Privacy Policy

This Privacy Policy explains which personal data PT. Inolab Teknologi Indonesia ("Inolab", "we") collects when you use Inolab at inolab.id, app.inolab.id, business websites at *.inolab.id and the Inolab mobile app, what it is used for, who it is shared with, and your rights over it. It is written in line with Law No. 27 of 2022 on Personal Data Protection, and section 12 sets out additional terms for users in Malaysia, Vietnam and the Philippines.

1. Our role

• For your account data, subscription data and visitors of inolab.id, we are the data controller.
• For data your business enters or collects through Inolab, such as customers, prospects, invoices, cashier sales, messages from the business website and automatic emails to customers, your business is the data controller and we process that data on your business's behalf, only to provide the service. Customers, prospects or visitors of a business website who want to access, change or delete their data should contact that business; we help the business meet the request.
• For business data we look up in public sources to offer Inolab (section 2), we are the data controller.

2. Data we collect

• Account data: name, email, password (stored as a hash, never as plain text), language preference, and two-factor authentication settings (the secret key is stored encrypted).
• Business data: business and legal name, address, phone, email, tax number, payment instructions, the business website's profile and content, and team members with their roles.
• Data the business enters: customers and their consent to reminders, prospects, quotes, invoices, payment records, cashier sales and returns, stock, internal notes and ready answers.
• Messages and automatic emails: messages people send through a business website's forms, and follow-up and reminder emails sent or prepared by automation, with their status.
• Support tickets: your questions and conversations with the Inolab team.
• Subscription payment data: plan, amount, status and the transaction reference from the payment provider. We do not receive or store card numbers, PINs or bank account passwords.
• Technical data: IP address, browser and device type, and activity times, for sign-in sessions, sign-in rate limiting, the activity log and choosing the site language (section 6).
• Mobile app: device name and notification token, if you use the mobile app and turn on notifications.
• Businesses from public sources: to offer Inolab to businesses, we read business data published on OpenStreetMap (business name, type, address and the business contacts listed there) and the business's own website. We record the source, never open social networks or marketplaces, and send no automatic messages to those businesses. A business that does not want to be contacted can ask us to delete its data and put it on our do-not-contact list.

3. How we use data

• To provide the service: accounts, invoices, the cashier, business websites, reports, automation and teamwork.
• To send service email: email verification, password resets, team invitations, invoices and quotes the business sends, automatic emails the business switches on, the weekly report, and subscription reminders and confirmations.
• To process subscription payments.
• To keep the service secure: two-factor authentication, abuse prevention, system monitoring and the activity log.
• To answer support tickets.
• To offer Inolab to businesses from public sources, by our team directly.
• To meet legal obligations, such as keeping transaction records.

The legal bases are performing our agreement with you (the Terms of Service), complying with legal obligations, our legitimate interest in keeping the service secure and in offering Inolab to businesses, and your consent where required. We do not sell personal data or use it for advertising.

4. Who receives data

• Payment providers (Midtrans, Xendit): the account owner's name and email, the plan name and the amount paid, when you pay for a subscription.
• A business's own Xendit account, when connected: when a business connects its own Xendit account so that its customers can pay invoices online, the invoice number and amount and that customer's name and email are sent to Xendit to open the payment page. Xendit processes it for that business and the money does not pass through Inolab. The key of the business's Xendit account is stored encrypted.
• Hosting and email providers: where our application, database, backups and email delivery run.
• Firebase Cloud Messaging (Google, United States): device tokens and notification content, only when mobile app notifications are on.
• Data processor for Inolab AI (our AI assistant): OpenAI (United States), or Anthropic (United States) if we switch to it: only when the business owner turns it on in Settings › AI. That page names the provider in use, and consent is asked again when the provider changes. Sent: team members’ questions and the business data needed to answer them within the asker’s access (for example customer names, invoice amounts, report summaries and activity notes), and invoice details for payment reminder drafts. Email addresses, phone numbers, tax numbers and street addresses are not sent. The AI provider processes the data on our behalf and, under its API terms, does not use API data to train models. OpenAI keeps abuse-monitoring logs for up to 30 days; we ask OpenAI not to store conversations. The owner can turn the feature off at any time.
• Recipients the business chooses: invoices, quotes and automatic emails are sent to the business's customers and prospects on the business's instruction.
• Authorities: when required by law.

