Privacy Policy

1. The data controller

The controller of personal data for your account and for this website is PT. Degresh Teknologi Dinamis. You can contact us about personal data at hello@degresh.com.

For the contents of a space used by a business — for example the names of staff, clients or suppliers recorded in its journals — that business is the controller, and we process the data on its behalf under the Data processing agreement. If a business like that records your data, contact the business first; we will help it answer your request.

2. What we process, why, and for how long

We collect only the data needed to run the service. The legal bases follow Article 20 of the PDP Law.

Account

Data:

display name, email address, preferred language, email verification status, password (stored as a one-way hash nobody can read), two-factor settings (the secret is encrypted) and recovery codes

Purpose:

creating your account, verifying your email, signing in securely, and sending service emails such as verification links, password resets and password-change notices

Basis:

performance of our agreement with you (the Terms of Service)

Kept for:

as long as the account is active; deleted within 30 days after the account is closed, except records kept by law (see below)

Bookkeeping data

Data:

spaces, accounts and wallets, journals and transactions, budgets, plans and forecasts, tags, recurring transactions, bank statement lines you import, reconciliations, fixed assets and the reports you generate. This can contain personal data if you record it, such as a person's name in a transaction description

Purpose:

storing, calculating and showing your books, and producing the exports you ask for

Basis:

performance of our agreement with you

Kept for:

until you delete the space or close your account; deleted from live systems within 30 days after that, except records kept by law (see below)

Files

Data:

attachments such as receipts and invoices, and report files in the space's report archive

Purpose:

keeping supporting documents and reports with your books

Basis:

performance of our agreement with you

Kept for:

an attachment deleted in the app is hidden, but the file is kept as part of the space's audit trail until the space is deleted

Members and invitations

Data:

the email address of people invited to a space (including those without an account yet), their role and access scope, the space name and the inviter's name

Purpose:

sending invitations and controlling who may see or change what

Basis:

performance of our agreement with the space owner, and our legitimate interest in managing access

Kept for:

invitations until accepted, cancelled or expired; memberships for as long as the space exists

Security and activity records

Data:

sign-in sessions (IP address, device type, app version, time), failed sign-in attempts, devices remembered for two-factor sign-in, and the activity log: who changed what, when, the values before and after, the IP address and the browser description (user agent)

Purpose:

protecting accounts from misuse, showing active sessions you can end, and giving each space a trustworthy audit trail

Basis:

our legitimate interest in keeping the service secure, and legal obligation

Kept for:

a session ends at most 7 days after sign-in, and its record is kept while the account exists; the activity log cannot be changed or deleted through the app, and is kept for as long as the law requires (see below)

Server logs

Data:

IP address, time, the address requested and error messages. We also record technical metrics such as request counts and response times, with no personal data

Purpose:

running, monitoring and securing the service

Basis:

legitimate interest

Kept for:

at most 30 days

This website, and when you contact us

Data:

this site has no forms. If you email us or send a WhatsApp message to request early access, we receive your name, email address or phone number, and your message

Purpose:

replying to you and arranging early access

Basis:

your consent, and your request before entering into an agreement

Kept for:

at most 12 months after the last contact, or sooner if you ask

Records kept by law

Bookkeeping records and the security and audit log are kept for as long as Indonesian law requires (for bookkeeping, 10 years under the tax rules), used only for security, legal duties and resolving disputes, and then deleted. This also applies after a space is deleted or an account is closed. While kept, these records are not used for anything else and stay protected like the rest of your data.

3. Where data is stored

The app, database and files run on infrastructure from server and data centre providers bound by contract to protect the data. If data is processed outside Indonesia, we apply the protections the PDP Law requires. Files are kept in private object storage that can only be reached through the app; browsers never connect to that storage directly. Every connection uses HTTPS.

Service emails are sent through Mailspace, the email service of DomaiNesia (PT Delta Neva Angkasa), a provider located in Indonesia. The full list is on the Service providers page.

4. What we don't do

• We don't sell personal data or bookkeeping data.
• We don't use your bookkeeping data or files to build features, train any model, or share them with anyone.
• We don't show ads, use advertising or analytics cookies, or profile you.
• We don't make automated decisions with legal effect on you.
• The app has no staff access to customers' spaces: our staff can't open your books.

5. Who may receive data

• Your space members, within the role and access scope the space's owner or Admins give them.
• Service providers who help us run the service, only for their task and bound by confidentiality. See Service providers.
• Courts or authorised government agencies, when lawfully required, and only as far as required.

6. Your rights

As a data subject, you have the right (Articles 5 to 13 of the PDP Law) to:

• be told who we are, why we process your data and on what legal basis;
• access your personal data and get a copy of it;
• correct data that is inaccurate or incomplete;
• ask us to delete your personal data or stop processing it;
• withdraw consent you have given;
• object to processing based on legitimate interest, and to decisions based solely on automated processing;
• ask us to postpone or restrict processing;
• receive your data in a common, machine-readable format, and move it elsewhere;
• complain and claim compensation for a breach in the processing of your personal data.

You can do much of this yourself: change your name and language in Settings, end sessions, and export your data at any time. For the rest, email hello@degresh.com from your registered address. We check your identity and respond within 3×24 hours, as the PDP Law requires.

Some rights may be limited where the law requires the data to be kept, such as the audit trail of a business space. When that happens, we explain why.

7. Security

We use HTTPS for every connection, store passwords as hashes, encrypt two-factor secrets, limit sign-in attempts, restrict access through roles in every space, record changes in an activity log that cannot be altered, keep files in private storage, and back up data regularly. No system is perfectly secure, but we keep improving these protections.

8. If a data breach happens

If a personal data protection failure happens, we notify you and the competent authority in writing within 3×24 hours of becoming aware of it, as Article 46 of the PDP Law requires. The notice says which data is affected, when and how it happened, and the steps we are taking to handle and recover from it.

9. Children

The service is not meant for people under 18. If we learn that an account belongs to a child without a parent's or guardian's consent, we close it and delete its data.

10. Cookies and local storage

This website sets no cookies. The app uses only the cookies needed to sign in and to remember your choices. The details are in the Cookie notice.

11. Changes to this policy

Every change is published on this page with a new version number and effective date, and earlier versions stay available to read. Important changes are announced by email and in the app before they take effect, and the app asks you to accept them again.

12. Contact and complaints

Questions, requests and complaints about personal data: hello@degresh.com. If you're not satisfied with our answer, you can complain to the personal data protection authority appointed by the government.