Privacy Policy

1. Who is responsible

PT Vardhana Digital Innovation is the data controller for account, billing, website and support data, and for the public-source intelligence we compile.

For personal data that a customer adds to its own workspace (for example names of contacts in notes, actions or prospects), the customer decides why and how it is used; we process it on the customer's behalf to provide the Service. Requests about such data should go to the customer first; we will help them respond.

2. Data we collect

• Account data: name, work email, password (stored only as a one-way hash), company name, role in the workspace, language and notification preferences, and — only if you add it and opt in — your WhatsApp number for the daily brief.
• Workspace content: company profile (products, industries, markets, sales channels), watchlists, saved items, feedback and dismissals, follow-up actions, notes, prospect pipeline, questions asked in Ask and the answers.
• Billing data: plan, billing name and email, company and tax details you give us, invoices and payment status. Card, e-wallet and bank details are entered with our payment provider and never stored by us.
• Communications: emails you send us and messages in the website chat (including answers written by our AI assistant and by our team).
• Usage and device data: pages and features used, actions taken, IP address, browser and device type, time stamps, error logs, and whether a notification email was opened (a small image in the email).
• Security data: sign-in events, rate-limit counters and an audit log of important actions (for example plan changes, team changes, and when our staff signed in to your workspace for support).

We do not intentionally collect specific (sensitive) personal data such as health, biometric, genetic, criminal-record, children's or personal financial data. Please do not enter such data in notes or other free-text fields.

3. Information from public sources

Opverio monitors publicly available business information: company announcements and newsrooms, regulatory and stock-exchange disclosures, government procurement notices, news media, research publications, and public reference data such as Wikidata, Wikipedia and companies' own websites. We collect only content that is publicly accessible through permitted means, respect robots.txt, identify our crawler and never bypass logins, paywalls or other access controls.

This content is about organizations. Names and roles of individuals can appear where they are part of public business news (for example an executive appointment or a spokesperson quoted in a press release).

4. Why we use personal data and on what basis

• To provide the Service you signed up for — accounts, workspaces, monitoring, matching, reports, alerts and support (performance of a contract).
• To bill you and keep accounting and tax records (contract and legal obligation).
• To keep the Service secure, prevent abuse and investigate incidents (legitimate interest and legal obligation).
• To improve relevance inside your workspace from your feedback, and to improve the Service in aggregate (legitimate interest).
• To send service emails (verification, invoices, security notices) and the reports and alerts you choose; product news only with your consent, which you can withdraw at any time (contract and consent).
• To comply with law and lawful requests from authorities (legal obligation).

Where we rely on your consent, you can withdraw it at any time; this does not affect processing before the withdrawal. Withdrawing consent for something the Service needs (for example your email address for sign-in) may mean we can no longer provide that part of the Service, and we will tell you so.

5. AI processing

We use large language models (currently Anthropic's Claude, accessed directly or through Amazon Web Services) to read public-source content, classify developments, write summaries and analysis, translate between English and Indonesian, answer questions in Ask and reply in the website chat.

To judge what matters to you, your company profile and watchlist may be included in these requests. We send only what a task needs, never your password or payment data, and use providers whose commercial terms do not allow our inputs to be used to train their models. We do not use your workspace data to train any model.

AI output is labelled in the product ("AI ANALYSIS"; heuristic output "AUTOMATED ANALYSIS") and may be wrong. Opverio does not make decisions about individuals that have legal or similarly significant effects.

6. Who we share data with

We do not sell personal data. We share it only as follows:

• Your workspace: members of your account and workspaces see the shared workspace content; the account admin manages members, billing and settings.
• Service providers (processors) that run parts of the Service for us under contract: cloud hosting (Vercel), database (Supabase), email delivery (Resend), AI processing (Anthropic, Amazon Web Services), payments (our payment provider), DNS and email routing (Cloudflare), search and data services that receive watchlist search terms but not your account details (Tavily, Brave Search, GDELT, the Apple Podcasts directory), and WhatsApp messages for members who opted in (Meta, WhatsApp Business Platform).
• Opverio staff, only where needed — for example to help with onboarding or a support request, including signing in to your workspace with time-limited, audited access.
• Authorities or other parties when required by law, to protect the rights and safety of our users or the public, or to enforce our terms.
• A successor in a merger, acquisition or sale of assets, subject to this policy.

