Terms of Service for Obscura Cloud

1. Who We Are and What These Terms Cover

1.1. Obscura Cloud (the "Service") is provided by PT Virtue Digital Indonesia ("we", "us"), a limited liability company established under the laws of the Republic of Indonesia, trading under the Valid brand (val.id).

1.2. These Terms of Service (the "Terms") govern use of Obscura Cloud, which is Obscura run by us in Indonesia as a subscription service (SaaS).

1.3. The Private and Enterprise editions (Obscura installed on the customer's own servers) are not covered by these Terms. They are governed by a separate licence agreement. What the licence check sends for those editions is described in the Privacy Policy.

1.4. These Terms are read together with the Privacy Policy and the Data Processing Agreement (the "DPA"). Together they form the agreement between us and the Customer (the "Agreement").

2. Terms We Use

• Customer: the company, institution or other organisation that opens an Obscura Cloud account.
• User: an individual given access by the Customer, including employees and invited external signers.
• Admin: a User who is allowed to manage the Customer's organisation inside the Service.
• Customer Content: documents, files, data and other information that the Customer and Users upload, create or process in the Service.
• Credits: a prepaid balance used for e-Meterai, certified electronic signatures, e-stamps and AI usage.
• PSrE: a licensed Electronic Certification Provider (Penyelenggara Sertifikasi Elektronik). In the Service, the PSrE is PT Peruri Digital Security ("Peruri").

3. Acceptance and Formation of the Agreement

3.1. The Agreement is formed when the person representing the Customer accepts these Terms by clicking an agreement button (click-through) at sign-up or ordering, or when the Customer starts using the Service.

3.2. The person who accepts the Terms declares that he or she is authorised to bind the Customer. If not authorised, that person must not accept these Terms.

3.3. The Service is meant for organisations, not for individuals for personal use, and is not directed at children. We do not knowingly give accounts to children.

3.4. At self-serve sign-up we record the version of the Terms, the links shown, the time of acceptance, the IP address and the user agent as proof of acceptance. The Customer can download or store a copy of the Terms from this page (use the browser's print function to save as PDF), or ask us for a copy.

3.5. Because the Customer is an organisation, we treat the relationship as business-to-business. Even so, we have drafted these Terms with consumer-protection principles in mind, including the ban on unfair standard clauses (Article 18 of Law 8/1999).

4. The Service

4.1. The Service provides a web and mobile document-management platform, including storing and managing files and versions, search, Office document editing, approval workflows, electronic signatures, e-Meterai, optional AI features, document sharing and an audit trail.

4.2. The Service is delivered as online access. No physical goods are shipped.

4.3. We may update, add or change features. A change that materially reduces functionality the Customer pays for is handled under Section 25.

5. Free Trial

5.1. New Customers get a 14-day trial.

5.2. We send reminders 7, 3 and 1 days before the trial ends.

5.3. The first invoice is issued at the end of the trial and is due 14 days later. A Customer who does not want to subscribe must cancel before the trial ends (Section 8).

6. Price, Billing and Payment

6.1. The Service is billed as a monthly subscription. Current prices are the prices shown in the Service at sign-up and on the Billing page, or in the agreed order form.

6.2. Invoices are issued in two languages (Indonesian first). VAT (PPN) is added where applicable. Our invoice is not a tax invoice (Faktur Pajak); a Faktur Pajak is issued separately under tax rules.

6.3. If the Customer withholds income tax under Article 23 (PPh 23), we record the withholding and the Customer must provide the withholding slip.

6.4. Card payments are processed by Midtrans. Cards are tokenised in the Customer's browser; we never see the full card number.

7. Late Payment and Suspension

7.1. If an invoice is still unpaid 7 days after its due date, we send a warning.

7.2. A self-serve subscription is suspended when an invoice is 14 days overdue, and never sooner than 7 days after the warning was sent.

7.3. A suspended organisation is fully blocked, including sign-in, until payment is made. The payment link keeps working, and paying lifts the suspension automatically.

