Privacy Policy

This Privacy Policy explains how PT SIPILOT INFORMASI TEKNOLOGI — G Land Arcadia 3 No. 11, Jl. Cikoneng, Bojongsoang, Bandung Regency, West Java 40288, Indonesia. ("Sipilot", "we") collects, uses, stores, and protects your personal data when you use https://sipilot.id and related services (the "Service").

1. Data We Collect

a. Account data

When you create an account we store your name, email address, and authentication credentials. Your account role (e.g. member or administrator) is also stored to control access.

b. Class, webinar, and registration data

When you register for a class or webinar we store your full name, email address, WhatsApp number, registration reference code, payment status, and session/cohort assignment. Transactional emails (registration confirmation, payment confirmation, schedule invitation with the meeting link) are sent to the email address you provide.

c. Membership data

If you take a membership plan, we store your membership tier, status, and related history attached to your account.

d. Payment records

Class payments are verified manually by an administrator (e.g. bank transfer): we store the payment method, amount, recorded reference, verification status, and an audit trail of who verified it. For purchases offering online checkout, payment is processed by Xendit — we store the payment-session reference and status returned by Xendit. In either flow we never store your card numbers or banking credentials.

For manual bank-transfer payments you may upload payment proof (a JPG/PNG image or PDF, max 5 MB). Proof is stored in private storage — not publicly accessible — and can only be opened briefly by an authorized administrator via a time-limited link that expires quickly, solely to verify your payment. An uploaded proof is not by itself a payment confirmation; SiPilot verifies payments against our official bank account records.

e. Virtual assistant and messages

The "Ask SiPilot" feature processes questions you submit through a third-party AI provider (OpenAI) to generate answers. Your questions are sent to that provider solely to produce a response. Please do not enter sensitive personal data into assistant conversations.

f. Cookies and local storage

The Service uses session cookies for authentication and browser local storage for preferences such as language choice. We do not use advertising cookies or third-party trackers.

2. How We Use Data

• Providing and operating the Service, including accounts, classes, webinars, and membership.
• Verifying payments and scheduling participants into sessions/cohorts.
• Processing payment proof you upload solely to verify your payment.
• Sending transactional emails (confirmations, schedule invitations, meeting links).
• Keeping the Service secure, preventing abuse, and meeting legal obligations.

3. Third-Party Processors

• Resend — transactional email delivery. Resend processes your name, email address, and message content to deliver emails.
• Supabase — the database, authentication, and private file-storage infrastructure where Service data is stored, including payment proof.
• Google Calendar — only through administrator action (see section 4).
• OpenAI — processes questions submitted to the virtual assistant feature (see section 1e).
• Xendit — processes online payments for purchases offering online checkout.

4. Google Calendar Integration

An administrator may connect a single organizer Google account via OAuth with the calendar.events scope only. The integration is used to create and delete class-session calendar events with Google Meet links on the organizer's calendar. Events are created with no attendee list and no Google notifications — participant data is not sent to Google through this integration.

Google access tokens are short-lived; the refresh token is stored encrypted on our servers and is never displayed, logged, or shared. The administrator can revoke access at any time via the disconnect control in the admin panel or through the Google account permission settings, which removes the connection and the stored token.

5. Data Retention

We keep data while your account is active and as long as needed to provide the Service, maintain operational and financial records, and meet legal obligations. Payment records — including payment proof you upload — and audit trails are retained for reconciliation, accountability, and to meet applicable Indonesian bookkeeping and tax obligations; retention follows those legal duties.

6. Your Rights

You may request access to, correction of, or deletion of your personal data, and raise questions or objections about data processing, by contacting us at sipilotinformasiteknologi@gmail.com. We will respond to legitimate requests in accordance with applicable law.

7. Security

We apply reasonable technical and organizational measures to protect data, including role-based access control, server-side processing for privileged operations, and encryption of integration tokens. No system is completely secure; we cannot guarantee absolute security.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version is always available on this page together with its update date.

9. Contact

For privacy and legal questions or requests, contact: PT SIPILOT INFORMASI TEKNOLOGI — G Land Arcadia 3 No. 11, Jl. Cikoneng, Bojongsoang, Bandung Regency, West Java 40288, Indonesia. Email: sipilotinformasiteknologi@gmail.com. For operational support: admin@sipilot.id.