7. International transfers

Some of our providers store or process data outside Indonesia (for example in Singapore, the United States or the European Union). When we transfer personal data abroad we make sure the recipient offers a level of protection at least equivalent to the UU PDP or is bound by appropriate contractual safeguards, as required by Article 56 of the UU PDP. Where the PDPA Singapore or the PDPA Malaysia applies, we likewise transfer personal data only to recipients bound to protect it to a standard comparable to those laws.

8. Cookies and similar technologies

We use only cookies that the Service needs: the sign-in session cookie, a cookie remembering the workspace you opened, your language choice, and — when our staff help you — a cookie that returns them to their own account. The website chat stores a random conversation token in your browser's local storage. We do not use advertising cookies or third-party analytics trackers. Email open tracking can be avoided by not loading images in your email client.

9. How long we keep data

• Account and workspace content: while your account is active; deleted within 90 days after the account is closed.
• Invoices and accounting records: for as long as Indonesian tax and company-document law requires (generally 10 years).
• Security and audit logs, support emails and chat conversations: for as long as needed for security, support and to resolve disputes, then deleted or anonymised.
• Public-source intelligence about organizations: kept as part of our market database for historical comparison.

10. Security

We use encryption in transit, one-way hashed passwords, database-level isolation between customers, role-based access, least-privilege staff access, audit logging and regular backups. No system is completely secure; if a personal data breach affects you, we will notify you and the authorities within 3 × 24 hours as required by Article 46 of the UU PDP. Where the PDPA Singapore applies we notify the Personal Data Protection Commission within 3 calendar days of assessing that a breach is notifiable, and where the PDPA Malaysia applies we notify the Personal Data Protection Commissioner within 72 hours; affected individuals are informed as soon as practicable (in Malaysia within 7 days) when the breach is likely to cause them significant harm. Our security measures are described on the Security page.

11. Your rights

Under the UU PDP (and, where applicable, the PDPA of Singapore or Malaysia) you have the right to:

• be informed about how your personal data is processed;
• access and obtain a copy of your personal data, and receive it in a commonly used format;
• correct inaccurate or incomplete data;
• have your data deleted or destroyed, and withdraw consent you gave;
• object to decisions based solely on automated processing, and ask us to delay or restrict processing;
• lodge a complaint with the competent authority.

Most account data can be changed in Settings. For other requests write to privacy@opverio.ai. We may ask you to confirm your identity and will respond within the time the applicable law requires — for example 3 × 24 hours where the UU PDP sets that limit (such as access and correction), 21 days under the PDPA Malaysia and, under the PDPA Singapore, as soon as reasonably possible and within 30 days or we will tell you when to expect a reply. Requests are free of charge unless the law allows a reasonable fee for copies, which we will tell you beforehand.

Supervisory authorities: in Indonesia the personal data protection authority under the UU PDP (until it is established, the Ministry of Communication and Digital Affairs); in Singapore the Personal Data Protection Commission; in Malaysia the Personal Data Protection Commissioner.

12. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data of children.

13. Changes to this policy

We may update this policy as the Service changes. The date at the top shows the latest version; for material changes we will notify account admins by email or in the app before they take effect.

14. Contact

PT Vardhana Digital Innovation, Jl. Pengadegan Timur I No. 30, Jakarta Selatan, Indonesia. Contact / WhatsApp: (+62) 877-6900-9733. Privacy questions and requests, and our data protection officer: privacy@opverio.ai. General questions: hello@opverio.ai.