Privacy Policy

This policy explains how EkoNugroho Labs (“we”, “us”) handles personal data in our products, including Karaya, and on this website. We are an independent, bootstrapped studio based in Bogor, Indonesia.

Data we collect

• Account data: your name, email address and login information.
• Household financial data you enter: accounts, transactions, categories, budgets, notes and receipt images you choose to upload.
• Assistant conversations: messages you send to the Karaya assistant and its replies.
• Technical data: basic logs such as IP address, device and browser type, and error reports, used to keep the service secure and working.

We do not connect to your bank and we never ask for banking passwords or PINs.

How we use it

• To provide the product: store your household ledger, generate reports and answer your questions.
• To secure the service, prevent abuse and fix problems.
• To contact you about your account or the beta.

We do not sell your data and we do not use it for advertising.

AI processing

When you use the Karaya assistant, the relevant message and the minimum ledger data needed to answer it are sent to the AI model provider configured for your household to generate a response. During the beta this is the provider whose API key you connect: Anthropic (Claude), OpenAI, Google (Gemini) or Groq. Each provider handles that data under its own API terms; for example, under Anthropic's commercial terms, data sent through its API is not used to train its models by default. We do not ask the model to store your data; your ledger lives in our database.

Service providers

We rely on a small number of providers to run the service: Supabase (database and authentication), Vercel (hosting), and the AI provider you connect for assistant responses. They process data only on our behalf and under their own security commitments. Data may be processed outside Indonesia.

Sharing inside a household

Members of the same household can see the accounts and transactions shared with that household, according to their role. Personal accounts are visible only as the household's settings allow.

Retention and deletion

We keep your data while your account is active. You can ask us to export or delete your account and household data at any time by emailing founder@ekonugroho.dev; we will complete deletion within 30 days, except where we must keep records by law.

Security

Data is encrypted in transit, access is scoped per household, and API keys are stored as hashes. No system is perfectly secure, so please use a strong password and tell us immediately if you suspect misuse.

Your rights

Consistent with Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022), you can request access to, correction of, or deletion of your personal data, and withdraw consent. Contact us and we will respond promptly.

Children

Accounts are for adults. Children may appear in a household only as data entered by their parents or as viewers added by an adult member.

Changes

If we change this policy in a meaningful way, we will update the date above and notify active users.

Contact

EkoNugroho Labs · Bogor, Indonesia · founder@ekonugroho.dev