For AI agents: use /llms.txt for the Nakafa content index.
Last updated: August 29, 2026
This Privacy Policy explains how PT NAKAFA TEKNO KREATIF ("Nakafa," "we," "us," or "our") collects, uses, and discloses Personal Data when you access or use our websites, applications, and related services (collectively, the "Services").
Your use of the Services is at all times subject to our Terms of Service, which incorporates this Privacy Policy.
This Privacy Policy covers how we treat Personal Data that we gather when you access or use the Services.
This Privacy Policy does not cover the practices of companies we do not own or control, or people we do not manage, including third-party services you may access through the Services. For information about third-party services' data practices, please refer to their respective privacy policies linked throughout this document.
Third parties receive Personal Data in different legal roles. Vercel, Convex, PostHog, Resend, Google, and Google Cloud generally provide defined technical services to Nakafa under their applicable service and data-processing terms. The precise role of each party depends on the processing activity and applicable law.
Polar acts as the Merchant of Record and authorized reseller for checkout transactions. Polar collects and processes checkout data under its own terms and privacy policy, while Nakafa receives the customer, checkout, and subscription information needed to provide and manage access to the purchased Service.
We limit disclosures to the data needed for the stated purpose. Where applicable law requires a data-processing agreement or an international-transfer safeguard, the required terms must be in place before the relevant processing occurs. The provider links below identify the terms that govern their processing and may be updated by those providers.
The table below summarizes categories of Personal Data we collect, why we collect it, and the categories of third parties with whom we disclose it. Details are explained in the sections that follow.
| Category of Personal Data (examples) | Purpose(s) for collection | Recipients and service roles |
|---|---|---|
| Profile or contact data (name, email, optional profile image, optional role) | Account creation, support, and service delivery | Convex (database/hosting) - Privacy Policy, DPA; Vercel (hosting) - Privacy Policy; Resend receives only the name and email needed for the welcome email - Privacy Policy |
| Account identifiers (authentication identifiers linked to your account) | Authentication and account security | Convex (database/hosting); Vercel (hosting) |
| Device and usage data (IP address, browser/OS, security logs, and consented usage events) | Security and service reliability; product improvement only after consent | Vercel (hosting/security logs); PostHog (consent-based product analytics) - Privacy Compliance |
| Operational error data (sanitized stack frames, bounded technical context, and a random identifier for that one report, without an account or product-analytics identifier) | Diagnosing failures and maintaining service reliability and security | PostHog (identity-free operational error reporting) |
| Education and activity data (class memberships, bookmarks, assessment attempts and responses, notification records and preferences) | Operating learning features and personalization | Convex (database/hosting); Vercel (hosting) |
| User Content (chat messages, comments, prompts, related conversation context, and generated responses) | Providing interactive features and AI responses | Convex (database/hosting); Vercel AI Gateway (AI routing) - Privacy Notice, AI Product Terms; Google (Gemini API model processing) - Gemini API Additional Terms, Privacy Policy; Google Cloud (Vertex AI model processing) - Cloud Terms, Cloud Data Processing Addendum |
| Payment and subscription data (customer, checkout, and subscription identifiers and related metadata) | Checkout, subscription management, and compliance | Polar (Merchant of Record and authorized reseller) - Privacy Policy, Checkout Buyer Terms; Convex (subscription records); Vercel (hosting) |
We checked these data-flow statements against Nakafa commit 070d125d16bb9f2a94125e23ed7f6a256df8a8a6. The implementation stores and synchronizes account profile data through Convex in packages/backend/convex/auth/client.ts, exposes the authentication boundary in apps/www/app/api/auth/[...all]/route.ts, enables the web app's Vercel production deployment in apps/www/vercel.ts, and sends only the recipient name and email address to Resend for the welcome message in packages/backend/convex/emails/mutations.ts.
The same revision defines the current notice version and separate anonymous and account decisions in packages/analytics/consent.ts, loads the browser SDK only after an effective grant in packages/analytics/posthog/browser.ts, and checks the current account grant both before queuing and around backend delivery in packages/backend/convex/analytics/capture.ts. Identity-free operational exceptions pass through a bounded property contract in packages/analytics/posthog/exception.ts. Account deletion removes consent records and starts erasure of the PostHog person and related events through packages/backend/convex/auth/cleanup/consents.ts and packages/backend/convex/analytics/erasure/action.ts.
AI requests follow the same pinned revision. packages/ai/config/model.ts maps nakafa-lite to google/gemini-3.5-flash-lite and nakafa-pro to google/gemini-3.7-flash. packages/ai/config/app.ts sends those identifiers through the validated Vercel AI Gateway provider in packages/ai/config/provider.ts. The routing contract in packages/ai/config/routing.ts permits only Google or Google Cloud Vertex AI routes and requires Vercel's no-prompt-training policy. If no eligible route satisfies those restrictions, the request fails. No other provider receives it. The research flow may enable Google Search grounding after inspectable web search, as shown in packages/ai/agents/research/step.ts and packages/ai/agents/research/agent.ts. User messages and their parts are written to Convex through apps/www/app/api/chat/persistence.ts, while generated responses and their parts are scheduled for Convex persistence through apps/www/app/api/chat/store.ts.
Checkout and subscription handling also follow the pinned revision. packages/backend/convex/customers/actions/public.ts requires an authenticated account and creates a Polar checkout session, packages/backend/convex/routes/polar.ts verifies Polar webhook signatures before processing events, and packages/backend/convex/customers/polar/webhook.ts accepts supported customer and subscription events through guarded internal Convex mutations. The exact subscription fields stored in Convex are defined in packages/backend/convex/subscriptions/schema.ts.
