Privacy policy
How we handle personal data, in plain terms. Last reviewed 11 September 2026.
This policy is written to comply with Indonesia's Law No. 27 of 2022 on Personal Data Protection (the PDP Law) and its implementing regulations. Where we act for clients in other jurisdictions, the client's local law is addressed in the engagement contract.
If anything here is unclear, email info@deitylabs.ai. We reply within one business day.
Who we are
PT DeityLabs Indonesia Company registration (NIB): 0012345678901 (temporary placeholder — replace with the real NIB) Registered address: Jln. Lanyahan, Br. Nagi, Ubud, Bali, Indonesia 80571 Email: info@deitylabs.ai · Phone: +62 811 3820 9701
We are the Personal Data Controller for data collected through this website and in the course of selling and delivering our services. We are a Personal Data Processor for data we handle inside the agents we build for clients — see When we act on a client's behalf.
We have not appointed a Data Protection Officer because we do not process personal data at a scale that requires one under the PDP Law. Privacy requests are handled directly by the founders at info@deitylabs.ai.
What we collect
We collect the minimum needed to talk to you, scope your work, build your agent and keep it running. We do not buy data, sell data, or build profiles of individuals.
| Category | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, work email, phone number, company, job title | You, when you book an audit, use the contact form, or email us |
| Correspondence | Emails, call notes, meeting recordings where you have agreed to recording, messages in shared channels | Our conversations with you |
| Booking data | Requested meeting times, time zone, notes you add to a booking | The scheduling tool on our booking page — Google Calendar |
| Audit materials | Process documents, system exports, sample call recordings, org charts, screenshots you share so we can map your workflows | You, during the 5-day audit |
| Engagement records | Quotes, contracts, invoices, payment status, project notes | Generated as we work together |
| Website data | IP address (truncated), browser type, pages visited, referring page, approximate country | Our hosting provider's server logs and our analytics — see Cookies and analytics |
| Job applicant data | CV, portfolio, references, interview notes | You, when you apply via our careers page |
| Client data (as processor) | Whatever your agent touches: caller voices, customer names, job addresses, maintenance logs, booking records, invoices | Your systems, under your instructions — see When we act on a client's behalf |
Specific personal data (the PDP Law's term for sensitive data — health, biometric, genetic, criminal record, children's data, personal finance and similar) is never collected through this website. We process it only inside a client agent, only where the client has instructed us to, and only where the client has confirmed it holds the lawful basis to do so.
Children. This website and our services are for businesses. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.
Why we collect it
The PDP Law requires a lawful basis for every category. Here is ours.
| Category | Purpose | Lawful basis (PDP Law Art. 20) |
|---|---|---|
| Contact details, booking data | To reply to you, schedule calls, send the audit deliverable, and send you a quote | Performance of a contract, or steps at your request before entering one |
| Correspondence | To keep an accurate record of what was agreed | Legitimate interest — keeping a record of business dealings |
| Audit materials | To map your workflows and produce the ranked automation map | Performance of a contract (the audit) |
| Engagement records | To invoice, collect payment, and meet tax and accounting obligations | Performance of a contract; legal obligation |
| Website data | To keep the site secure, fix errors, and understand which pages are useful | Legitimate interest — site security and improvement |
| Job applicant data | To assess your application | Steps at your request before entering a contract; consent for keeping your CV on file |
| Client data (as processor) | Whatever the client's agent is built to do | The client establishes the lawful basis. We act only on documented instructions |
We do not use your data for marketing beyond replying to enquiries you initiate. We do not send newsletters. We do not run advertising. If that changes, we will ask for consent first and this policy will be updated.
Automated decision-making. The agents we build take actions — logging a call, drafting a quote, scheduling a job — and escalate to a human when confidence is low. Where an agent's action has a legal or similarly significant effect on an individual, the client is responsible for ensuring a human reviews it and for telling affected individuals how to object. We design every agent with an escalation path and an audit log so that review is possible.
Who we share it with
We share personal data with the providers below because we cannot deliver the service without them. Each is bound by contract to use the data only to provide their service to us, and each of the AI model providers is used under commercial terms that exclude your data from model training.
The providers below reflect the stack published on How we build. Where an agent runs inside a client-owned cloud account, we are working inside your environment and the location is your region.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Anthropic PBC | Large language model inference | Prompts and documents passed to the agent | USA |
| OpenAI | Large language model inference | As above | USA |
| Google Cloud (Vertex AI) | Large language model inference; cloud hosting for agents (usually in your account, not ours) | Client data | Your region — commonly Jakarta (ap-southeast-3) or Singapore (ap-southeast-1) |
| Amazon Web Services (Bedrock) | Cloud hosting for agents, alternative to Google Cloud, in your account | Client data | Your region |
| Deepgram | Speech-to-text for voice agents | Caller audio, transcripts | USA |
| Vapi / Retell AI | Voice agent orchestration | Caller audio, transcripts, phone numbers | USA |
| ElevenLabs / Twilio | Text-to-speech and telephony for voice agents | Caller audio, phone numbers | USA |
| Google Workspace | Email, documents, calendar (including the booking tool on our booking page) | Contact details, correspondence, meeting bookings | USA |
| Hostinger International | Website hosting and CDN | Server logs | Singapore / global edge network |
| Google LLC (Google Analytics 4, loaded via Google Tag Manager) | Website analytics | Truncated IP, page views, device type | USA |
| Indonesian bank (per quote) | Invoice payments by bank transfer | Billing contact, invoice amounts | Indonesia |
We also share data where the law requires it (a court order, a tax audit) and with our professional advisers (accountant, lawyer) under confidentiality.
