Privacy Notice

The law we work to

We are an Indonesian company and this notice is written to Indonesian law: UU No. 27/2022 on Personal Data Protection (PDP), and PP No. 71/2019 on electronic systems and transactions. The supervising ministry is Komdigi (Kementerian Komunikasi dan Digital).

We are registered as an electronic system operator (PSE) with Komdigi. We do not publish the registration number on this site; it is available to a regulator or to law enforcement on request.

We are not offering GDPR or CCPA rights here, because we are not set up to honour them properly, and listing a right we cannot deliver would be worse than not listing it.

Nothing runs before you choose

Analytics are off until you press Accept. If you press Reject, or ignore the banner, no analytics script loads and no analytics data is recorded. You can change your mind at any time from Cookies Preferences.

Two separate streams

It matters which is which, so they are described separately rather than blended.

• Page and click counts. Recorded on our server so a creator can see how their page performs: a view or a click, the page it belongs to, the referring site, and coarse device type — mobile, tablet or desktop. No cookie, no session id, nothing that follows you between pages. This runs whether or not you accept, because there is nothing in it that identifies you.
• Behaviour analytics. Only after you accept. Pages opened and their order, links and buttons pressed by their visible label, which form fields you filled — the field's name only, never what you typed — whether a form was submitted, and a random session id that groups one visit and does not persist or link to any account.

What we never record

We do not read the contents of any field. Password fields are excluded entirely. Anything that looks like data you typed — email addresses, passwords, tokens, search terms — is stripped in your browser before it is sent, and query strings are removed from recorded links.

Affiliate links, and what the marketplace learns

When you click a link to a marketplace we work with, we route the click through our affiliate account before sending you on. That means the marketplace receives a referral code identifying the creator's page the click came from — derived from their username, so it is not anonymous with respect to the creator, though it says nothing about you.

From the moment you arrive at the marketplace, their privacy terms apply, not ours. The full mechanism is in section 4 of the Terms.

Who else handles your data

• Supabase — database and sign-in. Hosted in the United States.
• Our hosting provider — serves the site from Indonesia
• Marketplace affiliate networks — receive the referral code on a hop
• Google Analytics — only if a deployment is configured for it, and only after you accept

Personal data we hold, and where it is held

We keep the amount of personal data small on purpose, but we do hold some, so here it is plainly:

Because the database is hosted in the United States, this is a transfer of personal data outside Indonesia within the meaning of Article 56 of the PDP Law. We rely on the hosting provider's own contractual data-protection commitments as the basis for that transfer, and by using linkgrowth you are told of it here rather than in a clause you never see.

• Creator email address — needed to sign you in, held for as long as the account exists.
• Form submissions — whatever a creator's form asks for. That routinely includes a visitor's email address, and can include a name, phone number or free-text message.
• A hashed IP address on each form submission, used only to stop the same form being submitted repeatedly. It is a hash, not a stored IP — but a hash of an IP can be reversed by brute force, so we treat it as personal data rather than claiming it is anonymous.
• Analytics events — only if you accepted them, and with the values you typed stripped in the browser first.

We hold no identity documents, no payment details, no message content beyond what a visitor typed into a creator's own form, and no precise location.

Roles

We are responsible for account data and analytics. For anything a creator collects through a form on their page, the creator decides and is responsible; we hold it for them. See section 6 of the Terms.

How long we keep it

Per stream, written as what we actually do rather than a schedule we do not run:

• Your account and your page content — kept while the account is open, and deleted within 30 days of you deleting it.
• Form submissions — kept for the creator who collected them, and deleted with that creator's account on the same 30-day basis.
• The hashed IP on a form submission — kept for as long as the submission it belongs to, and deleted with it.
• Analytics events — kept indefinitely. No deletion job runs against them today, so this notice says so plainly rather than imply a schedule we do not operate. They carry no IP address and no identifier that follows you between sessions.

Aggregate counts that identify nobody are kept without limit, including after an account is deleted.

Your rights, and how to use them

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or withdraw consent. Write to contact-us@linkgrowth.id. This is a manual process handled by a person, not an automated portal, and we aim to reply within 30 days.

One honest limitation

Analytics events are reported by the visitor's own browser to a public endpoint. Anyone determined to inflate a number can. Treat the figures as indicative of trends, not as audited measurements.