7.4. Non-payment never causes data to be deleted. During suspension, Admins can still export data (Section 21).

8. Renewal, Cancellation and Plan Changes

8.1. The subscription renews each month until cancelled.

8.2. The Customer may cancel at any time. After cancellation, the Service continues until the end of the period already paid for.

8.3. The base plan is changed by cancelling and subscribing again. Add-ons added mid-period are billed pro rata by an off-cycle invoice.

9. Prepaid Credits

9.1. Credits are used for e-Meterai, certified electronic signatures, e-stamps and AI usage.

9.2. Credits do not expire.

9.3. An e-Meterai or signing operation that fails does not deduct Credits.

9.4. Using the Customer's own AI key or the Customer's own Peruri contract is not metered and does not deduct Credits.

9.5. Unused Credits are not refundable, except where the law requires otherwise or where we end the Service without the Customer's fault; in that case we refund unused prepaid Credits pro rata.

10. Refunds

10.1. Subscription fees already paid for the current period are not refunded when the Customer cancels, because the Service stays available until the end of the period (Section 8.2).

10.2. A pro rata refund of prepaid subscription fees is given when: (a) the Customer ends the Agreement because of a change to the Terms under Section 25; (b) we end the Service for a reason other than the Customer's breach; or (c) the law requires it.

10.3. Credits: see Section 9. An e-Meterai that has been successfully affixed cannot be refunded, except under Peruri's terms or applicable regulation.

10.4. Refund requests go to support@obscr.id and we answer in writing.

11. Service Level and Support

11.1. Scope. This Section applies to Obscura Cloud. As Section 1.3 says, the Private and Enterprise editions are not governed by these Terms. For those installations, which run on the customer's own servers, support and any service levels are as agreed in the order form, and there is no availability commitment, because the customer runs the server.

11.2. Availability target. We aim for the Service to be available at least 99.5% of the time in each calendar month. The Service is available when it can be reached for sign-in and document access, as measured by our monitoring.

11.3. What is not counted as unavailability. The following are not counted: (a) scheduled maintenance announced at least 48 hours in advance and carried out between 22:00 and 05:00 WIB, up to 4 hours per month in total; (b) urgent security fixes; (c) problems caused by the Customer, its Users or its systems; (d) outages of third-party services, including the PSrE (Peruri), AI providers, Midtrans, WhatsApp and email delivery; and (e) force majeure (Section 23).

11.4. Service credits. If availability in a calendar month falls below the target, the Customer receives a service credit equal to a share of that month's subscription fee:

The service credit is at most 25% of the subscription fee for any one month. Service credits are not Credits under Section 9.

11.5. Claiming a service credit. The Customer claims a service credit by email to support@obscr.id within 30 days after the end of the month concerned. Service credits are applied to the next invoice and are not paid out as cash. Without limiting Section 22.3, service credits are the Customer's sole remedy for unavailability of the Service.

11.6. Support. Support is provided by email at support@obscr.id, Monday to Friday, 09:00 to 17:00 WIB, excluding Indonesian public holidays. Our first-response targets are:

These are targets for a first response, not resolution times.

12. Customer Content

12.1. Customer Content remains the Customer's. We claim no ownership of it.

12.2. The Customer grants us a limited, non-exclusive licence, only for the term of the Agreement, to store, process and display Customer Content solely to provide the Service to the Customer. We do not use Customer Content to train AI models.

12.3. The Customer warrants that it has the right to upload Customer Content, and that for third-party personal data in it the Customer has a lawful basis for processing and has met its duty to inform the data subjects.

12.4. How long documents are kept follows the retention rules the Customer sets itself.

13. Personal Data Protection

13.1. For the content of documents and the data of Users inside the Customer's organisation, the Customer is the Personal Data Controller and we are the Personal Data Processor. Each party's rights and duties are set out in the DPA.

