PRIVACY POLICY

The following are the definitions of the terms used in this Policy:

To provide the Services, Veritask collects Data from Users through several methods, which can be classified as follows:

1. Data Knowingly Provided by Users

We collect information that You voluntarily submit when carrying out the following activities:

• Account Registration and Management: Personal identity data (name, mobile number, email address, other contact information) and corporate information (company name, address, business identification number (NIB), position).
• Direct Communications: Information received through interactions with the customer support team, including communications made by email or via Our social media pages. In such interactions, We may collect Personal Data in the form of name, contact information, and the content of the communications or messages You send to Us.
• Financial Transactions: Payment data required to process transactions, including credit card details and e-wallets.
• Use of AI Features: All data, documents, and information input into Veritask's artificial intelligence features for the purpose of automated analysis and processing.
• Other Information You Provide: We may collect other information You provide to Us, including when You participate in events or surveys We organize, and when You provide information to Us or to vendors acting on Our behalf for the purpose of verifying Your identity or age.

2. Data Automatically Recorded in Connection with Use of the Services

While You use the platform, Our systems automatically record the following technical data:

• Activity and Location Data: Platform usage history (login activity, features accessed), approximate location data based on IP address, and server logs.
• Device and Configuration Data: Information about the device used (hardware type, operating system), as well as Your preferences and settings on the platform recorded through technologies such as cookies.
• Device Access (With Permission): The platform may request permission to access components of Your device such as the camera, gallery, and internal storage to enable document upload and download functionality. This access is granted only with Your consent and is limited to files You select.
• Usage Data: We may collect information about Your use of and activity within the Services, including the features You use and the actions You take. We may also collect information related to feedback You provide on model responses, as well as information about Your time zone, country, and the date and time You access the Services.
• Cookies and Similar Technologies: We use cookies and similar technologies to support the operation and management of the Services, and to improve Your experience in using the Services. Certain information as described in this Policy may be stored by Us through the use of cookies, among other things to retain Your preferences between sessions of use when You are not logged in to Your account, and to support authentication and the provision of customer support services. Details on Our use of cookies are set out in Appendix I of this Policy.

We process Your Data on the basis of lawful grounds for processing as stipulated in the PDP Law, namely Your consent, performance of Our contractual obligations to You, compliance with Our legal obligations, and/or Our legitimate interests having regard to Your rights and interests. Your Data may be used by Us for the following purposes:

• Verifying and managing Your account for use of the Site and the Services.
• Providing, operating, and maintaining Our AI-based Services.
• Processing payment transactions and managing Your subscription.
• Enhancing Your experience by personalizing and optimizing the user interface of the Site and the Services.
• Conducting research and analysis to develop and improve the features, security, and quality of the Services.
• Managing promotions, surveys, or other marketing activities.
• Facilitating communication between You and Our customer support team to help resolve questions or issues related to the Services.
• Sending marketing information, newsletters, and other publications that may be of interest to You. You may withdraw this consent at any time.
• Complying with lawful orders from law enforcement officials or competent authorities.

We may combine and/or de-identify Data so that the information can no longer be used to identify You. Aggregated or de-identified Data may be used by Us to analyze use of the Services and to develop and improve the features and quality of the Services.

We implement security measures, including encryption and access restrictions, to protect Your Personal Data from unauthorized access or use. Access to Personal Data is limited to those who need it to perform their duties and responsibilities.

Such aggregated or de-identified Data will not be used by Us to re-identify You, unless required under the prevailing laws and regulations.

Your Personal Data, including documents and information You input into AI features, is not used by Us to train or develop artificial intelligence (AI) models, and We only use third-party AI model providers that, based on their published terms of use and policy statements, do not use it for such purposes.

We will not sell or rent Your Data. We may disclose or transfer Your Data to third parties only under the following conditions:

• Service Providers: We may share Your Personal Data with third-party vendors or service providers acting as Data Processors to help Us provide and operate the Services, including cloud infrastructure providers, data analytics services, and payment processing services.