Your accounts, your data. Wherever possible, agents run inside cloud and model-provider accounts that you own. In that case we are not hosting your data at all — we are working inside your environment under access you control and can revoke. Our published stack is at How we build.
Cross-border transfers
Some of the providers above are outside Indonesia. Under PDP Law Article 56 we may transfer personal data abroad where the destination has a level of protection equal to or higher than Indonesia's, where adequate and binding protection is in place, or where you have consented. We rely on the providers' contractual data-protection terms as the binding protection, and where a client requires it, we can pin hosting and inference to a specific region (including Indonesia, where the provider offers it).
How long we keep it
| Category | Retention | Why |
|---|---|---|
| Enquiry that does not become an engagement | 12 months from last contact, then deleted | Long enough to follow up if you come back |
| Contact details and correspondence for clients | Duration of the engagement plus 5 years | Contract and dispute limitation periods |
| Audit materials | Deleted 90 days after the audit deliverable is accepted, unless a build starts | We do not need to keep your process documents |
| Engagement records (contracts, invoices) | 10 years | Indonesian tax and accounting law |
| Website server logs | 30 days | Security and debugging |
| Analytics data | 14 months | Trend analysis only |
| Job applicant data (unsuccessful) | 6 months after the decision, or longer with your consent | To reconsider you for a later role |
| Client data (as processor) | As the client instructs; deleted or returned within 30 days of the engagement ending | You own it |
When a period ends we delete the data or anonymise it so it can no longer identify you. Backups are overwritten on a 35-day cycle.
How we protect it
Encryption in transit and at rest, least-privilege access, multi-factor authentication on every account, and no client data on personal devices. Every agent we ship logs what it did and why, so actions can be traced. The full picture, including how we handle credentials inside your environment, is on our Security page.
If something goes wrong. If a breach affects your personal data, the PDP Law requires us to notify you and the Indonesian data protection authority within 3 × 24 hours of becoming aware of it. We will tell you what happened, what data was involved, what we have done about it, and what you can do.
When we act on a client's behalf
When you engage us to build or run an agent, you are the Controller of the data the agent touches and we are the Processor. Because we do not use a separate data processing agreement, the terms below form part of our engagement with you:
- Instructions. We process client data only on your documented instructions — the signed quote, the agreed workflow map, and written changes. If we believe an instruction breaches the PDP Law, we will tell you before proceeding.
- Purpose limitation. We do not use client data for anything other than delivering and maintaining your agent. We do not use it to train models, ours or anyone else's.
- Sub-processors. We use only the providers listed above, or others we have told you about in writing at least 14 days before they start. You may object; if we cannot resolve the objection, you may terminate the affected work without penalty.
- Security. We apply the measures in How we protect it and any additional measures agreed in the quote.
- Confidentiality. Everyone who works on your agent is bound by written confidentiality obligations.
- Assistance. We help you respond to data-subject requests and breach notifications relating to the agent, within the PDP Law's deadlines.
- Deletion or return. When the engagement ends, we hand over and delete our copies of your data within 30 days, unless the law requires us to keep it.
- Audit. You may ask for evidence of our compliance once a year, or after a security incident, at reasonable notice.
- Your obligations. You confirm you have a lawful basis for the data you give the agent, that you provide the notices the PDP Law requires (including call-recording announcements for voice agents), and that you handle requests from your own customers and staff.
Your rights
Under the PDP Law you have the right to:
- Know who is processing your data and why (this policy);
- Access your data and receive a copy — we respond within 3 × 24 hours as the PDP Law requires;
- Correct inaccurate or incomplete data;
- Delete your data, subject to legal retention obligations;
- Withdraw consent where consent was the basis, without affecting processing that already happened;
- Object to decisions made solely by automated processing that have a legal or significant effect on you;
- Restrict processing while a dispute is resolved;
- Port your data to another provider in a machine-readable format;
- Claim compensation for breaches of the PDP Law.
To exercise any right, email info@deitylabs.ai. We will acknowledge within one business day and may ask you to confirm your identity. There is no fee.
If your data is being processed by an agent we built for one of our clients, your request should go to that client — they are the Controller. If you are unsure who that is, contact us and we will point you to the right place.
If you are unhappy with our response, you may complain to the Indonesian personal data protection authority established under the PDP Law.
Cookies and analytics
We do not use advertising cookies, remarketing pixels, session-replay tools or cross-site tracking. We do not sell or share browsing data.
We use Google Tag Manager to load Google Analytics 4 to understand which pages are read and where the site breaks. IP addresses are truncated before storage and no advertising features are enabled. You can opt out of analytics with the Google Analytics opt-out browser add-on or by blocking third-party scripts in your browser; the site works fully without it.
Strictly necessary cookies (security, load balancing) are set by our hosting provider and cannot be disabled.
Changes to this policy
We review this policy at least once a year and whenever our processing changes. Material changes are announced on this page with a new "last reviewed" date; clients under an active engagement are notified by email at least 14 days before the change takes effect.
Contact
info@deitylabs.ai · +62 811 3820 9701 Jln. Lanyahan, Br. Nagi, Ubud, Bali, Indonesia 80571
Replies within one business day, always.