Privacy Policy

Dupuu is operated by PT Jackzard Inovasi Digital, a company established in Indonesia (“Dupuu”, “we”, “us”). For personal data about our own users, people invited to organizations, visitors to dupuu.com and the people who contact us, Dupuu is the data controller (pengendali data pribadi).

You can reach the person responsible for personal data protection at Dupuu at privacy@dupuu.com.

Our customers use Dupuu to build websites, stores and email lists. For personal data collected through those, such as form messages, newsletter contacts, customer accounts, orders, digital product downloads and site analytics, the customer who owns the site is the controller and Dupuu acts as their processor (prosesor data pribadi) under our Terms of Service. If you are a visitor or shopper of a site built with Dupuu, please read that site’s privacy notice and contact its owner about your data. If you contact us, we will pass your request to the site owner where we can.

• Account data: name, email address, username, password (stored only as a secure hash), profile picture, language and time zone.
• Sign-in providers: if you sign in with Google, Apple, Facebook, LinkedIn or X, we receive your name, email address, profile picture and an account identifier from that provider, as allowed by your settings there.
• Organization and team data: organization name, members, roles and invitations, including the email addresses you invite.
• Billing data: billing name, email, tax number, plan, invoices, payment status and payment method type. Payment details are entered with Midtrans; we do not receive full card numbers.
• Seller and payout data: if you sell with a Dupuu store, the business verification and payout details you provide, such as legal name, identity number (NIK), business registration (NIB), tax number (NPWP), supporting documents and bank account.
• Content: websites, pages, files, images, collections, products, emails, templates and other material you create or upload, which may include personal data about you or others.
• AI data: prompts you write, references and images you attach, the website content sent with them, and the suggestions returned.
• Agent and API data: API tokens, OAuth grants and the apps you approve, and logs of the requests they make.
• Connected services: if you connect Google Search Console, an access token (stored encrypted) with read-only access to search performance data for your sites.
• Usage and device data: IP address, browser and device information, pages and features used, active sessions and security logs.
• Security checks: results of bot checks at sign-up (Cloudflare Turnstile) and signals used to detect fraud and abuse.
• Error reports: technical details of errors in the app, with personal data removed before they are sent.
• Communications: messages you send to support, abuse or privacy contacts, and your email preferences.

We do not ask for sensitive (specific) personal data such as health, biometric or religious data. Identity numbers are collected only for payout verification.

We process this data for the site owner, as described above.

• Analytics: Dupuu’s built-in analytics do not use cookies or store a persistent identifier. A visitor is counted with a hash of their IP address, browser and the site’s address, salted with a value that changes every day, so the same person cannot be followed from one day to the next. We record the page, referrer and campaign tags, device type, screen size, and approximate country, region and city looked up from the IP address on our own servers. The IP address itself is not stored with analytics events.
• Forms, accounts and orders: whatever the site owner asks for, such as names, contact details, messages, shipping addresses, order history and digital product access.
• Email: contacts on the owner’s lists, and whether emails were delivered, opened or clicked, and unsubscribe requests.
• Delivery: technical logs needed to serve pages securely, such as IP address and browser, kept for a short time.

• From you, when you sign up, build sites, buy a plan, verify your store or contact us.
• From your organization, when an owner or admin invites you or assigns you a role.
• Automatically, from your device when you use Dupuu.
• From third parties: sign-in providers, Midtrans (payment status), domain registrars, Google Search Console when you connect it, and Agents you authorize.

• To provide the Services you sign up for: create your account, host and publish your sites, run AI features, your store and payouts, send email you ask us to send, process invoices, and give support. Basis: performance of our contract with you.
• To meet legal obligations, such as tax and accounting records, verification before payouts, consumer protection, and lawful requests from authorities. Basis: legal obligation.
• To keep Dupuu secure and reliable, prevent fraud, spam and abuse, enforce our terms, and fix errors. Basis: our legitimate interests in a safe service, balanced against your rights.
• To improve Dupuu using usage information, aggregated where possible. Basis: legitimate interests.
• To send product news and offers. Basis: your consent, which you can withdraw at any time with the unsubscribe link. Service messages such as invoices and security alerts are not marketing.
• Connected services and optional features, such as Google Search Console. Basis: your consent, which you can withdraw by disconnecting.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use your content, prompts or AI output to train AI models.

When you use the AI assistant, we send your prompt, attached references and the relevant parts of your site to AI model providers, either directly or through OpenRouter, to generate designs, text and images. The providers process this data to return a response under their API terms and data protection commitments. We select providers and settings that do not use API data to train their models where those options are available. We keep your AI conversations and proposals with your site so you can review, apply or undo them, and delete them with the site.

