Privacy Policy

Effective date: OCT 20 2026

Introduction

Coding Folks ("we", "us", "our"), a team of independent software developers based in Depok, Indonesia, respects your privacy. This Privacy Policy explains what personal data we collect through codingfolks.dev and when you work with us on a project, why and on what basis we use it, who receives it, how long we keep it, and your rights under Indonesian law, including Law No. 27 of 2022 on Personal Data Protection ("UU PDP"). Coding Folks is not a registered company. The team members who answer your email or sign your Project Agreement are the controller of the data described in this policy, except where the section "Client Project Data" says otherwise.

Information We Collect

Contact details you send us by email or message (name, email, phone/WhatsApp, company)
Project information you share during consultation and delivery (goals, budget, requirements, files)
Billing details needed to invoice you (name or company name, address, tax number)
Technical data our hosting provider records when you visit the website (such as IP address, browser type and the pages requested) in server logs
Payment details are processed by our third-party payment provider or your bank; we do not store your card information.

This website has no contact form, accounts or tracking. What you choose to put in an email to us, including the project choices the price estimator writes into one, is what we receive.

How We Use Your Information

We use personal data only for the purposes below, each on the basis shown.

To respond to inquiries and prepare project proposals (your request, and your consent when you write to us)
To deliver, maintain, and support the software we build for you (performing our agreement with you)
To send project updates, invoices and payment reminders (performing our agreement with you)
To keep accounting and tax records (a legal obligation)
To keep the website secure and working (our legitimate interest)

We do not use your data to profile you or make automated decisions about you, and we do not send marketing messages unless you have asked for them.

Client Project Data

Any data, content, or materials you provide for a project (e.g. text, images, business data) remain your property. We access this data only to complete the agreed project and do not use it for any other purpose without your consent.

If that material includes personal data of other people, such as your customers or employees, you are the controller and we act as your processor. In that case we process it only on your instructions and for the project, keep it confidential, apply reasonable security measures, use sub-processors only as described in "Data Sharing", tell you without undue delay if we learn of a breach affecting it, and return or delete it when the project ends. You are responsible for having the right to give it to us. For government or enterprise clients, data handling follows any additional confidentiality terms agreed in the project contract or NDA.

Data Sharing

We do not sell your personal information. We may share data with:

Sub-processors strictly necessary to deliver a project (e.g. hosting providers, email and file storage services, payment gateways), who may only use it for that purpose
Members of our team and independent contractors working on your project, who are bound by confidentiality
Authorities, if required by law

Some of these providers operate servers outside Indonesia. When your data is transferred abroad, we make sure the destination offers an equal or higher level of protection, or we put other safeguards in place as the law requires.

Cookies

This website measures how it is used only if you agree. When you first open it you can accept or decline, and if you decline, or do not answer, no cookie is set and nothing is sent. If you accept, Google Analytics 4 (Google) sets cookies and records how the site is used: the pages you see, the links you click (for example the contact buttons), your approximate region, and your device and browser. Your IP address is anonymised. We use this only to see what works and to improve the site, not for advertising. You can change your answer at any time with "Cookie settings" in the footer. Apart from that, the only thing the site keeps on your device is your price estimate, in your browser's session storage, so that it can be carried from the estimator to the contact form; it is not sent anywhere and goes when you close the tab. Your browser or the links you follow (for example to social networks) may set their own cookies, under their own policies.

Data Retention

We keep personal data only as long as the purpose needs:

Inquiries that do not lead to a project: up to 12 months after the last message
Project data: for the duration of the project and the warranty period, then up to 24 months for support and disputes, then deleted or anonymized
Invoices and accounting records: for the period tax and company records laws require (currently up to 10 years)

You can ask us to delete or anonymize your data earlier, unless the law requires us to keep it.

Your Rights

Under UU PDP you may ask us to:

tell you what data we hold about you and how we use it, and give you a copy;
correct or complete data that is inaccurate;
delete data, or stop processing it, when the law gives you that right;
withdraw a consent you have given, and object to processing we do on other grounds;
give you your data in a structured, commonly used format, or send it to another controller, where the law provides for it.

Write to the email below. We may need to confirm who you are first. We respond as the law requires, and in any case within 14 days. If we cannot do what you ask, we will explain why. If you are not satisfied, you may also complain to the personal data protection authority.

Security and Data Breaches

We protect personal data with reasonable technical and organizational measures, such as access limited to those who need it, encrypted connections and separate accounts for each service. If a breach puts your data at risk, we will notify you and the authority within the time the law sets (currently 3 x 24 hours), with what happened, what data is involved and what we are doing about it.

Children

Our services are for businesses and adults. We do not knowingly collect data from anyone under 18. If you think a child has sent us data, write to us and we will delete it.

Changes to This Policy

We may update this policy from time to time. We will show the new effective date above and, for changes that matter, tell clients we work with by email. A change applies from its effective date and does not reduce rights you already have under an agreement with us.

Contact

Questions or requests about this policy can be sent to hello@codingfolks.dev