The listed learning and account-activity records are stored in domain-owned Convex schemas at the same revision. Class and membership records are defined in packages/backend/convex/classes/schema.ts, bookmark and collection fields in packages/backend/convex/bookmarks/schema.ts, assessment attempts and responses in packages/backend/convex/assessments/schema.ts, and notification records and preferences in packages/backend/convex/notifications/schema.ts.
The bounded account-deletion coordinator runs each domain-owned cleanup program in packages/backend/convex/auth/cleanup/impl.ts. Those programs remove class memberships through schools.ts, bookmarks and collections through social.ts, assessment attempts and responses through assessments.ts, and notification records and preferences through notifications.ts.
Polar is Nakafa's Merchant of Record and authorized reseller. When you complete checkout, you purchase the applicable product from Polar and enter a payment agreement with Polar under the Polar Checkout Buyer Terms. Polar, or its payment processor, collects and processes the payment details needed for the transaction under the Polar Privacy Policy.
Nakafa does not collect your full payment-card number. We receive the customer, checkout, subscription, product, status, and related metadata needed to grant access, manage your subscription, provide support, and meet legal obligations.
We collect and use Personal Data to operate, maintain, and improve the Services. This includes providing account and learning features, supporting subscriptions, sending the welcome email, maintaining security and reliability, preventing abuse and scraping, and complying with legal obligations. We use optional product analytics only after you consent.
If you are in the EU/EEA, we process Personal Data under one or more of the following legal bases:
We disclose Personal Data in the following circumstances:
Nakafa routes AI requests through Vercel AI Gateway to Gemini 3.5 Flash Lite or Gemini 3.7 Flash. The Gateway may select Google or Google Cloud Vertex AI, but the application does not permit another model provider. Each request requires a route that Vercel identifies as disallowing prompt training. If no eligible route is available, the request fails. When you use an AI feature, the prompt, related conversation context, and technical metadata needed to process the request are sent to the selected providers. The generated response is returned to Nakafa and may be stored with the conversation so that the feature works and the conversation remains available to you.
Research features may use Google Search grounding to corroborate public information. That processing can include queries derived from your prompt and contextual information needed to retrieve grounded results. The no-prompt-training restriction is not a promise of zero retention. Provider-controlled security, abuse-prevention, and grounding logs remain subject to the applicable provider terms. Google currently documents that, for Vertex AI Grounding with Google Search, query and contextual logs that are not associated with a customer or end user may be stored for up to three days for debugging.
Do not include government identifiers, financial-account numbers, highly sensitive health information, or other sensitive Personal Data in an AI prompt. AI output can be inaccurate and must not be treated as professional advice or as the sole basis for an important decision.
The relevant provider terms include the Vercel AI Product Terms, Vercel Notices and License Information, Gemini API Additional Terms, Google Cloud Terms, Google Cloud Service Specific Terms, and Google Cloud Data Processing Addendum.
We separate storage that is necessary to operate the Services from optional product analytics.
Vercel may still process request and security logs as our hosting provider, and Nakafa may report service exceptions without an advertising or product-analytics identifier. We process those limited records only to operate and secure the Services. We do not use them to build a product-usage profile.
For information about PostHog's processing, review its Privacy Compliance documentation.
We retain Personal Data for as long as necessary to provide the Services and for legitimate business purposes, including compliance, dispute resolution, and enforcement of agreements.
Retention depends on the type and purpose of the data:
If you request deletion, we will delete or de-identify Personal Data unless we are required or permitted to retain it for legal or legitimate business reasons.
We use reasonable administrative, technical, and organizational measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration, and destruction.
No security program can eliminate all risk. You are responsible for keeping your account credentials confidential and for using a secure password and device practices.
We are based in Indonesia and may process and store Personal Data in Indonesia and other countries where our Service Providers operate. A transfer for which applicable law requires a transfer mechanism must not begin until Nakafa has verified and put that mechanism in place. This Policy does not identify an adequacy decision or contractual safeguard for a provider flow unless that exact arrangement has been verified. Contact nakafaai@gmail.com for current information before relying on a particular mechanism.
The Services are not intended for children under 13 years of age. If you are under 13, do not use the Services or submit Personal Data.
If you are under 18, you may use the non-AI parts of the Services only with the involvement and permission of a parent or legal guardian who agrees to this Privacy Policy and our Terms of Service.
AI features are available only if you are at least 18 years old and meet any higher minimum age required by the law where you live.
If we learn that we collected Personal Data from a child under 13, we will take steps to delete that information.
Your rights depend on where you live.
If you are in Indonesia, you may have rights under Indonesia’s Personal Data Protection Law, including rights to access, correct, and delete your Personal Data, and other rights provided by applicable law.
If you are in the EU/EEA, you may have the following rights:
If you are a resident of a US state with a comprehensive privacy law (for example California and certain other states), you may have rights such as:
This Policy commits Nakafa not to sell Personal Data or use it for cross-context behavioral or targeted advertising. Before changing that commitment, we will update this Policy and provide any notice or opt-out required by applicable law.
To exercise your privacy rights, contact us at nakafaai@gmail.com. You can also change or withdraw product-analytics consent through the privacy controls in the Services.
To protect users, we will verify your identity before processing certain requests. Verification may require access to the email address associated with your account or other information needed to confirm your identity.
If you are making a GDPR-related request, include “GDPR Request” in the subject line.
PT NAKAFA TEKNO KREATIF, Taman Sukahati Permai Blok H-6, Sukahati, Cibinong, Kabupaten Bogor, Jawa Barat 16913, Indonesia
Email: nakafaai@gmail.com
