Privacy Policy

This Privacy Policy explains how AtlasCMS ("ATLAS", "we") collects and uses personal data when you use our website and our hosted CMS. The operator is PT Starset Teknologi Indonesia, Jakarta, Indonesia. We follow Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and its implementing rules.

1. Two roles

• For our own account data (people who sign up and use the dashboard) we are the data controller (pengendali data pribadi).
• For the content and leads of a brand (for example form submissions from a customer's website visitors) the customer is the controller and we act as the processor (prosesor) on their instructions. If you are a visitor of a customer's website, please read that site's own privacy notice.

2. What we collect

Data	Why we process it
Account: name, email address, password (stored only as a hash), profile picture, role in each brand	To create your account, sign you in and manage access.
Sign in with Google or GitHub, when you choose it: provider id and verified email. We store no provider access tokens.	To let you sign in and to match you to your existing account.
Brand content you create: pages, posts, media, menus, settings, translations	To host and deliver your content.
Leads from your forms: names, email addresses, phone numbers, campaign ids, the page they came from	To give the brand its leads, and to forward them to the CRM the brand connects.
Site analytics: page path, referrer, a visitor identifier. Ad and conversion events are sent to platforms such as Meta or TikTok only when the brand turns them on and the visitor consents.	To show the brand its traffic.
Technical data: IP address, browser, request ids and error reports	To keep the service secure, apply rate limits and fix faults. Error reports have personal data removed before they are stored.
Audit trail: who changed what and when, recorded with ids and never with content bodies or secrets	Security and accountability for brand teams.
Messages you send us, for example to [email protected]	To answer you.

3. Cookies and similar storage

We use three kinds of cookies and similar storage:

• Necessary cookies. The dashboard uses a session cookie and a CSRF cookie that keep you signed in and protect your requests, and this website remembers your cookie choice. They are strictly necessary and do not need consent. If you tick "Remember me" the session stays on that device for longer.
• Analytics cookies. This website, atlascms.id, uses analytics cookies to understand how the site is used. They are set only with your consent, and nothing is loaded before you accept.
• Your choice. The cookie banner appears on your first visit. Choose Accept, Decline or Customize. You can reopen it at any time with "Cookie settings" in the footer, and change or withdraw your consent.

Websites that customers build with ATLAS set their own cookies and show their own consent banner.

4. Legal bases

We process personal data on these bases: your consent, where you give it; performance of our agreement with you; our legitimate interests in securing and improving the service, where your rights do not outweigh them; and compliance with legal obligations.

5. Who receives your data (subprocessors)

We do not sell personal data. We share it only with providers that help us run the service, and only as far as needed:

• Hosting and storage. The service and its backups run on servers operated by us in Indonesia. A brand may choose its own S3 compatible storage for media.
• Infrastructure and service providers. ATLAS runs its own email delivery and its own servers in Indonesia. We may use trusted infrastructure and service providers to operate the service, always under confidentiality and data protection obligations. A brand can connect its own SMTP server for its own emails.
• Sign in. Google and GitHub, only when you choose to sign in with them.
• AI drafting. AI drafting features use third-party AI models through processors bound by contract. When a member uses an AI feature, the text they ask us to process is sent to those processors. AI output stays a draft until a person publishes it.
• Error monitoring and integrations. Error reports have personal data scrubbed before they are stored. When a brand connects a CDN or turns on advertising and conversion tracking, data goes to the services the brand chose, on the brand's instructions.

Some of these providers process data outside Indonesia. In that case we rely on the safeguards that UU PDP requires.

6. How long we keep data

• Account data: while your account is active and for a short period afterwards to settle disputes.
• Brand content and leads: until the brand deletes them or asks us to. Deleting a lead removes the record.
• Audit logs: for as long as the account is active, unless the customer asks otherwise.
• Backups: encrypted, kept for at most one month on a rolling basis, and by default they leave out personal data. Longer backup retention is available on request as a paid storage add-on of up to Rp800.000.

7. Security

Every brand is isolated from the others. Secrets such as integration keys are stored encrypted and are never shown again. Webhooks are signed. See the Security page for more. No system is perfectly secure; if a breach affects your personal data we will notify you and the authority within the time UU PDP requires (3 x 24 hours).

8. Your rights

Under UU PDP you have the right to: know how your data is used, access and receive a copy of it, correct or complete it, delete or destroy it, withdraw your consent, object to automated decisions, restrict processing, claim compensation for a breach of your rights, and move your data to another service where this applies. To use a right, write to [email protected]. We may ask you to prove who you are, and we answer within the time the law sets. If you are a visitor of a customer's website, contact that customer first.

9. Children

ATLAS is for businesses and agencies and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.

10. Changes

We update this policy when our practices change. The date at the top shows the latest version. For a material change we tell account holders in advance.

11. Contact

Data protection questions and requests: [email protected], our data protection contact. For anything else write to [email protected]. Company: PT Starset Teknologi Indonesia, Jakarta, Indonesia.