This Privacy Policy applies to all users of the Gumugu platform, including Gumugu Edu, Gumugu Pesantren, Gumugu Flow, and Gumugu Academy ("Services"). By using our Services, you agree to the practices described in this policy.
Data We Collect
1.1 Account Data
When you create an account or register for our Services, we collect:
- Full name and display name
- Email address and phone/WhatsApp number
- Institution name and information (school, pesantren, or organization)
- Job title and role within the organization
- Password (stored as hash, never in plaintext)
1.2 Usage Data
We automatically collect data about how you use our Services:
- Pages and features visited, time and duration
- Actions taken within the platform (clicks, inputs, uploads)
- Error logs and crash reports for system improvement
- Most frequently used features (for product development)
1.3 Device Data
We collect technical information about the device you use:
- Device type, operating system, and browser version
- IP address (used for security and anomaly detection)
- Unique device identifiers (for mobile apps)
1.4 Data You Enter into the Platform
Student, santri, employee, document, and other content data you enter into the platform belongs entirely to you. Gumugu acts as a data processor, not a data controller, for this information.
How We Use Your Data
We use collected information for the following purposes:
Run, maintain, and improve the Gumugu platform in line with your expectations.
Respond to inquiries, resolve issues, and provide technical assistance.
Send important notifications about your account, security updates, or service changes.
Understand usage patterns to develop new features and improve user experience.
Detect, investigate, and prevent unauthorized or harmful activity.
Process payments, manage subscriptions, and send invoices.
We do not use your data for third-party advertising. We never sell your data to anyone.
Data Storage & Security
Data is stored on servers located in Indonesia, in compliance with applicable law (Personal Data Protection Law and Government Regulation 71/2019).
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Passwords are hashed using bcrypt.
Data is automatically backed up daily. Backups are retained for a minimum of 30 days at a geographically separate location.
Internal Gumugu team access to customer data is strictly limited and only for legitimate technical support purposes.
We regularly conduct security testing and audits to identify and address potential vulnerabilities.
In the event of a data breach affecting you, we will notify you within 72 hours as required by applicable law.
Data Sharing
Gumugu does not sell, rent, or trade your data. We only share data under the following limited conditions:
We work with selected service providers (cloud infrastructure, payment gateways, email delivery) who are bound by strict data processing agreements.
We may disclose data if required by law, court order, or to protect the rights, property, or safety of Gumugu or our users.
In other situations not listed above, we will seek your explicit consent before sharing any data.
Data Retention
You can request earlier data deletion at any time by contacting us at privacy@gumugu.com. Requests will be processed within 30 days.
Your Rights
In accordance with Indonesia's Personal Data Protection Law (UU PDP) and international best practices, you have the following rights:
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data under certain conditions.
Receive your data in a structured, machine-readable format.
Object to processing of your data for certain purposes.
Request restriction of processing your data under certain circumstances.
To exercise your rights, send a request to privacy@gumugu.com. We will respond within 30 days. Some requests may require identity verification.
Children's Privacy
Gumugu is a B2B platform designed for institutions (schools, pesantren, organizations), not for direct use by children. Data of underage students or santri is managed by the institution, not by the child individually.
For student and santri data entered by institutions into the Gumugu platform:
- The institution is responsible for obtaining required parental/guardian consent
- Gumugu processes that data under the institution's instructions as data controller
- Student data is never used for advertising or commercial purposes
- Access to student data is restricted to parties authorized by the institution
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the 'Last updated' date at the top of this page
- Send email notifications to all registered users
- Display a notification banner on the platform at least 30 days before changes take effect
Continued use of the Services after changes take effect constitutes your acceptance of the updated policy.
Contact
For questions about this Privacy Policy or to exercise your privacy rights, contact us:
