Obscura Privacy Policy

1. Who We Are

1.1. PT Virtue Digital Indonesia (trading as Valid, val.id; "we") provides Obscura, a document-management platform. This policy explains what personal data we process, why, and what rights you have, in line with Law 27/2022 on Personal Data Protection (the "PDP Law") and its implementing regulations (including Government Regulation 33/2026).

1.2. When we are Controller and when Processor.

• On Obscura Cloud, the Customer is the Personal Data Controller for the content of documents and for the data of the Users inside its organisation, including their account data. We are the Processor and process that data on the Customer's behalf and on its instructions (see the DPA).
• We are the Controller only for our own customer-relationship data (sign-up and billing contacts, invoices, prospects), for data about visitors to our website, and for the security logs we need to protect the Cloud service.
• On Private and Enterprise installations, the customer is the Controller of everything on its server (see Section 7).

2. The Three Audiences This Policy Covers

This policy covers three audiences separately:

• Part A (Section 3): visitors to obscr.id (including getobscura.id, which redirects there) and people who sign up or contact us.
• Part B (Sections 4 and 5): Users in a Customer organisation on Obscura Cloud, external signers, and users of the Obscura mobile app.
• Part C (Section 6): third parties whose data appears in a Customer's documents.

Section 7 onwards applies to all of them.

3. Part A: Website Visitors and Sign-ups

3.1. The website

• obscr.id sets no cookies. It stores only your language choice in the browser's localStorage.
• The site loads no analytics tools, advertising pixels or third-party trackers, and makes no requests to third-party font providers (fonts are self-hosted).
• The contact form is a mailto: link with no server behind it. The email you send arrives at contact@obscr.id through your own email program.
• The site's server may keep standard access logs (IP address, time, page) for security and maintenance. Retention: up to 30 days.

3.2. Sign-up and demo requests

When you sign up or contact us, we process: organisation name, contact name, email, telephone, requested subdomain, language, and the consent record (IP address, user agent, time and the version of the Terms and this Policy).

3.3. Purposes, basis and retention

4. Part B: Users in a Customer Organisation

This Part applies to employees and others given an account by a Customer on Obscura Cloud, and to the external signers described in Section 4.3. Your organisation (the Customer) is the Controller of this data, including your account data, and we process it on its behalf as Processor. We are the Controller only for the items marked as ours below and for the security logs we need to protect the Cloud service (Section 1.2). For the content of documents, see Section 6.

4.1. Data we process

• Account: email, display name, optional telephone, avatar; password (argon2id hash only); MFA (encrypted TOTP secret; passkeys); SSO identities; sessions (the session does not store IP address or user agent); devices and push tokens; account lockout counters; password-reset tokens (hash only, valid 30 minutes).
• Audit log (append-only and hash-chained): every audited action with IP address, user agent and request ID, including denied attempts; external-signer events with IP address and user agent.
• Sharing and document protection: share-link access logs, download and copy issuance records (IP, user agent), external approvals, transfer and fill requests.
• Forensic watermarking: issued copies carry an invisible mark and a copy code identifying the recipient and time, to trace leaks.
• Electronic signatures: specimen and saved signatures; the verified phone number and enrolment status for a certified certificate (Section 4.2); external signers' data (Section 4.3).
• Organisation KYB (we are the Controller): legal name, NIB, NPWP, address, signatory name. The signatory's NIK is not stored.
• Billing (we are the Controller): contact and billing email, buyer NPWP and address on invoices. Cards are tokenised by Midtrans in the browser; we receive only a masked card number.
• Usage statistics: per-organisation daily counts and AI token usage. The app contains no analytics or tracking library.

4.2. Certified electronic signature enrolment (PSrE)

To sign with a certified electronic certificate, you first enrol with a licensed electronic certification provider (PSrE) through the app. For this, the app collects:

• a photo of your KTP (taken with the camera only) and, optionally, a photo of your NPWP;
• a short video of your face, recorded with sound, for a liveness check (no longer than 8 seconds);
• biodata: full name, NIK, place and date of birth, gender, address, province and city, organisation unit and position, and a verified phone number.

The face video and voice are biometric data, a category of specific personal data under Article 4(2) of the PDP Law. They are processed only with your explicit consent, which you give in the app before you submit, and only so that a licensed certification authority can verify your identity and issue an electronic certificate.

The data goes to PT Peruri Digital Security (Peruri Sign-IT), a licensed PSrE. Peruri processes it as its own Controller under its Certificate Policy, Certification Practice Statement, Subscriber Agreement and privacy policy. For installations billed through Valid, the request passes through a relay we operate (the Valid Broker); we do not store the photo or the video there. The Obscura server does not store the KTP photo, the NPWP photo or the video. It keeps only the verified phone number and the enrolment status.

