Privacy notice

Who we are

This site is run by Preneurs Indonesia ( “Preneurs”, “we”), based in Jakarta, Indonesia. We are the party responsible for the personal data described here — the pengendali data pribadi under Indonesia’s Personal Data Protection Law (UU No. 27 of 2022), and the data controller under the GDPR where it applies.

For anything in this notice, write to privacy@preneursindonesia.com.

What we collect, and when

We collect personal data in exactly one place: the Say hello form. Nothing else on this site asks you for anything, and we do not use advertising or tracking cookies.

• What you type: your name, email address, and optionally a WhatsApp number, your country and city, your role and organization, what brings you here, and any message you write.
• Your consent: the fact that you ticked the consent box, and when.
• Technical context: your browser’s user agent, and a one-way cryptographic hash of your IP address. We do not store the IP address itself and cannot recover it from the hash. It exists so we can detect and block abuse of the form.

We do not collect data from children, and we do not knowingly process sensitive categories of personal data. Please do not put any into the message field.

Why we use it

• To reply to you. If you asked to be connected to a startup, to request one, or to pitch a note, we use your details to get back to you. Legal basis: your consent, and our legitimate interest in answering people who contact us.
• To send Founder’s Notes, but only if you chose that and then confirmed by clicking the link we email you. Legal basis: consent. We never add anyone to the list who has not confirmed.
• To keep the form usable. The IP hash and the anti-spam challenge exist to stop automated abuse. Legal basis: legitimate interest in the security of the service.

We do not sell your data, we do not share it for advertising, and we do not use it to build a profile of you.

Who else processes it

We use a small number of service providers, each acting on our instructions:

• Supabase — the database that stores submissions.
• Resend — sends the confirmation email, the newsletter, and our internal notification.
• Cloudflare Turnstile — the anti-bot check on the form.
• Upstash — holds the short-lived rate-limit counters keyed to the hashes described above.
• Vercel — hosts the site and serves its pages.

Some of these operate outside Indonesia. Where personal data is transferred abroad we rely on the provider’s contractual data protection commitments, including standard contractual clauses where the GDPR applies.

How long we keep it

• Newsletter subscribers: until you unsubscribe, and for up to 12 months after that so we can prove you were removed.
• Unconfirmed subscriptions: deleted after 30 days if you never click the confirmation link.
• Other enquiries: up to 24 months after we have dealt with them.
• IP hashes and rate-limit counters: the counters expire within an hour; the hash is kept with the submission.

Your rights

Under UU PDP — and under the GDPR if you are in the EU or EEA — you can ask us to show you the data we hold about you, correct it, delete it, restrict what we do with it, or send it to you in a portable form. You can withdraw consent at any time; that does not undo what we did before you withdrew it.

Email privacy@preneursindonesia.com and we will respond within 30 days. Every newsletter also carries a one-click unsubscribe link, which takes effect immediately.

If you think we have handled your data badly, you may complain to Indonesia’s data protection authority, or to your local supervisory authority in the EU or EEA.

Cookies

This site sets no cookies of its own and runs no analytics that identify you. Cloudflare Turnstile may set a short-lived token in your browser purely to run its bot check when you open the form.

Changes

If we change this notice we will update the date at the top. If a change materially affects how we use your data, we will tell subscribers by email before it takes effect.