Privacy policy and transparent talent data governance.

1. Personal Data We Collect

We collect information you consciously provide as well as telemetry generated empirically during your platform assessments:

• Identity Credentials: Full name, verified email, telephone/WhatsApp contact, professional repository links (GitHub, LinkedIn, personal domains), and organizational business verification files for hiring partners.
• AI Assessment Telemetry: Case study responses, transcripts with the AI diagnostic evaluator, code submissions, response timestamps (90-second proctoring windows), screen focus tracking (3-strike anomaly tracking), and 7-dimensional competency distributions (0–9,999 XP scale).
• Billing & Transaction Logs: Event tickets, bootcamp enrollments, and subscription records. Credit cards, Virtual Accounts, and QRIS payments are processed directly by Bank Indonesia licensed payment gateways (Midtrans Snap). Foldera never stores raw credit card details or bank account credentials.
• Technical Metadata: IP addresses, browser User-Agent strings, operating systems, and session tokens to monitor multi-login anomalies and uphold assessment integrity.

2. Legal Basis & Processing Objectives

Pursuant to the Indonesian Personal Data Protection Act (UU PDP No. 27/2022), Foldera operates as a Data Controller under the following lawful bases:

3. Public Visibility & Contact Masking

We adhere to Privacy by Design. Information displayed on public talent directories (`/talents` and `/en/talents`) is automatically masked to guard candidates against spam and unsolicited telemarketing:

• Personal email addresses, direct phone/WhatsApp numbers, and residential addresses are masked from public view.
• Public visitors can only view: Candidate display name, engineering specialization, general location, 7-dimensional XP radar, Journey Stage, and Verified badges.
• Direct contact channels are accessible strictly by verified corporate hiring partners who initiate an official interview invitation through our authenticated ATS workspace.

4. Third-Party Data Disclosures

Foldera never sells, rents, or monetizes personal data with third-party advertising exchanges. We share data solely with trusted infrastructure service providers under strict data processing agreements:

• Hiring Partners (Employers): Assessment scorecards, authorized transcripts, and career portfolios are disclosed only when a candidate applies to an opening or accepts a direct invitation.
• Cloud & Database Infrastructure: Supabase (encrypted PostgreSQL with Row Level Security) and enterprise cloud partners for encrypted storage.
• Payment Gateways (Midtrans): Financial metadata necessary for transaction settlement, official invoice rendering, and statutory corporate e-Faktur Pajak filing.
• Legal Authorities: Law enforcement agencies when required by a valid court subpoena under Indonesian jurisdiction.

5. Security Safeguards, Encryption & Retention

We enforce stringent technological and operational security safeguards:

• Data in transit is encrypted using TLS 1.3; data at rest is protected with AES-256 database-level encryption.
• Row Level Security (RLS) policies governed by JWT authentication tokens enforce strict tenant data isolation.
• Assessment records remain retained while an account is active to facilitate historic benchmarking and public certificate validation. You may request account deletion at any time.

6. Data Subject Rights Under PDP Law

Under Indonesian PDP legislation, you maintain comprehensive rights over your personal data:

7. Data Protection Officer (DPO) Contact

To exercise your privacy rights or file an inquiry regarding personal data handling, reach out to our designated compliance officers: