Privacy Policy

1. Manager and scope

Andega.pro is a portfolio and workspace for web design and development services managed by Sahdan Kiat Andega, based in Indonesia. Questions and privacy requests can be submitted to hello@andega.pro. This policy applies to public sites, inquiry forms, and client workspaces.

The service can currently run as a local demo. When the demo is active, sample orders, materials/files, reviews/revisions, conversations, sample invoices, and approval previews are saved in the browser, not sent to Andega. Don't enter sensitive information into the demo or use shared devices for project data.

2. Processed information

• Inquiry: name, email, optional company, type of service, and content of the message you choose to send via the email application.
• Accounts when the backend is enabled: email, account identity, session information, and access roles.
• Project when backend is activated: title, services, brief, budget range, status, progress and order creation time.
• Local storage: orders, material requirements, reviews/revisions, sample invoices, conversations, demo profiles, approval previews, as well as your saved preferences. Demo files are stored in the browser's IndexedDB and are not uploaded to the server.
• Guest Agent history is stored locally, not sent to an AI provider or the studio. Creating a new room preserves previous rooms. Message backups exclude attachment contents. Clearing site/browser data removes local history; workspace demo cleanup does not remove Agent rooms.
• Technical information: hosting or authentication providers may process IP addresses, browser information, and security logs when those services are used.

3. Purpose and basis of processing

Information is used to respond to inquiries, assess needs, prepare bids, carry out agreed work, manage accounts, maintain security, and fulfill applicable obligations. The basis is the request for steps before the contract or contract implementation, legal obligations, and proportional security interests. Consent is requested for optional processing that requires it.

We do not use briefs for personalized advertising and do not sell personal data. Client content or information is not used as portfolio material without publication permission.

4. Recipients and service providers

If configured, Supabase handles authentication, PostgreSQL and Realtime; Cloudflare can handle hosting, site delivery and technical logs. Email and WhatsApp applications process messages you send through their services. Spotify and social media links only open external services when clicked; there are no third party players embedded in the page at this time.

Access to project data is limited to those who need it for the work. Additional providers, including payment or e-signature, are not yet active. If used later, the destination and recipient will be explained before the data is sent. Data may also be disclosed if required by law or necessary to legally address an incident.

5. Data location and transfer

Infrastructure providers can process data outside Indonesia. Supabase dedicated project region and production hosting configuration have not been defined. Before receiving production client data, location, transfer arrangements and relevant contractual safeguards need to be established. That information will be updated in this policy.

6. Storage and retention

Demo data stays in the browser until you delete it or the browser clears storage. The clear demo data button is available on the Cookies & Storage page.

For production operations, inquiries that are not ongoing are targeted for deletion within 90 days after the conversation ends. Work files and project communications are targeted to be retained for up to 12 months after closing for support and dispute resolution, unless otherwise agreed. Payment or contract documents are retained to the extent required by applicable obligations.

Removal may be delayed for disputes, legal obligations, or reasonable backup cycles. The schedule above is operational policy; Automatic server deletion is not yet available on the demo version. Requests are handled via email.

7. Your rights and requests

In accordance with applicable provisions, you can request information, access and copies, correction, cessation or restriction of processing, erasure, withdrawal of consent, and portability if applicable. Contact hello@andega.pro with the context of the request; do not send passwords, OTPs, or identity documents without request through appropriate channels.

The applicant's identity is verified proportionally before data is disclosed or deleted. We aim for confirmation of receipt within three working days and completion within the legally required deadline. If a request cannot be fully fulfilled, the reasons will be explained. Withdrawal of consent does not cancel previous lawful processing.

8. Security and incidents

Account access uses provider authentication when enabled and order access is restricted by database rules. No system can guarantee absolute security. Store credentials securely and report suspicious access immediately. If a data incident occurs that requires notification, notification is carried out in accordance with applicable regulations. Demo is not a place to store confidential documents.

9. Children and policy change

Services are addressed to parties who can legally enter into agreements. If you do not yet have legal qualifications, involve a parent, guardian or authorized representative before ordering. We do not ask for children's data for marketing purposes.

The date above indicates the version of this policy. Material changes will be displayed on the site and, for affected active clients, informed through the project contact. New optional processing is not considered approved simply because the policy is updated.