  We ensure that such Data Processors are bound by written agreements or terms that require them to:

  • maintain the confidentiality and security of the Data;
  • process the Data only for the purposes and in accordance with the instructions We set;
  • limit access to the Data to authorized parties who need to access it;
  • implement reasonable security measures to protect the Data from unauthorized access, use, alteration, disclosure, or destruction; and
  • fulfill obligations relating to Personal Data protection in accordance with the prevailing laws and regulations.
• Corporate Transactions: In the event of a merger, acquisition, restructuring, asset transfer, change of management, or other business transaction involving the Company, Your Data may be transferred or disclosed on a limited basis to parties involved in the transaction for purposes of review and assessment. Such Data may form part of the assets transferred to Our successor or affiliates, subject to applicable Personal Data protection provisions. We will notify You of such transfer of Personal Data in accordance with the prevailing laws and regulations.
• AI Model Providers: To operate AI features, documents and information You input into the Services are processed by the third-party AI model providers We use. Based on their published terms of use and policy statements, such providers do not use Your data to train AI models and retain it only for the limited period necessary for security monitoring and abuse prevention.
• Affiliates: We may share Your Data with Our affiliated companies for the purposes described in this Policy, including customer support, account administration, payment processing, and technical support.
• Third-Party Services You Connect: If You choose to connect Your account with third-party services, such as Google Drive, We may share necessary information with those service providers. Use of such services is subject to the terms and privacy policies of each provider.
• Your Organization: If Your account is provided by the company or organization where You work, We may provide information about Your account and Your use of the Services to that organization.
• Advertising Partners: Subject to Your consent, We may share certain Data with advertising and marketing partners, such as Meta, TikTok, and Microsoft, to display advertisements for Our Services and measure their effectiveness. Further details are set out in Appendix I of this Policy.
• Transfers Outside Indonesia: Some of the service providers We use, including cloud infrastructure providers, AI model providers, and analytics and advertising partners, may process Your Data outside the territory of Indonesia. In such cases, We will ensure that the destination country has a level of data protection equivalent to or higher than the PDP Law. If not, We will ensure that adequate and binding protection is in place or seek Your consent beforehand.
• Legal Obligations: We may disclose Your Data if required by law or to respond to valid legal process.

Aggregate Data: Data that has been aggregated or de-identified as described in the section on Purposes of Processing Your Data may be shared by Us with third parties for the purposes described in this Policy.

1. Our Core Commitment and Protection Measures

Veritask places the confidentiality of Your Personal Data as its highest priority. We are committed to keeping all information You submit confidential and will not disseminate it, except for the purposes and on the processing grounds described in this Privacy Policy.

To protect Your confidential information, including documents and information You input into AI features, We implement the following measures:

• No Data Training Policy (Non-Data Training): Your Data is automatically excluded from the training or development of AI models by Us, without requiring any action from You. We only use third-party AI model providers that, based on their published terms of use and policy statements, do not use data submitted through their services to train AI models.
• Minimal Data Retention: Based on the terms of use and policy statements published by the third-party AI model providers We use, inputs and outputs sent to AI models are not retained by those providers after the request has been processed, except for a limited period necessary for security monitoring and abuse prevention as set out in those providers' terms. We ourselves do not store the inputs You submit to AI features or the outputs generated after the request has been processed. Documents or results that You knowingly choose to save in Your account will remain stored on the platform until You delete them, but We do not access, view, or read the contents of such content, except at Your request or with Your consent (for example, for customer support purposes) or where required under the prevailing laws and regulations. To support this commitment, such content is stored in encrypted form, access to it is limited to certain personnel who require special authorization, and every access is recorded in audit logs that are reviewed periodically.

We periodically review the terms of use and policy statements of third-party AI model providers and will update this Policy if there are material changes.

2. Security Limitations and Your Responsibilities

Although We make our best efforts, it is important to understand that no data transmission over the Internet is completely secure. Accordingly, Veritask cannot provide an absolute (100%) guarantee of security for the data You send.

You also bear fundamental responsibility for maintaining the security of Your account, which includes:

• Account Confidentiality: You must keep Your account details, including email and password, confidential and not share them with anyone.
• Device Security: You are fully responsible for the security of the devices You use to access Our Services.

You hereby agree to release Veritask from any claims or losses arising from Your negligence in maintaining the confidentiality of Your account or the security of Your devices.

