for the Google sign-in address) containing a random security code to make sure the sign-in process really started from your browser; this cookie is deleted as soon as the process is complete. Your language choice (Indonesian / English) is stored in the ia_lang and ia_lang_pick cookies (1 year, no personal data), and a language suggestion you have closed is remembered in your browser storage (ia_lang_hint). If you use Free Learning without an account, your progress and exercise scores are stored only in your browser (ia_belajar_local) and are copied to your account only when you sign in or sign up. To measure ads, the Meta Pixel sets the first-party cookie _fbp (a random browser identifier, 90 days) and, if you came from a Meta ad (a link containing fbclid), _fbc (an ad-click identifier, 90 days); it also loads a script from connect.facebook.net and sends data to facebook.com. See Third parties. The pixel is not loaded in the admin panel. You can block it with your browser's privacy settings or a tracker blocker without affecting the Service. Apart from that, we do not use other advertising cookies or third-party trackers. Our infrastructure providers may set technical cookies for network security.

12 Minors

The Service is intended for users aged 18 and over. Processing the personal data of users under 18 requires the consent of a parent or guardian, in accordance with Article 25 of the PDP Law.

13 Policy changes

We may update this policy. We will announce important changes through the Service or by email before they take effect. The date of the last update is shown at the top of this page.

14 Contact

For questions, data subject rights requests, or reports about personal data: