Privacy Policy

1. Information We Collect on the Website

We collect information you provide voluntarily, including:

• Via the contact form: name, email, phone number, company name, message
• Via newsletter signup: email, name (optional)
• Via WhatsApp/direct communication: name, WhatsApp number
• Automatic usage data: IP address, browser, pages visited, visit time (after you give consent via the consent banner)

Legal Basis: Your explicit consent via form/banner. Data is processed for business communication purposes under Article 4 letter h of the PDP Law.

2. INCLUDE Platform and Android App

When you create an account and use the INCLUDE platform, through the web at app.include.co.id or the INCLUDE app for Android, we process:

• Account data: name, email address, phone number (optional), password (stored hashed) or Google sign-in, and your role in the organisation.
• Organisation data: company name, subscription plan, and billing history.
• Device data: sensor readings, device status, and related metadata sent by the IoT devices you connect to your account.
• Usage and technical data: access logs, in-app actions (audit log), IP address, and device or browser type, used for security and troubleshooting.
• Payments: processed by our payment gateway partner, Doku. We do not store your card numbers.

This data is used to provide the service (dashboards, alarms, reports, automation), manage subscriptions, send operational notifications about alarms and your account, and keep the service secure.

3. About the Android App

• The INCLUDE app for Android displays the INCLUDE platform (app.include.co.id). The data it processes is the same as described in section 2.
• The app does not request access to your camera, microphone, location, contacts, or files.
• Your login session is stored on your device so you do not have to sign in every time. Signing out removes it.
• If you allow notifications, they are only used for alarms and account-related messages. You can turn them off in your phone settings at any time.
• The app contains no advertising and we do not sell your data.
• The service is intended for businesses and is not directed at children under 18.

4. Deleting Your Account and Data

You can ask us to delete your INCLUDE account and its data at any time:

1. Send an email to privacy@include.co.id from the email address registered to your account, with the subject "Account deletion request".
2. We will verify the request and confirm by email once the deletion is complete.

We delete your account data, and device data belonging to the organisation if you are its only administrator. Invoice and payment records are kept for as long as tax and accounting law requires. Device data is otherwise retained only for the period of your subscription plan.

5. How We Use Information

• Respond to inquiries and provide consultation/demos
• Send service communications (auto-reply, status updates)
• Send marketing communications only with your consent (opt-in)
• Analyze usage trends to improve our services
• Legal compliance and fraud prevention

6. Data Storage & Retention

• Leads (from form/WhatsApp): retained for up to 2 years or until marked "won/lost"
• Subscribers (newsletter): retained until you unsubscribe or click "unsubscribe" in an email
• Analytics data: automatically deleted per Plausible/GA4 retention policy (typically 90 days)
• IP address: hashed when stored to prevent direct identification

7. Sharing Information

We do not sell, trade, or transfer your personal data to third parties without consent, except:

• Email providers (Resend/Hostinger SMTP) to send communications, bound by security agreements
• Analytics providers (Plausible/GA4), anonymized data
• When ordered by a lawful authority

8. Your Rights (under the PDP Law)

You have the right to:

• Access: request a copy of your personal data
• Correction: update inaccurate data
• Deletion: request deletion of data (within legal limits)
• Withdrawal of Consent: unsubscribe from the newsletter or opt out of analytics at any time

Contact: privacy@include.co.id

9. Data Security

We use:

• SSL/TLS encryption for data in transit
• MySQL database on Hostinger with access control
• Environment variables for sensitive credentials (never hardcoded)
• Rate limiting on public APIs to prevent abuse
• Honeypot + CSRF protection on forms to prevent spam

10. Consent Banner & Analytics (website)

We show a consent banner the first time you visit. Your choice is stored in the iv-consent cookie. Analytics and ad pixels only activate after you choose "Agree" (Consent Mode v2).

11. Policy Changes

We may update this policy at any time. Significant changes will be announced by email to the address registered in our system.

12. Contact Us

Privacy questions:
Email: privacy@include.co.id or info@include.co.id
Address: PT Inteligensi Teknologi Indonesia, Klampis Megah Blok B20, Jl. Klampis Jaya, Sukolilo, Surabaya 60117, Indonesia
WhatsApp: +62 85 1711 10227