Privacy Policy

PT AFISENA LEARNING TECHNOLOGY (“Afisena”, “we”, “us”) operates a multi-tenant learning management system (LMS) that lets schools run their own online learning environment on a subdomain or custom domain. This policy explains what personal data we process, why, who we share it with, and the rights you have over it.

This policy is written in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”) and its implementing regulations. By using our services you acknowledge that you have read and understood it.

Our role differs by data category: for school-owner accounts and billing data we act as the data controller. For data a school manages inside its LMS (teachers, students, grades, and content), the school is the controller and we act as a processor on the school's instructions.

Depending on how you interact with the platform, we collect:

• School-owner account data — your name, email address, and profile picture from your Google account when you sign up with Google Sign-In.
• School-user account data — name, email, username, role (admin, teacher, student), grade level, and a one-way hash of your password (never the plain text).
• Learning data — courses, materials, test and assignment answers, learning progress, and interaction signals used by the adaptive-learning features.
• Billing data — subscription plan, invoice history, and payment status. We never receive or store card numbers, CVVs, or payment credentials; all of that is handled by DOKU, a licensed payment processor.
• AI usage data — prompts and outputs of AI features (content generation, learning assistant, adaptive quizzes) together with credit-usage metrics.
• Technical data — IP address, browser type, pages visited, and aggregate analytics via Google Analytics.
• Correspondence — emails or messages you send to our support.

• Providing and operating the LMS, including authentication and account management.
• Processing subscriptions, invoices, and payments through DOKU.
• Running adaptive-learning features and the AI assistant.
• Sending transactional email (account invitations, password resets, billing and activity notifications).
• Monitoring security, preventing abuse, and complying with legal obligations.
• Analyzing usage in aggregate to improve the service.

We do not sell your personal data, and we never use student data for advertising.

Under Article 20 of the PDP Law we process personal data on the bases of: (a) performance of a contract — providing the service you signed up for; (b) consent — for example when you register with your Google account; (c) legitimate interest — platform security and fraud prevention; and (d) legal obligation — including retention of financial transaction records.

We share data only with processors needed to run the service, and only to the extent necessary:

• DOKU (PT Nusa Satu Inti Artha) — a Bank Indonesia–licensed, PCI-DSS-certified payment processor. DOKU receives the data required to process payments (name, email, amount, payment method). DOKU's privacy policy is available at doku.com.
• Google — Google Sign-In for school-owner authentication and Google Analytics for aggregate usage analytics.
• TikTok — an advertising measurement pixel, ONLY on our marketing site (afisena.com) and only after you agree to it. It is never loaded on a school subdomain, so teacher and student activity is never sent to TikTok.
• AI model providers — AI feature requests are forwarded to language-model providers through an API intermediary. We do not include student identity data in those requests beyond what the feature requires.
• A transactional email provider — for invitations, password resets, and notifications.
• Cloud infrastructure providers — hosting, database, and file storage.

We may also disclose data where required by law, court order, or a lawful request from a competent authority.

Student accounts are created and managed by schools, not by us. Schools are responsible for obtaining any consent required from parents or guardians under the PDP Law before enrolling minors. We process student data solely on the school's instructions for learning purposes, and never for marketing or commercial profiling.

We use strictly necessary cookies for login sessions and language preferences, plus Google Analytics cookies to understand usage in aggregate. You can disable cookies in your browser settings; disabling session cookies will prevent you from signing in.

On our marketing site (afisena.com) we also use third-party ADVERTISING cookies from TikTok. Their purpose differs from the aggregate analytics above: they measure the effectiveness of our advertising campaigns, and the data is used to target ads. They require your consent — they are set only after you press Accept on the consent bar, and you can withdraw that consent at any time. If you decline, nothing is set and no events are sent.

Advertising cookies are NEVER set in the school area — the subdomains where teachers and students work. Their activity is never sent to any advertising platform.

• All traffic is encrypted with TLS (HTTPS).
• Each school's data is isolated with database-level row-level security, so no school can read another school's data.
• Passwords and access tokens are stored as one-way hashes.
• Payment data is handled entirely by DOKU, which is PCI-DSS Level 1 certified.
• Internal access to production data is restricted and logged.

Data is kept for as long as your account or school is active. After termination, school data is deleted or anonymized within a reasonable period, except where the law requires longer retention (for example, financial transaction records). School owners may request deletion of their school's data via the contact below.

Under the PDP Law you have the right to:

• Access and obtain a copy of your personal data.
• Correct inaccurate or incomplete data.
• Delete your personal data, subject to legal exceptions.
• Withdraw consent for processing based on consent.
• Object to certain processing.
• Lodge a complaint with the personal data protection authority.

For students and teachers: because your school is the data controller, please direct requests to your school admin first. We will assist the school in fulfilling them.

Some of our processors (for example AI model and analytics providers) may process data outside Indonesia. Where that happens, we ensure the destination country or processor provides an equivalent level of protection as required by Article 56 of the PDP Law.

We may update this policy from time to time. Material changes will be announced by email or in-platform notice before they take effect. The “last updated” date at the top of this page always reflects the current version.

Questions, data-subject requests, or privacy complaints can be sent to support@afisena.com. We aim to respond within 1×24 hours on business days.