5. Transfers abroad

Inolab is operated from Indonesia. If you use Inolab from another country, your data is transferred to Indonesia and processed there. Some of the providers in section 4 are in the United States. We only use providers that process data on our behalf under written terms, send data over encrypted connections, and send only the data that is needed. We remain responsible for data those providers process for us.

6. Cookies and site language

The inolab.id site and the app at app.inolab.id use one language cookie (inolab_locale), so that the language you choose on one is used on the other as well. It holds only the language code, is kept for at most one year, and is only set once you choose a language. A choice of light or dark appearance is kept in the same way in the cookie inolab_theme, which holds only the word "light" or "dark" and is only set once you choose it. The app also uses cookies that are needed for sign-in sessions and form protection. We do not use advertising, analytics or third-party tracking cookies.

Before you choose a language, the site may use the language of your country (Malaysia, Vietnam or the Philippines). To do so, your IP address is compared with an address list stored on our server; the IP address is not sent to anyone else, and the result is kept only as a one-way hash for at most one day.

7. Retention and deletion

Data is kept while your account or business is active. If you ask us to delete your account or business, the data is deleted within a reasonable time, except data we must keep longer by law, such as payment transaction records. Deleted data may remain in encrypted backups until those backups are replaced; daily backups on our server are kept for about two weeks. The history of agent runs is deleted automatically after 90 days, and the history of webhook deliveries after 30 days.

8. Security

Data is sent over encrypted connections (HTTPS). Passwords are stored as hashes, two-factor secrets and sessions are stored encrypted, database backups are encrypted, each business's data is kept separate from other businesses, and access within a team is limited by role. No system is free of risk; if a personal data protection failure occurs, we will notify you and the competent authority within the time set by law, for example within 3 x 24 hours under Indonesian law.

9. Your rights

You have the right to information about how your data is processed, to access and obtain a copy of your data, to correct inaccurate data, to request deletion or restriction of processing, to object to processing for marketing, to receive your data in a portable format, and to withdraw consent you have given. You can change most data yourself in Settings, and the business owner can export all of the business's data. For other requests, email hello@inolab.id from your account's email address. We respond within the time set by the law that applies to you.

10. Children

Inolab is intended for businesses and is not directed at children. A business that enters data about children, for example as customers, is responsible for obtaining the consent of a parent or guardian where the law requires it.

11. Changes to this policy

We may update this Privacy Policy. We will announce important changes by email or in the app before they apply. The effective date is shown at the top of this page.

12. Additional terms by country

Malaysia. Where the Personal Data Protection Act 2010 (as amended in 2024) applies to the processing of your data, we process it in line with the seven personal data protection principles of that Act. This notice is available in Malay and English. You have the right to access and correct your data, to withdraw consent, to prevent processing for direct marketing, and to ask for your data to be transmitted to another controller where technically feasible. Personal data breaches are notified to the Personal Data Protection Commissioner and to the people affected as required by the Act and the Commissioner's guidelines. Your data is transferred to Indonesia and to the providers in section 4 with the safeguards described in section 5.

Vietnam. Where the Law on Personal Data Protection No. 91/2025/QH15 applies to the processing of your data, we only process data on a basis that Law allows, including your consent, which you can withdraw at any time. You have the right to be informed, to give and withdraw consent, to access, correct and delete your data, to restrict or object to processing, and to complain, sue and claim compensation. Transfers of data out of Vietnam (to Indonesia and to the providers in section 4) are made with an impact assessment dossier where the Law requires one. Personal data breaches are notified to the personal data protection authority within 72 hours of discovery, and to the people affected as required.

Philippines. Where the Data Privacy Act of 2012 (Republic Act No. 10173) applies to the processing of your data, you have the right to be informed, to object, to access, to rectify, to erase or block data, to obtain your data in a portable electronic format, to claim damages, and to file a complaint with the National Privacy Commission. Notifiable personal data breaches are reported to the National Privacy Commission and to the people affected within 72 hours of discovery. We remain accountable for data transferred to Indonesia and to the providers in section 4.

13. Contact

Questions and requests about personal data, including for our data protection officer, can be sent to hello@inolab.id.

PT. Inolab Teknologi Indonesia
Robayan RT 013 RW 003, Kalinyamatan, Jepara, Jawa Tengah 59467, Indonesia
Email: hello@inolab.id · WhatsApp: +62 857-4782-0782