Security & Policies

Scope

This policy applies to the Finance space for personal and business sales and purchase invoices, accounting records, funding accounts, contacts, transactions, shared spaces, precious metals, and activity history.

Data we may process

The data involved depends on the features you use and the information you choose to provide.

• financial account names, contacts, invoices, items, payments, categories, transactions, notes, and attachments you enter
• the business identity and member role used to open a business Finance space
• shared-space settings and the members you invite
• activity data that helps trace changes
• the minimum technical data needed to protect sessions and prevent unauthorized access

Sources and collection

Data may come from you, another member's action connected to your account, an authorized party in a service process, or your browser and device when a feature is used. We seek to explain the need when data is requested and do not request unrelated data without a reasonable purpose.

• You may provide data through forms, settings, Chat, uploads, email, support, or a service workflow.
• Technical data such as sessions, devices, times, and security signals may be created automatically to operate the service.
• When an account is created, we record the connection IP address and its estimated country for account history and security. The estimate uses reference data held on our server without sending the IP address to a location lookup service. A VPN or the network you use can affect the result; the connection country does not establish nationality or home address. It also helps set the initial language. You can still choose Indonesian or English.
• Data from another party is processed only when connected to a function, access decision, report, or lawful obligation.

Why data is used

Data is used only for legitimate purposes connected to the service.

• store and display the invoices, accounting records, and financial records you create
• link recorded invoice payments to the same space's cash flow
• manage personal and business access according to membership and roles
• maintain change history and provide support
• maintain product reliability and security

Visibility and sensitive data

Some visibility choices can be managed in product settings.

• Finance records are private by default and are not used for transaction-based advertising.
• Shared-space data is disclosed only to invited members under their assigned roles.

Finance data sources and types

Finance data mainly comes from your account, financial account names and types, categories, transactions, currencies, amounts, dates, notes, attachments, shared-space settings, and activity you enter. We also receive minimum technical data from sessions, devices, and requests for security.

We do not need a bank password, PIN, one-time code, private key, or banking credential to provide record keeping. Do not put one in a note or attachment.

• Transaction data is used to store, sort, calculate, filter, and display the records you request.
• Space data is used to enforce invitations, roles, and access boundaries.
• Activity data is used to trace changes and support troubleshooting.

Record and shared-space privacy

Finance records are private by default. In a shared space, data may be visible to invited members under their role and permission. The server checks session and membership; knowing a space ID is not enough to obtain data.

The space owner is responsible for member choices, but that does not remove application access controls or each member's duty to keep information confidential.

• Records are not used for transaction-based advertising.
• Data is not published to a profile, public search, or Insimen as part of Finance use.
• Attachments are served through access-checked paths and should not be stored in a public folder.

Operations and providers

Data is used to operate features, keep calculations and history consistent, send enabled notifications, prevent unauthorized access, handle errors, and provide support. Technical logs should use only necessary metadata and should not over-collect credentials or record contents.

Hosting, database, storage, email, or monitoring providers may help operate the service with limited access appropriate to their task.

Retention, deletion, and export

Retention for records, attachments, change history, support reports, and backups may differ. Data is deleted, anonymized, or restricted when no longer needed unless it must be kept for security, fraud prevention, audit, disputes, or obligations.

Deleting a space or account may affect other members and shared history. We may request confirmation or verification before a request that could delete shared data.

• Access or correction requests may require identity verification and a check of whether data belongs to you or another member.
• Recovery backups may remain for a limited cycle before being overwritten or deleted.
• Keep exports or financial evidence secure and do not share private links publicly.

Rights and request limits

You may request access, correction, update, restriction, or deletion of certain data through the privacy channel. We assess the request based on ownership, impact on a shared space, and applicable obligations.

Other members' data, audit records, or information needed for security may not always be provided or fully deleted.

Sharing

We do not sell personal data as a commodity. Data may be shared on a limited basis with:

• members you invite to a shared space and grant access to
• support personnel who need to address an issue you report
• infrastructure providers needed to operate the service securely

Retention and security

Data is retained only as long as needed to operate the service, protect users, resolve disputes, or meet applicable obligations. It is then deleted, anonymized, or restricted as appropriate.

We use technical and organizational controls proportionate to risk. No digital transmission or storage can be guaranteed 100% secure, so users must also protect their accounts and devices.

Your requests

Subject to applicable law, you may request access, correction, restriction, or deletion of certain data. Some information may need to be retained for security, audit, service, or legal reasons. We will explain a decision where reasonably possible.

Cookies and similar technology

Cookies or similar technologies may be used for sessions, language preferences, security, and product operation. Disabling necessary cookies may prevent parts of the service from working.

Updates

This policy may be updated when the product, processing practices, or legal requirements change. The latest version is identified by the update date above; material changes may receive an additional notice through an appropriate channel.