Privacy Policy

This Privacy Policy explains how Posturian Technologies (“Posturian”, “we”, “us”) handles personal data when you visit our website or contact us about our products. It does not describe how the Posturian platform processes data on behalf of customers; that is covered by the agreement we sign with each customer.

Our approach

We aim to follow widely recognised privacy principles when we handle personal data:

• Transparency. We tell you what we collect, why, and who receives it.
• Purpose limitation and data minimisation. We collect only what we need for the purposes below; for example, the message field in the demo form is optional.
• Storage limitation. We keep personal data only as long as needed (see Retention).
• Security and accountability. We protect personal data with technical and organisational measures and respond to your requests.

1. Who we are

Posturian Technologies is the controller of the personal data described in this policy.

Contact: contact@posturian.ai

2. Data we collect

• Demo requests, contact messages, and emails. When you request a demo, send us a message through the contact form, or email us: your name, email address, company, the topic you choose, and any message you write. For demo requests and contact messages we also record your IP address and the time of submission, to prevent abuse and to limit repeated submissions, and a follow-up status so our team can track the response.
• Website events. When you submit the demo or contact form, we record that the event happened: the event name, the time, the page path (without query strings), and a random identifier that exists only in your browser tab session (no cookie) and is created only if you accepted analytics. These records contain no name, email address, IP address, or message, and are used only for aggregate counts.
• Visitor analytics (only with your consent). If you accept analytics cookies, we record each public page you open: the page path (without query strings), the time, the website that referred you (host name only), your device category (desktop, mobile, or tablet), your approximate location (country, province or region, and city), and a one-way daily hash. Approximate location is worked out on our own servers from your IP address using a local geolocation database (IP geolocation by DB-IP.com, licensed CC BY 4.0). Your IP address is used only for that lookup and is then discarded; no external geolocation service is called. The hash is computed on our server from your IP address and browser type with a secret key and changes every day, so it lets us count unique visitors per day but cannot be reversed or used to follow you across days. We do not store your IP address or browser type, and we do not record your location for visits after the first page of a session, nor visits to sign-in or account pages. If you decline, none of this is recorded. You can change your choice at any time through “Cookie settings” in the footer.
• Accounts. You can create an account with a work email address that you verify by email, or receive one from our team. For each account we store your name, your company name, your email address and whether it is verified, and your password in hashed form (we cannot read it). To limit repeated sign-in and password-reset attempts we keep short-lived counters per account, stored under a one-way hash of your email address and deleted automatically. We send verification and password-reset emails through our email delivery provider. When you sign in we record a session containing its expiry time, your IP address, and your browser type (user agent).
• Sign-in attempt counters. To limit repeated sign-in attempts, we keep a counter per IP address and request type.
• Technical data. Like most websites, our servers may record standard technical information, such as IP address, browser type, and request time, to keep the website secure and reliable. The website does not use advertising trackers.

We do not knowingly collect personal data from children.

3. How we use your data

• To respond to your enquiry and arrange a product demonstration.
• To create and operate your account, keep you signed in, and protect accounts from unauthorised access and repeated sign-in attempts.
• To operate, secure, and improve our website, and to prevent abuse.
• To meet legal obligations and to establish, exercise, or defend legal claims.

We do not sell your personal data.

4. Legal bases

Where data protection law requires a legal basis, we rely on your consent (for example, when you submit the demo request form), our legitimate interest in running our business, securing our services, and responding to enquiries, performance of an agreement with you or your organisation (for accounts), and compliance with legal obligations.

5. Sharing

Email delivery. When you submit the demo request form, we use Resend, an email delivery provider, to send our team a notification containing the details you submitted (name, email address, company, and message).

Infrastructure and network providers. We use hosting and database infrastructure to run the website, and network, content delivery, and security services that carry and protect website traffic, which means your requests may pass through those providers’ systems. We share personal data with other service providers only where they help us operate our website and communications, and where required by law.

6. International transfers

Our email delivery provider, network and content delivery providers, and other service providers may process personal data in countries other than your own, including outside Indonesia. Where personal data is transferred across borders, we put in place the safeguards required by applicable law.

7. Retention

• Demo requests and contact messages: deleted automatically 12 months after they are received, or sooner if you ask us to delete them.
• Accounts: kept while the account is active and removed when it is closed or when you ask us to delete it.
• Sessions: expire after at most 7 days, or when you sign out.
• Sign-in attempt counters: used only to limit repeated attempts and deleted within 24 hours.
• Website events: deleted after 180 days; the random tab identifier is removed after 30 days. They are not linked to your name or email.
• Security and administration logs (for example sign-ins to administrator accounts and changes made by administrators, including the IP address): kept for 12 months to investigate incidents and abuse, then deleted.

We may keep data for longer where the law requires it.

8. Security

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, or misuse. No method of transmission or storage is completely secure.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data and request deletion;
• restrict or object to certain processing;
• withdraw consent at any time, without affecting earlier processing;
• data portability; and
• lodge a complaint with your local data protection authority.

How to exercise your rights. Email contact@posturian.ai and tell us what you would like us to do, including the name and email address you used with us. We may need to verify your identity before acting on a request, for example by asking you to confirm from that email address. We will respond within the time required by applicable law, and we will tell you if we cannot act on a request and why.

10. Cookies

The Posturian website sets only essential cookies (a cookie that remembers your cookie choice, and a session cookie if you sign in) and, only if you accept, an analytics preference that lets our own visitor analytics run. There are no advertising trackers. See our Cookie Policy for details.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows when it last changed.

12. Contact

Questions about this policy: contact@posturian.ai.