1. Who We Are
This Privacy Policy explains how PT TURBULA AKAR INOVASI (“TurbulaAI”, “we”, “us”), a sole-shareholder limited liability company (Perseroan Perorangan) registered in Indonesia at Infiniti Office, Bellezza BSA 1st Floor Unit 106, Jl. Letjen Soepeno, Jakarta Selatan, DKI Jakarta, handles personal data when you visit our website at turbula.ai or our legal pages at legal.turbula.ai (together, the “Website”), join our early-access waitlist, or contact us.
We are the personal data controller (pengendali data pribadi) under Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”) and, where they apply, the EU GDPR and UK GDPR. You can reach us, including the person responsible for data protection, at [email protected].
2. What This Policy Covers
This Policy covers personal data, meaning information about a person who can be identified, directly or indirectly, on its own or combined with other information. It applies to Website visitors, people who register on our early-access waitlist, and anyone who contacts us.
The Website currently provides company and product information and allows visitors to join our early-access waitlist; it does not yet offer user accounts, file uploads, or paid plans.
3. What We Collect
| Category | What it includes |
|---|---|
| Waitlist data | First name, last name (optional), and email address when you join our early-access waitlist |
| Consent and policy version records | The Privacy Policy version in effect (PRIVACY_POLICY_VERSION), timestamp, and confirmation status when you submit the waitlist form or give consent |
| Contact data and communications | Name, email address, organization (if provided), and the contents of your message when you email or contact us |
| Website technical and anti-abuse data | IP address, browser and device information, and request logs processed by our hosting provider to deliver and protect the Website; a one-way salted cryptographic hash of your IP address used to enforce waitlist rate limits; and Cloudflare Turnstile anti-bot verification tokens |
| Cookie and security token data | Identifiers stored by strictly necessary security cookies and anti-bot tokens (Section 10) |
We do not seek specific personal data under Article 4(2) of the PDP Law, such as health, biometric, genetic, criminal record, children’s, or personal financial data. Please do not send us specific personal data.
4. Why We Use It
Each purpose has a legal basis under Article 20(2) of the PDP Law (and Article 6 of the GDPR where it applies). We collect only what each purpose needs.
| Purpose | Legal basis |
|---|---|
| Running and protecting the Website | Legitimate interest |
| Preventing automated abuse and enforcing rate limits on the waitlist (Cloudflare Turnstile and salted IP hashing) | Legitimate interest |
| Registering you on the early-access waitlist, sending your confirmation email, and notifying you about early access and product availability | Fulfilling your request before entering into an agreement; your consent |
| Answering inquiries (general, partnership, press, or privacy requests) | Legitimate interest |
| Optional news and marketing updates | Your consent |
| Legal compliance, handling data subject rights requests, and legal claims | Legal obligation |
Where we rely on legitimate interest, we have weighed it against your rights, and you can object (Section 9). Where we rely on consent, we ask for it explicitly in a written or recorded form (Article 22) and keep proof of it, including the Privacy Policy version and timestamp recorded at submission (Article 24). Contacting us with a general inquiry is not consent to marketing.
5. Who We Share It With
- 5.1
We do not sell personal data.
- 5.2
Service providers. We use providers for website hosting, serverless database storage, anti-bot security, transactional waitlist emails, and corporate email. They act only on our instructions under written data protection agreements. Their names, countries of establishment, purposes, and processing locations are listed on our Subprocessors page at legal.turbula.ai/subprocessors.
- 5.3
Authorities. We disclose personal data only in response to a lawful, verified request, such as a court order. We disclose only what is required, keep a record, and tell you where the law allows.
- 5.4
Protecting rights. We may disclose personal data where necessary to protect the rights, safety, or property of TurbulaAI, our visitors, or others, as permitted by law.
- 5.5
Company changes. If TurbulaAI merges, splits, is acquired, consolidates, or converts its company form, we will notify you before and after your personal data is transferred (Article 48). If TurbulaAI is dissolved, we will tell you whether your data is stored, transferred, deleted, or destroyed.
- 5.6
Anyone else only with your consent.
6. Transfers Outside Indonesia
- 6.1
Where data goes. Website traffic, anti-bot verification, and waitlist database records (stored in Cloudflare D1) are processed across Cloudflare’s global network, including the United States. Transactional waitlist confirmation emails are sent via Resend in the United States, and corporate emails are handled on Google’s global infrastructure. The providers receiving this data are established outside Indonesia (see the Subprocessors page).
- 6.2
Legal basis. We follow Article 56 of the PDP Law in order: (a) we first check whether the recipient’s country of establishment offers protection equal to or higher than the PDP Law; (b) if not, we put binding safeguards in place, such as data processing agreements; (c) only if neither applies would we ask for your consent. Our current transfers rely on (b); none relies on your consent.
- 6.3
Risks. Data processed abroad is subject to that country’s laws, which may allow access by its authorities under different conditions. We use providers with strong security and contractual protections to reduce this risk.
- 6.4
EEA and UK users. Your data is processed in Indonesia, the United States, and other countries in our providers’ networks. Where the GDPR or UK GDPR requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses in our providers’ data processing terms.