3. Storage, Deletion, and Confidentiality Exceptions

Retention Period: Account Data and other Data We collect will be retained by Us only for as long as necessary to fulfill the purposes of processing, for as long as Your subscription remains active, or in accordance with retention periods required by law. After such period ends, the Data will be deleted or destroyed by Us. Provisions regarding AI feature inputs and outputs are subject to the Minimal Data Retention provision in the section on Our Core Commitment and Protection Measures.

AI Data Deletion Requests: Because We do not store AI feature inputs and outputs after the request has been processed, deletion requests relating to AI features apply to documents or results You have saved in Your account. You may delete them yourself through the Services or submit a request in accordance with Appendix II of this Policy.

Information We Retain Until You Delete It: Some of Our Services allow You to delete Personal Data stored in Your account. You may delete certain Personal Data through features available in the Services or by deleting Your account.

After You request deletion of Personal Data, We will delete such Personal Data from Our systems within a reasonable time, unless We are required or entitled to retain it for longer under the prevailing laws and regulations, to fulfill legal obligations, resolve disputes, or protect Our legitimate rights and interests.

Exceptions to the Confidentiality Obligation: Our obligation to maintain confidentiality does not apply to data that:

• Has become public information other than through Our negligence;
• We obtained lawfully from a third party not bound by a confidentiality obligation;
• You have authorized to be disclosed; or
• Must be disclosed under law, court decision, or order of a lawful government authority.

We implement reasonable technical, administrative, and organizational measures to protect Your Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.

Nevertheless, no method of transmission over the Internet or electronic storage is completely secure or error-free. Accordingly, You should be careful in deciding what information You provide through the Site and the Services.

We are also not responsible for the actions of third parties that result in the circumvention or breach of privacy settings or security measures implemented on the Site and the Services, including on third-party sites or services accessible through the Services.

In the event of a Personal Data Protection failure, We will provide written notification to You and the competent authority no later than 3 x 24 (three times twenty-four) hours, which includes at a minimum the Personal Data disclosed, when and how the Personal Data was disclosed, and the handling and recovery efforts We have undertaken.

As a Data Subject, You have rights over Your Personal Data in accordance with the prevailing laws and regulations, including the right to:

• Obtain information about Our identity as the Data Controller, the grounds for processing, the purposes of processing, and other relevant information regarding the processing of Your Personal Data.
• Complete, update, and/or correct Your Personal Data that is incomplete, inaccurate, or inappropriate.
• Obtain access to Your Personal Data that We process and obtain a copy of such Personal Data in accordance with applicable provisions.
• Request the termination of processing, deletion, and/or destruction of Your Personal Data in accordance with the prevailing laws and regulations.
• Withdraw the consent You have given as the basis for processing Personal Data, to the extent such processing is based on Your consent.
• Object to certain processing of Personal Data, including decisions based solely on automated processing, including profiling, in accordance with applicable provisions.
• Request the restriction or postponement of processing of Your Personal Data in accordance with the prevailing laws and regulations.
• Obtain and/or use Your Personal Data in a form consistent with data portability provisions, where such right applies under the prevailing laws and regulations.
• File a claim and obtain compensation for violations in the processing of Personal Data in accordance with the prevailing laws and regulations.
• Lodge a complaint with the competent institution or authority if You believe that the processing of Your Personal Data violates the applicable personal data protection provisions.

How to Exercise Your Rights

To exercise these rights, You may contact Us through the contact details set out in the Contact Us section of this Policy. When submitting a request, We may ask for certain information to verify Your identity and ensure that the request relates to Your Personal Data.

We will follow up on Your request in accordance with the prevailing laws and regulations and within the period stipulated under those provisions, namely no later than 3 x 24 (three times twenty-four) hours from the time We receive Your request for rights subject to such time limit.

The exercise of Your rights may be subject to limitations or exceptions under the prevailing laws and regulations, including where fulfilling the request could affect legitimate interests, legal obligations, law enforcement processes, or other interests protected by law.

Further mechanisms and procedures for submitting and fulfilling Your rights as a Data Subject are set out in Appendix II – Mechanism for Fulfilling Personal Data Subject Rights, which forms an integral part of this Policy.

We may update or amend this Privacy Policy from time to time. If there are changes, We will publish the latest version along with the effective date of the Privacy Policy on this page, unless another form of notification is required under the prevailing laws and regulations.

We encourage You to review this Privacy Policy periodically so You remain informed about how We process and protect Your Personal Data.