13.2. We are the Controller for our own customer-relationship data (sign-up and billing contacts, invoices, prospects), for data about visitors to our website, and for the security logs we need to protect the Service. This is described in the Privacy Policy.

13.3. We process personal data in line with Law 27/2022 on Personal Data Protection and its implementing regulations.

14. Electronic Signatures

14.1. The Service passes certified electronic signature requests to a licensed PSrE (Peruri). We are not a PSrE.

14.2. Certificate issuance, signer identity verification and certificate validity are governed by the PSrE's terms, Certificate Policy (CP) and Certification Practice Statement (CPS), which the Customer and each signer accept.

14.3. Signer identity verification (for example NIK, ID-card photo and liveness video) is sent to the PSrE and is not stored by Obscura (see Section 4.2 of the Privacy Policy).

14.4. The Service also offers an in-house (uncertified) signature tier. That signature has lower evidentiary weight than a certified signature (ITE Law as amended by Law 1/2024; Government Regulation 71/2019). The Customer chooses the tier that fits.

14.5. Documents that by law cannot be signed electronically remain the Customer's responsibility.

15. e-Meterai

15.1. Stamp duty is a state levy (Law 10/2020; Ministry of Finance Regulations 133/2021 and 134/2021). The Customer decides which documents need a stamp.

15.2. e-Meterai is affixed through Peruri. A failed affixing is not charged. An e-Meterai that has been affixed cannot be refunded, except under Peruri's terms or applicable regulation.

16. AI Features

16.1. Features that use AI: question-and-answer over documents, reading and extraction from uploaded files, and similar features marked as AI in the Service. Semantic search runs locally.

16.2. When the Customer uses the default provider, document text or extracts are sent to OpenAI or Anthropic (United States) when someone asks a question or asks AI to read an upload. The Customer's organisation can instead choose its own provider or a compatible endpoint, which may be self-hosted; the data then goes wherever that provider is. Before AI features are used in the Obscura mobile app, the app asks the User to agree to the sharing. The basis for transfers abroad is described in Section 9 of the Privacy Policy.

16.3. We do not use Customer Content to train models.

16.4. AI output may be wrong or incomplete. Users must review it before relying on it. AI only assists and makes no legal decisions. (See also Ministry of Communication and Information Circular 9/2023 on AI ethics.)

16.5. An Admin can switch AI off, use its own provider key or a self-hosted endpoint, or block AI by document classification (DLP). Private Vault folders are never sent to AI.

17. Forensic Watermarking

Issued copies of documents (downloads, copies and shared files) can carry an invisible mark and a visible copy code. These identify the recipient and the time of issue and are used to trace leaks. The Customer must inform its Users of this.

18. Acceptable Use

18.1. The Customer and Users must not: (a) upload or share unlawful content; (b) spread malware; (c) abuse or disrupt the Service or other users; (d) reverse engineer the Service or try to extract source code, except as the law allows; (e) overload the Service unreasonably; (f) access another organisation or its data without right.

18.2. Lawful requests from authorities. We may comply with a lawful request from a competent authority to the extent the law requires. We will notify the Customer where the law permits.

19. Security and Confidentiality

19.1. We apply reasonable technical and organisational measures to protect the Service and Customer Content, as described in Annex 2 of the DPA. The Service is developed and operated under PT Virtue Digital Indonesia's ISO/IEC 27001-certified information security management system.

19.2. No system is completely free of risk. We do not promise that the Service will never suffer disruption or incidents.

19.3. Each party keeps the other's confidential information confidential and uses it only for the Agreement, except where disclosure is required by law.

19.4. The Customer is responsible for keeping its Users' credentials confidential and for managing access rights in its organisation.

20. Suspension and Termination

20.1. The Customer may end the Agreement by cancelling the subscription (Section 8).

20.2. We may end the Agreement if the Customer materially breaches the Terms and does not fix the breach within 14 days of written notice. For serious breaches (for example unlawful use or a threat to the Service's security), we may suspend access immediately.

