This Privacy Policy explains what personal data Cahyadi Aditya collects through this website and client engagements, why it is processed, which service providers may receive it, how long it is retained, and the rights available to you.

Last updated: September 2, 2026

1. Who Controls Your Data

Cahyadi Aditya is responsible for the personal data described in this policy. Questions, requests, or concerns about your data can be sent to cahyadiaditya.office@gmail.com.

2. Data I Collect

The data collected depends on how you use the website or engage my services. It may include:

• Contact and inquiry data, including your name, email address, phone number, company or organization, budget range, and project context.
• Direct communications sent through email, WhatsApp, calls, or other agreed channels.
• Client and project data, including briefs, research, product information, brand assets, content, feedback, approvals, and commercial records.
• Website analytics, including pages viewed, page title, URL, interaction events, filter selections, CTA clicks, and related event context.
• Technical and security data, which may include IP address, browser and device information, approximate location, Turnstile verification signals, and protected-work access attempts.

Please do not submit sensitive personal data unless it is necessary for an agreed engagement and an appropriate handling method has been confirmed.

3. Why Data Is Processed

Personal data is processed only for specific purposes, including:

• Responding to inquiries and assessing whether an engagement is a suitable fit.
• Preparing proposals, entering into agreements, and delivering contracted services.
• Managing project communication, feedback, approvals, handoff, invoicing, and support.
• Protecting forms, confidential work, and website infrastructure from abuse or unauthorized access.
• Understanding website performance and improving content, navigation, and service communication.
• Complying with applicable accounting, tax, contractual, and legal obligations.

Depending on the context, processing may be based on your consent, steps requested before entering a contract, performance of a contract, compliance with legal obligations, or a legitimate interest that does not override your rights. Personal data is not sold or used for third-party advertising lists.

4. Analytics and Interaction Data

When analytics is enabled, Mixpanel is used to understand page views and important website interactions. The implementation sends page and event context, not the values entered into contact-form fields. Mixpanel may also process technical information such as IP address, browser, device, and approximate location, and may store an identifier in browser local storage. The implementation is configured to respect supported Do Not Track signals.

5. Service Providers and International Processing

Selected providers process data only where needed to operate the website or deliver an engagement. These may include:

• Cloudflare, for website infrastructure, security, and Turnstile bot protection.
• Resend, for transmitting contact-form submissions by email.
• Mixpanel, for product analytics and interaction measurement.
• Google services, including Gmail and Google Fonts, for communication and website typography.
• Figma, FigJam, Notion, Loom, or similar collaboration tools when they are used for an engagement.

Some providers may process data outside Indonesia. Where this occurs, reasonable steps are taken to use established providers and appropriate contractual or operational safeguards. External services such as WhatsApp and social platforms apply their own privacy terms when you choose to use them.

6. Cookies and Browser Storage

The website uses browser storage only for defined functions. Mixpanel may use local storage for analytics identity and persistence. Password-protected case studies use a secure, HTTP-only access cookie that expires after seven days. Cloudflare Turnstile may use necessary browser signals or storage to provide its security function.

You can clear cookies and local storage through your browser. Doing so may reset analytics identifiers or require you to enter a protected-work password again. The website does not intentionally use advertising or retargeting cookies.

7. Data Retention

• Inquiry data is generally retained for up to 12 months unless it develops into a client relationship or must be retained for a legal reason.
• Client, project, and transaction records are retained for the engagement, reasonable post-project support, and any period required by applicable contractual, accounting, tax, or legal obligations.
• Protected-work access cookies expire after seven days.
• Analytics data is retained according to the configured provider settings and may be retained in aggregated or de-identified form for longer.

8. Your Rights

Subject to applicable law and relevant exceptions, you may request to:

• Access or obtain a copy of your personal data.
• Correct inaccurate or incomplete data.
• Withdraw consent or object to certain processing.
• Restrict, stop, delete, or destroy data where the applicable requirements are met.
• Stop non-essential communications.

Requests can be sent to cahyadiaditya.office@gmail.com. Identity may need to be verified before a request is completed, and some data may be retained where required by law or an active contractual obligation.

9. Security and Data Breaches

Reasonable technical and organizational measures are used to protect personal data from unauthorized access, alteration, disclosure, or loss. No internet transmission or storage system can be guaranteed to be completely secure.

If a personal data protection failure triggers a notification obligation, affected data subjects and the relevant authority will be notified in writing within the period required by applicable law, including the 3 x 24 hour period under Indonesia's Personal Data Protection Law where applicable.

10. Children and External Links

This website is not directed to children and does not knowingly collect personal data from children. The website may link to third-party websites or platforms whose data practices are governed by their own policies.

11. Governing Law and Policy Updates

This policy is governed by the laws of the Republic of Indonesia. It may be updated when website functionality, service providers, business practices, or legal requirements change. The updated date at the top of this page shows when the latest version became effective.