Privacy policy

1. Controller and contact

EbookIndie at ebookindie.com is operated by Heru Wijaya as the personal-data controller, based in Kuala Pembuang, Seruyan, Central Kalimantan, Indonesia. The owner handles privacy requests and complaints.

Use the privacy-request form or contact ebookindieofficial@gmail.com with the subject “Privacy EbookIndie”. Do not send identity-card numbers, passwords, one-time codes, or private access keys.

2. Data, purposes and legal bases

Guest checkout requests a name only for PDFs with a name watermark, without requiring email or phone/WhatsApp. A payment provider may request additional data under its own terms. We do not store full card numbers, payment PINs or OTPs. We do not sell personal data, perform automatic direct marketing, or make legally significant automated decisions based on visitor profiles.

If additional processing requires consent, its purpose and choices will be explained before use. Withdrawing consent does not undo lawful previous processing or applicable retention obligations.

3. Providers and processing outside Indonesia

The service uses OpenAI Sites and Cloudflare infrastructure for hosting, databases, files and security; Midtrans/payment-method providers for transactions; Resend for service email; and Google Gmail for support. When connected by the owner, the EbookIndie administrator reads support emails and attachments and sends replies through Gmail. Incoming messages remain in Gmail; the website retains status, handling notes and protected connection credentials. Outgoing replies are encrypted until delivery is confirmed. Gmail data is used for support, not advertising or AI-model training. Gmail data use complies with the Google API Services User Data Policy, including Limited Use. DomaiNesia provides domain/DNS management. Providers receive only data needed for their role; payment providers may act as separate controllers. Google API Services User Data Policy.

The operator is in Indonesia. Hosting infrastructure and certain providers process data in the United States and other locations in global networks. We review provider processing, security and transfer terms and limit transmitted data. Rights requests can be submitted to EbookIndie even when overseas providers are involved. Providers’ terms apply to processing for which they are responsible.

OpenAI providers · Cloudflare privacy · Midtrans privacy · Resend privacy

4. Retention and deletion

Data is retained according to its purpose, legal obligations and retention schedules. Expired download access does not automatically delete transaction records.

• Transaction records and relevant accounting/tax documents are retained for at least 10 years under applicable rules. Minimum required records remain protected when deletion cannot include mandatory archives.
• Service records, privacy requests and handling evidence follow service/accountability needs and applicable electronic-system retention rules, including a five-year minimum reference where no specific rule applies. Unnecessary or unlawfully processed data is reviewed for deletion; exceptions and reasons are explained to the requester.
• Statistics cookies last at most 90 days. Visit records older than 120 days are gradually cleared during service use. Rate-limit hashes are temporary. Infrastructure providers’ logs do not necessarily follow the same periods.
• Backups are protected and are not used for routine service. Approved deletion/correction instructions are recorded and reapplied before restored data is used. Required records or records under dispute remain restricted.

Relevant data may be retained longer for disputes, lawful law-enforcement requests or other obligations. We explain why a restriction or deletion request cannot be fulfilled rather than promise immediate removal of every copy.

5. Rights and handling requests

You may request information, access/copies, correction, cessation or restriction of processing, withdrawal of consent, deletion/destruction, and raise objections or complaints under applicable rules. Portability requests and objections to automated decisions can use the same channel.

1. Use the privacy-request form or email the contact address. An order number may be included but is not required. Keep the receipt number.
2. The operator checks identity proportionately, for example through an existing contact or matching order access. Do not send access secrets on the public form. If further evidence is needed, the operator explains the minimum data and a safe channel.
3. Requests are recorded on receipt. Access, correction, consent-withdrawal and restriction rights follow the applicable 3 × 24-hour deadlines. Identity checks do not remove recorded deadlines; obstacles and follow-up are explained.
4. Results are sent to a verified contact. Other people’s data and security secrets are withheld. If retention is mandatory or a request cannot be met, the reasons and scope are explained. Requesters may complain again and use available legal resolution channels.

Ordinary handling is free. Removing an account or access may affect order recovery. Downloaded PDFs remain on the file holder’s device; their watermarks cannot be changed from the server.

6. Cookies, browser storage and statistics choices

Your browser may store drafts, favourites, order access and support messages. Cookies/sessions are required for authentication and security of the functions used. Clearing browser data may remove saved access; save your order-access information first.

Statistics do not request names, email or phone numbers, or use order identities. PDF Tools also counts page openings, heart clicks and link-copy actions. Records contain the page/tool type, action, time and a random code for each page opening; PDF/photo names and contents are excluded. Records are gradually cleared after 120 days. Do Not Track and Global Privacy Control are respected. You can also stop statistics in this browser without affecting purchasing.

6a. Google advertising on PDF Tools

When enabled on tool pages, Google and its advertising partners may use cookies, IP addresses, device identifiers and similar technologies to serve and measure ads. Personalised ads may reflect visits to this or other websites. Locally processed PDFs/photos and support Gmail data are not used for advertising.

Advertising consent is managed separately from the statistics choices above. Visitors may refuse or manage consent through the advertising privacy message when available. Google personalisation choices are available in My Ad Center; other-provider choices in AdChoices. Read about Google’s use of data on partner sites.

Advertising privacy: When enabled on our tools, Google and its advertising partners may use cookies, IP addresses, device identifiers, and similar technologies to serve and measure ads. Personalized ads may reflect visits to this and other websites. Document contents and support Gmail data are not used for advertising. Advertising consent is separate from site statistics. You can manage or refuse consent in the advertising privacy message when available, and manage personalization using the links above.

7. Security, incidents and lawful requests

We use access restrictions, administrator authentication, HTTPS, attempt limits, private file storage and backups. Access is limited to required tasks. No system can guarantee absolute security.

In a data-protection incident, the operator contains the impact, investigates, records and restores service. Written notice is provided to affected individuals and the competent authority within the applicable 3 × 24-hour deadline, describing affected data, when/how it was exposed and the response. If contact details are unavailable, a suitable notification channel is chosen without revealing personal data publicly.

Law-enforcement requests are checked for legal basis, authority and scope. Only necessary and lawfully requested data is provided, with records and notification where permitted.

8. Children and policy updates

Children’s purchases and data submissions require parent/guardian involvement under applicable rules. Do not include unnecessary child data in products, orders or support images. Contact the privacy channel if you become aware of child data supplied without an appropriate basis.

This policy may change as services or requirements change. The update date is shown on this page. A new purpose requiring additional grounds or consent is not accepted merely because the policy has changed.