If your organisation has turned on AI features and you choose to fill the form from your KTP photo, the photo is sent to your organisation's AI provider only to read the text on it; you can type the details yourself instead.

Signing without a certified certificate does not require any of this.

4.3. External signers

External signers are people outside the organisation who sign through a link. For them we process: name, email, phone number, the IP address and browser or app details at signing, the time and version of the consent they gave, their signature image, and the channel a one-time code was sent to.

One-time codes and signing links are sent by email, through the organisation's own mail server or, on Obscura Cloud, through our own mail server. Where the organisation has turned on WhatsApp delivery, they can also be sent by WhatsApp, through Meta's WhatsApp service.

These records are kept with the signed document, under the organisation's retention rules. A spent signing link shows a receipt for 90 days.

4.4. Purposes, basis and retention

4.5. Cookies and local storage in the web app

The web app uses one essential cookie, obscura_session (HttpOnly, Secure, SameSite=Lax, 24 hours), to keep you signed in. The browser also stores the sign-in token, language, theme, interface state and local drafts in localStorage. There are no advertising or analytics cookies.

5. The Obscura Mobile App

5.1. The Obscura mobile app connects only to your organisation's own Obscura server (on Obscura Cloud or on a Private or Enterprise installation), plus Apple Push Notification service or Firebase Cloud Messaging for notifications. Your organisation is the Controller of the data the app sends to its server.

5.2. The app contains no analytics, crash-reporting, advertising or tracking SDKs. It does not use the advertising identifier and does not track you across other apps or websites.

5.3. Device permissions. The app asks for each permission only when you use the feature that needs it:

• Camera: to take the KTP photo and liveness video for certificate enrolment (Section 4.2), and to photograph a leaked page to trace its source.
• Microphone: the liveness video is recorded with sound.
• Photo library: to pick or save files.
• Face ID / Touch ID: to unlock the app and confirm signatures. The biometric check happens on the device; the app receives only a pass/fail result from the operating system, and no biometric template leaves the device.

5.4. Data stored on the device.

• In secure storage backed by the iOS Keychain or Android Keystore: a sign-in token (valid 30 days, renewed as it is used), a device identifier, recently opened documents, search history, your settings, and your choice about sharing data with AI.
• In the app's private storage: offline copies of documents you pin, and a preview cache. Offline copies are deleted when you sign out.

5.5. Push notifications. Your device's push token is stored on your organisation's server. It is deleted when you sign out, when you turn notifications off, or when your account is disabled. A notification contains a short alert and a link into the app, not document contents.

6. Part C: Third Parties Whose Data Is in Customer Documents

6.1. Documents uploaded by a Customer can contain other people's personal data, for example employees, partners or the Customer's own customers, including names of people and organisations extracted from documents, extracted text and search embeddings.

6.2. In this case the Customer is the Controller and decides the purpose, legal basis and retention. We act only as Processor on the Customer's instructions and under the DPA.

6.3. If your data is in an organisation's documents and you want to use your rights (access, correction, erasure and others), contact that organisation first. We will help the Customer answer your request. If you send the request to us, we forward it to the Customer.

6.4. Unsaved AI chat history is deleted after 30 days by default (an Admin can change this). How long documents are kept follows the Customer's retention rules.

7. Private and Enterprise Editions (Licence Check)

Obscura Private and Enterprise are installed on the customer's own servers. The customer runs the server and is the Controller of everything on it. We have no access to that data and are neither Controller nor Processor for it, with two exceptions where we act as Processor:

• Licence check data: a daily licence check to licence.getobscura.id, containing the licence fingerprint, edition, build, expiry and modules. It contains no document data, tenant names, user identities or counts. Air-gapped installations send nothing.
• Valid Broker: for installations billed through Valid, the e-signature and e-Meterai requests relayed through the Valid Broker, which also meters units. The Broker stores no document content or hashes, and does not store the enrolment photo or video (Section 4.2).

8. Recipients and Subprocessors

We do not sell personal data. We share it only with the parties below, as far as needed for the Service:

Semantic search (embeddings) runs locally with no third party. Office document editing (OnlyOffice) is self-hosted. We may also disclose data where the law requires or a competent authority lawfully requests it.

9. Transfers Abroad

9.1. Documents and the database are stored in Indonesia, on our own servers in a data centre in Jakarta, backups included. Service emails are sent through our own mail server in Indonesia. The routine cross-border transfers are these:

• to the AI providers in the United States, only when AI features are on with the default provider;
• to Apple and Google push services (global), for notification metadata only;
• to WhatsApp (Meta Platforms) (global), only if the organisation turns on WhatsApp delivery;
• to Cloudflare (global), for DNS queries for our domains only.

