Privacy Policy

What we collect

• Account details. When you register we store your name, your email address, and a hash of your password. We never store the password itself. Your role (staff, admin, or super-admin) is stored with your account.
• Sign-in activity. We keep an audit trail of sign-ins, sign-outs, failed sign-in attempts (including the email address that was typed), password resets, and email verification. Changes that signed-in team members make to users, settings, and blog posts are logged with their name and the time.
• Session data. While you are signed in, the server keeps a session record that includes your IP address and your browser's user agent. It is used to keep you signed in and to protect your account.
• Content you add. Blog posts and images that signed-in team members upload.
• Emails. We send verification and password reset emails to the address on your account. We do not send marketing email.
• Server logs. Like most web servers, the server that hosts this site may log the IP address, the page requested, and the time of each request, for security and troubleshooting.

Cookies and local storage

Essential cookies are needed for the site to work and are set without asking. Nothing else is set unless you agree.

• rewire-starter-kit-session: keeps you signed in. Essential. It expires after 120 minutes without activity.
• XSRF-TOKEN: protects forms against cross-site request forgery. Essential.
• remember_web_*: set only if you tick "Keep me signed in on this device". It keeps you signed in after you close the browser.

Fonts are served from this site, so no font provider sees your visit.

Why we use your data

• To create and run your account, and to keep it secure.
• To send the account emails described above.
• To keep the audit trail that shows who changed what in the dashboard.
• To meet legal obligations when they apply to us.

Who we share it with

We do not sell personal data. We share it only with the service providers that run this site for us: our hosting provider, our email delivery provider, and Google if you accept analytics cookies. We may also disclose data when the law requires it.

How long we keep it

• Account details are kept until you ask us to delete your account or an administrator removes it.
• Audit trail entries are kept for 365 days. A scheduled job deletes older entries.
• Session records expire after 120 minutes without activity.

Your rights and choices

Depending on where you live, laws such as the EU GDPR or Indonesia's Personal Data Protection Law (Law No. 27 of 2022) give you rights to access, correct, delete, or restrict the use of your personal data, and to object to processing or withdraw consent.

• You can change your name and email address in your account settings after you sign in.
• To get a copy of your data or to have your account deleted, email admin@recodex.id.

Security

In production, pages are served over HTTPS, passwords are stored as hashes, and admin areas are limited by role. No system is completely secure, so we cannot promise absolute security.

Children

This site is not aimed at children, and we do not knowingly collect their personal data.

Changes to this policy

When we change this policy we update the date at the top of the page. If a change is significant, we say so here.

Contact

Questions about this policy go to PT Reka Mitra Teknologi at admin@recodex.id.