7. How Long We Keep It
| Data | Kept for |
|---|---|
| Waitlist data (first name, optional last name, email address) | While the waitlist is open and until early-access invitations conclude, or until you withdraw consent or ask us to remove you (removed within 30 days of your request) |
| Consent and policy version records | While the waitlist registration or consent is relied on, plus the period needed to prove compliance |
| Salted IP hashes for waitlist rate limiting | Stored only as a one-way salted cryptographic hash (never your raw IP address in our database) for as long as necessary to enforce waitlist rate limits and prevent automated abuse, and deleted when the associated waitlist or rate-limit record is removed |
| Website technical and security logs | The limited period our hosting and security provider keeps them to deliver and protect the Website |
| Cookie and security token data | For the duration of the session or the limited validity window of the security token (Section 10) |
| Contact data and inquiries | Up to 24 months after our last correspondence, unless you ask us to delete it sooner |
| Marketing list (if applicable) | Until you withdraw consent; removed within 30 days after |
| Records of rights requests | 24 months after the request is completed |
| Backups | Removed in the normal backup cycle |
After these periods, we delete, destroy, or anonymize the data. When we delete your data because you asked or withdrew consent, we will confirm it to you (Article 45).
8. Security, Accuracy, and Breaches
- 8.1
We protect personal data with measures suited to the risk, including HTTPS encryption, strict Content Security Policy (CSP) headers, one-way salted cryptographic hashing of IP addresses for rate limiting, multi-factor authentication on administrative accounts, and access limited to personnel who need it.
- 8.2
We take reasonable steps to keep your data accurate and complete, and verify it where needed (Article 29). Please tell us at [email protected] if your waitlist or contact details change.
- 8.3
If a data breach occurs, we will notify affected people and the competent authority in writing within 3 x 24 hours of becoming aware of it (Article 46), stating what data was affected, when and how, and what we are doing about it. Where Article 46(3) requires, such as when a breach seriously affects the public, we will also notify the public. We also meet GDPR notification requirements where they apply.
9. Your Rights
- 9.1
Under the PDP Law you have the right to:
- a.
know who processes your data, why, on what basis, and how we are accountable (Art. 5);
- b.
correct or update your data (Art. 6);
- c.
access and get a copy of your data, with the record of how it was processed (Arts. 7 and 32);
- d.
end processing and have your data deleted or destroyed (Art. 8);
- e.
withdraw consent at any time (Art. 9);
- f.
object to automated decisions with legal or significant effects (Art. 10);
- g.
delay or restrict processing (Art. 11);
- h.
sue and claim compensation for violations (Art. 12); and
- i.
receive your data in a machine-readable format and have it sent to another controller where the systems can communicate securely (Art. 13).
- a.
Where the GDPR or UK GDPR applies, you can also object to processing based on legitimate interest and to direct marketing. These rights are subject to the exceptions in the law.
- 9.2
How to ask. Email [email protected] from the email address you used on the waitlist or in your inquiry, and describe your request clearly. Every request is recorded (Article 14), and we may verify your identity first.
- 9.3
How fast. Within 3 x 24 hours of a complete request, we will:
| Request | Our action |
|---|---|
| Correction or update (Art. 30) | Make the change and tell you the result |
| Access (Art. 32) | Give you access to your data and its processing record |
| Withdrawal of consent (Art. 40) | Stop the processing based on that consent |
| Delay or restriction (Art. 41) | Delay or restrict processing and confirm it is done |
Other requests are handled within the time the law requires. If we cannot fulfil a request because a legal exception applies, we will explain why.
- 9.4
Cost. Exercising your rights, including getting a copy of your data, is free, except in specific circumstances that genuinely require costs. Under the GDPR, we may also refuse or charge for manifestly unfounded or excessive requests.
- 9.5
Accessibility. If you have a disability and need this Policy, your rights, or a consent request in an accessible format or through another means of communication, contact us and we will provide it, obtaining consent from you or your guardian where required (Article 26).
10. Cookies and Security Tokens
We use only strictly necessary security cookies and tokens. On the Website, our hosting and security provider (Cloudflare) uses security tokens and Cloudflare Turnstile on the waitlist form to detect bots, prevent automated abuse, and protect the Website against attacks. These cookies or tokens may temporarily store technical identifiers linked to your browser or device, which may constitute personal data.
We do not use analytics, advertising, or cross-site tracking cookies. You can configure your browser settings to block or delete cookies, though blocking strictly necessary security cookies or tokens may prevent the waitlist form from verifying your submission. If we ever introduce non-essential cookies in the future, we will update this Policy and ask for your consent first.
11. Other Things to Know
- 11.1
Age. The Website and waitlist are only for people aged 18 or over. We do not knowingly collect data from anyone younger and will delete it if we find out. Please contact us if you believe this has happened.
- 11.2
Automated decisions. We do not profile anyone or make automated decisions with legal or similarly significant effects about people. We use automated anti-bot verification (Cloudflare Turnstile) and rate limiting on our waitlist form to prevent spam and abuse; if your waitlist submission is blocked in error, you can reach us at [email protected] and a person will assist you.
- 11.3
EEA and UK representatives and complaints. Where required by Article 27 of the GDPR or UK GDPR, we will appoint a representative and list them here. You may complain to the data protection authority where you live or work, or to the UK Information Commissioner’s Office.
12. Changes and Language
- 12.1
We may update this Policy by publishing a new dated version on this page. For material changes, we will give reasonable advance notice on the Website or by email where appropriate. For changes to consent-based processing, we will notify you before the change takes effect (Article 21(2)). We will ask for new consent before using your data for a new purpose that needs it.
- 12.2
This Policy is available in Bahasa Indonesia and English. For users in Indonesia, the Bahasa Indonesia version prevails if they differ; for everyone else, the English version prevails unless local law requires otherwise.
13. Contact and Complaints
PT TURBULA AKAR INOVASI
Infiniti Office, Bellezza BSA 1st Floor Unit 106, Jl. Letjen Soepeno, Jakarta Selatan, DKI Jakarta
Email: [email protected]
If you are not satisfied with our response, you can complain to Indonesia’s personal data protection authority, currently the Ministry of Communication and Digital Affairs (Komdigi), or the dedicated personal data protection agency once established, or to the authority in your country (Section 11.3).