9.2. Purpose: to answer a question or read an upload at the User's request, to deliver notifications and one-time codes, and to resolve our domains. Basis for the transfer under Article 56 of the PDP Law: we make sure the destination country has an equal or higher level of protection; if not, we rely on adequate and binding safeguards (for example a data processing agreement with the provider); if neither exists, consent.

9.3. Risk: data sent is subject to the laws of another country and the provider's control while it is processed. To reduce this, an Admin can switch AI off, use its own provider key or a self-hosted endpoint, or block AI by document classification. Private Vault folders are never sent to AI. We do not use Customer content to train models.

10. Retention

11. Your Rights and How to Use Them

Under the PDP Law (Articles 5 to 14) you have the right to:

• get information about how your data is processed;
• ask for correction of wrong data (we act within 3 x 24 hours, Article 30);
• access your data and ask for a copy (3 x 24 hours, Article 32);
• ask for erasure or destruction of data (Articles 8 and 42 to 45);
• withdraw consent; processing stops within 3 x 24 hours (Article 40);
• ask to restrict processing (3 x 24 hours, Article 41);
• object to automated decisions (Article 10);
• claim damages for a violation (Article 12);
• ask for data portability (Article 13).

How to apply: for data we control (Section 1.2), send a written request to contact@obscr.id with the subject "Privacy", stating your name, account email and the right you want to use. We may ask for proof of identity. Requests are recorded and answered in writing. Rights may be limited by the exceptions in the PDP Law.

If you are a User in an organisation, your organisation is the Controller of your data, so send requests (access, correction, deletion and others) to your organisation first. You may also write to us at contact@obscr.id with the subject "Privacy"; on Obscura Cloud we pass the request to your organisation and help it respond.

Account deletion: accounts are deleted by your organisation's administrator. On deletion, sign-in, devices and certificates are revoked. Records the organisation must keep, such as its audit log, stay under its retention rules.

For the content of documents, apply to the Customer (the Controller). We assist it.

12. Consent

Accepting the Terms of Service is not consent to processing personal data. Where processing relies on consent (for example to answer a demo request, for push notifications, for sharing data with AI in the app, or for certified electronic signature enrolment), it is requested separately and is not made a condition of unrelated services (Articles 22 to 24 of the PDP Law; Government Regulation 33/2026). You can withdraw it at any time without affecting earlier processing.

13. Security

We apply technical and organisational measures to protect data (Articles 35 and 39 of the PDP Law): file encryption at rest (per-object envelope encryption); signing keys, MFA secrets and stored credentials are encrypted; TLS in transit; tenant separation (a separate database schema and storage namespace per organisation); a tamper-evident, hash-chained audit log with regular verification; MFA (TOTP, passkeys), SSO (OIDC, LDAP, SCIM), lockout after repeated failures, and a minimum password length of 12 characters. The Service is developed and operated under PT Virtue Digital Indonesia's ISO/IEC 27001-certified information security management system. No system is completely free of risk. Details are in Annex 2 of the DPA.

14. Personal Data Protection Failures

If a failure of data protection affects you, the Controller (the Customer for data in its organisation, or we for data we control) notifies you and the competent authority in writing within 3 x 24 hours, and in some cases also announces it publicly (Article 46 of the PDP Law). As Processor, we notify the Customer earlier (see the DPA).

15. Automated Decisions and AI

AI output is assistance only. We do not make decisions that have legal effect on you solely by automated processing. Users review AI output before using it. You have the right to object (Article 10 of the PDP Law).

Before you use AI features in the mobile app, the app asks you to agree to the sharing. Your choice is stored on the device and can be changed in Account. The AI provider is chosen by your organisation: OpenAI, Anthropic, or a compatible endpoint, which may be self-hosted. On Obscura Cloud with the default provider, the data goes to the United States (Section 9).

16. Children

The Service is for organisations and is not directed at children (Article 16A of the ITE Law; Article 25 of the PDP Law). We do not knowingly collect children's data. If you know this has happened, contact contact@obscr.id.

17. Privacy Contact

Questions or requests about privacy: contact@obscr.id. Our Data Protection Officer can be reached at the same address (Articles 53 and 54 of the PDP Law).

18. Merger, Demerger, Acquisition or Consolidation

If we undergo a merger, demerger, acquisition or consolidation, we notify you before and after the event (Article 48 of the PDP Law). Data stays protected under this policy until the successor notifies a change.

19. Changes to This Policy

Changes to this policy are notified before they take effect, by email and/or inside the Service (Article 21(2) of the PDP Law). We keep earlier versions.

20. Complaints

You can complain about a suspected violation to us at contact@obscr.id, or to the PDP Authority or another body designated by law.

21. Language

This policy is made in Indonesian and English. If there is any difference, the Indonesian version prevails.

22. Version and Effective Date

Version 2026-10. Effective from 28 October 2026.