We share personal data only as needed to provide the Services, with providers bound by contract to protect it and use it only on our instructions:

• Vultr: cloud hosting and databases (Singapore).
• Cloudflare: content delivery, DNS, protection against attacks and bot checks (Turnstile).
• Bunny.net: storage and delivery of uploaded files and website assets.
• Amazon Web Services (Amazon SES): sending account, billing, store and marketing emails.
• Midtrans: processing payments for plans, store orders and refunds.
• OpenRouter, OpenAI, Google (Gemini), Anthropic, fal.ai and other AI model providers reached through OpenRouter: generating AI suggestions and images.
• Sentry: error monitoring, with personal data removed.
• Namecheap and domain registries: registering and renewing domains, as registries require.
• Komerce (RajaOngkir): shipping rates for stores, using origin and destination areas and parcel weight.
• Pixabay and Unsplash: stock image search; only your search terms are sent.
• Google, Apple, Facebook, LinkedIn and X: when you choose to sign in with them, and Google when you connect Search Console.

Within your organization, members can see the content and data the organization holds according to their role. We may also disclose data if the law requires it, to protect people from harm, to enforce our terms, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply and we will notify you.

Our main infrastructure is in Singapore, and some providers process data in other countries, including the United States and the European Union. When personal data leaves Indonesia, we make sure the destination offers a level of protection equal to or higher than Indonesian law, or that appropriate and binding safeguards, such as standard contractual clauses, are in place, or that you have consented, as required by Law No. 27 of 2022 and, where it applies, the GDPR.

• Account, organization and content data are kept while your account is active.
• When you delete your account, we delete or anonymize your personal data without undue delay. Copies in backups are removed as backups are replaced on their regular cycle.
• Invoices, payment and payout records are kept for as long as Indonesian tax and company document laws require, generally 10 years.
• Site analytics are kept while the site exists, in the cookieless form described above.
• Security and server logs are kept for a limited period, unless they are needed to investigate an incident.
• Marketing preferences are kept until you withdraw consent, and a record of the withdrawal is kept so we respect it.

Subject to the law, you have the right to:

• be informed about how and why your personal data is processed;
• access and get a copy of your personal data;
• correct inaccurate or incomplete data;
• have your data deleted or destroyed;
• withdraw consent you have given, without affecting earlier processing;
• object to processing based on our legitimate interests, and to decisions based solely on automated processing that significantly affect you;
• restrict or delay processing;
• receive your data in a commonly used, machine-readable format and have it transferred to another controller;
• claim compensation for violations, as provided by law; and
• complain to the data protection authority: in Indonesia, the institution responsible for personal data protection under Law No. 27 of 2022; in the EU or UK, your local supervisory authority.

California and other US states: you can ask to know, access, correct and delete your personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information beyond what is needed to provide the Services. We will not discriminate against you for exercising your rights. You may use an authorized agent, whose authority we may verify.

You can view and correct most account information in your account settings, download form entries, orders and products from the dashboard, and delete your account there yourself. For any other request, email privacy@dupuu.com. We may need to verify your identity, and we respond within the time limits set by law.

On dupuu.com and the Dupuu app we use only cookies and browser storage that are necessary for the Services:

• Sign-in and security: keep you signed in, protect your session and requests, and run bot checks.
• Preferences: remember your language and editor settings.
• Drafts: keep work in progress, such as the website brief you start on dupuu.com before you sign up, in your browser’s session storage.

We do not use advertising cookies, and our analytics are cookieless. If we ever add optional analytics or marketing cookies, we will ask for your consent first where the law requires it. Sites built with Dupuu are controlled by their owners, who decide which cookies and third-party tools their sites use.

We protect personal data with encryption in transit, hashed passwords, encrypted tokens for connected services, role-based access controls, session management, rate limiting, monitoring and least-privilege access for staff. No system is perfectly secure, so please use a strong, unique password and keep your sign-in methods safe.

If a personal data breach occurs, we will act to contain it, and we will notify affected people and the authority in writing within 3 x 24 hours of becoming aware of it, as Law No. 27 of 2022 requires, describing the data involved, when and how it happened, and what we are doing about it. Where we process data for a site owner, we will notify that owner without undue delay so they can meet their own obligations.

Dupuu is not intended for children. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian. If you believe a child has given us personal data, contact privacy@dupuu.com and we will delete it.

We use automated checks to detect spam, fraud and abuse, for example at sign-up, before payouts and when emails are sent. These checks can delay or block an action. They do not make final decisions with legal effects without a person being able to review them; you can ask for a review by replying to our notice or emailing support.

We may update this policy. For material changes we will notify account owners by email or in the dashboard before they take effect. The date at the top shows when it was last updated.

PT Jackzard Inovasi Digital

For privacy questions or requests, including to reach the person responsible for personal data protection, email privacy@dupuu.com.