20.3. Suspension for non-payment is covered in Section 7.

20.4. Provisions that by their nature survive the end of the Agreement (for example confidentiality, limitation of liability and dispute resolution) continue to apply.

21. Data Export and Deletion After the End

21.1. An Admin (or our operator at the Customer's request) can export all data as an encrypted ZIP. Export is available while suspended, after closing and in read-only mode. The download link is valid for 15 minutes and the archive is deleted after 7 days.

21.2. After the subscription ends, the organisation is closed (reversible) and then purged. A purge irreversibly deletes documents, the database schema and registry rows, and is done manually by our operator.

21.3. Our policy: the Customer can export data for 30 days after the subscription ends; within 90 days after the subscription ends we delete that organisation's data. Exceptions: billing records that must be kept under tax and accounting rules, and backups, which age out under the backup cycle (daily, 7 copies by default).

21.4. The audit log is kept for as long as the organisation exists and is deleted together with it.

22. Warranty and Limitation of Liability

22.1. We provide the Service with reasonable care. To the extent the law allows, the Service is provided "as is", and we do not warrant that it is free of errors.

22.2. Our total liability to the Customer for all claims arising from the Agreement is limited to the fees the Customer paid in the 12 months before the claim was made.

22.3. That limit does not apply to loss caused by our wilful misconduct or gross negligence, or to anything else the law does not allow to be limited. Nothing in the Agreement excludes all of our liability.

22.4. We are not liable for indirect loss, lost profit or lost business opportunity, except loss covered by 22.3.

22.5. We are not liable for independent third-party services, including the PSrE, Peruri and Midtrans, which are subject to their own terms.

23. Force Majeure

Neither party is liable for delay or failure caused by circumstances beyond its reasonable control, such as natural disaster, war, riot, widespread power or network failure, government action or failure of an infrastructure provider. The affected party must tell the other as soon as possible and work to restore the situation. Payment obligations that have already fallen due are not cancelled.

24. Notices and Contact

24.1. Notices to the Customer are sent to the registered Admin or billing email and/or shown inside the Service.

24.2. Notices to us go to contact@obscr.id or to our address at PIK Avenue Mall, Level 6, Jalan Pantai Indah Kapuk Boulevard, Kel. Kamal Muara, Kec. Penjaringan, Kota Adm. Jakarta Utara, DKI Jakarta 14470. General questions: contact@obscr.id.

25. Changes to the Terms

25.1. We may change the Terms. Material changes are notified at least 30 days before they take effect, by email and/or inside the Service. A change takes effect only after that notice.

25.2. If the Customer does not accept a material change, it may terminate the Agreement before the change takes effect and receive a pro rata refund of prepaid subscription fees for the period after termination.

25.3. Continued use of the Service after the effective date means the Customer accepts the change. A change required by law may take effect sooner.

26. Governing Law and Dispute Resolution

26.1. The Agreement is governed by the laws of the Republic of Indonesia.

26.2. The parties first try to settle any dispute by good-faith negotiation for 30 days from written notice of the dispute by either party.

26.3. If it is not settled, the dispute goes to the South Jakarta District Court (Pengadilan Negeri Jakarta Selatan).

27. Language

27.1. These Terms are made in Indonesian and English. Both versions are equally authentic (Law 24/2009 Article 31; Presidential Regulation 63/2019 Article 26).

27.2. If there is any difference or conflict, the Indonesian version prevails.

28. General

28.1. The Agreement is the parties' entire agreement on the Service and replaces earlier oral understandings.

28.2. If a provision is invalid or unenforceable, the others remain in force.

28.3. The Customer may not assign the Agreement without our written consent. We may assign it to a successor to our business, with notice to the Customer.

28.4. Failure to exercise a right is not a waiver of that right.

29. Version and Effective Date

Version 2026-10. Effective from 28 October 2026. This version is recorded together with the Customer's acceptance at sign-up.