Last updated: August 15, 2026
This Privacy Policy describes how Pomodo collects, uses, and protects information when you use our AI-powered news summarization service ("Service"). We are committed to transparency about our data practices and to complying with Indonesian Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi / UU PDP) and other applicable regulations. By using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please discontinue use of the Service.
We may collect the following categories of information: Automatically Collected Data • IP address and approximate geolocation (country/region level) • Browser type, operating system, and device type • Pages visited, time spent, and navigation patterns • Referral URLs (where you came from) • Search queries made within the Service • Advertising and analytics identifiers set by third-party cookies (see Section 5) Account Data (if you register) • Email address and chosen username • Authentication credentials (stored in hashed form) • Preferences and saved article history In accordance with UU PDP, we classify the above as general personal data. We do not collect specific personal data (data pribadi yang bersifat spesifik) such as health information, biometric data, financial records, or government-issued ID numbers (NIK, passport).
We use collected information to: • Operate, maintain, and improve the Service • Personalize content recommendations based on reading behavior • Analyze usage trends to improve AI summarization quality • Send transactional emails (e.g., account verification, password reset) • Detect and prevent fraud, abuse, or unauthorized access • Comply with legal obligations under Indonesian law We process your personal data based on your consent and our legitimate interest in providing the Service. We do not sell your personal data for money. Our advertising partners collect data through cookies to personalize advertising, as described in Section 5; some jurisdictions treat this as a "sale" or "sharing" of personal data. We do not use your data to train our AI models without separate, explicit consent.
Our Service uses third-party AI APIs to generate news summaries. When processing articles, these systems may receive: • The text content of source articles (publicly available information) • Query inputs if you use search or chat features We do not transmit your personal identifiers (name, email, IP address) to AI processing systems. AI providers we use are contractually bound by data processing agreements that restrict secondary use of submitted content. Article summarization inputs are ephemeral and are not retained by our AI providers beyond the scope of a single request, in accordance with our data processing agreements.
We may share your information only in the following circumstances: Service Providers: We engage third-party vendors (e.g., cloud hosting, email delivery, analytics, and advertising) who access data solely to perform services on our behalf and are bound by confidentiality and data processing agreements. Legal Requirements: We may disclose information if required by Indonesian law, court order, or a lawful request from authorized government institutions such as Kominfo (Ministry of Communication and Information Technology) or law enforcement agencies. Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred. We will notify users before any such transfer in accordance with UU PDP. We do not sell, rent, or trade your personal data to data brokers. We do use Google's advertising and analytics services, which collect data through cookies as described in Section 5.
We retain your personal data only as long as necessary to provide the Service or as required by Indonesian law: • Account data: Retained for the duration of your account plus 90 days after deletion • Usage logs: Aggregated after 30 days; raw logs deleted after 90 days • Email communications: Retained for up to 2 years for support purposes Upon deletion, your data will be permanently removed from our systems within 14 days, except where retention is required by applicable Indonesian regulations. Some data may be retained in anonymized, non-identifiable form for analytics purposes.
Under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP), you have the following rights regarding your personal data: • Access: Request confirmation of whether we process your data and obtain a copy. • Correction: Request correction of inaccurate or incomplete personal data. • Deletion: Request deletion of your personal data ("hak untuk dilupakan"). • Withdrawal of Consent: Withdraw consent for data processing at any time, without affecting prior processing. • Objection: Object to automated decision-making that produces legal or significant effects on you. • Portability: Request your data in a structured, machine-readable format. To exercise any of these rights, contact us at [email protected]. We will respond within 14 days as required under UU PDP. You also have the right to lodge a complaint with the Indonesian personal data protection authority once formally established.
As we use international cloud infrastructure and AI service providers, your data may be processed in countries outside Indonesia. We ensure that any cross-border transfer of personal data complies with Article 56 of UU PDP, which requires that the destination country has a comparable level of personal data protection, or that adequate contractual safeguards are in place. By using the Service, you consent to the transfer of your data to our service providers abroad under these conditions.
We implement technical and organizational security measures including: • TLS/HTTPS encryption for all data in transit • Encrypted storage for sensitive data at rest • Role-based access controls limiting employee access to personal data • Regular security assessments and vulnerability reviews In the event of a personal data breach that poses a risk to your rights, we will notify the relevant Indonesian authority and affected users within the timeframe required by UU PDP. We will also take immediate steps to contain and remediate the breach.
Our Service is not directed to individuals under the age of 17 (the age of majority under Indonesian law for most civil acts). We do not knowingly collect personal data from children without verifiable parental consent as required under UU PDP. If you believe a child has provided us with personal data without appropriate consent, please contact us immediately and we will delete that information promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable Indonesian regulations. We will notify you of significant changes by posting the updated policy with a new "Last Updated" date, and by sending an email notification to registered users for material changes. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
Pomodo acts as the data controller (pengendali data pribadi) for personal data processed through this Service. For privacy-related questions, requests, or complaints, contact us at: Email: [email protected] We aim to respond to all privacy inquiries within 14 days as required under UU PDP.