Privacy Policy

AergonOS Project Management (the “Service”, available at https://project.aergonos.com) is operated by Aexo Digital Indonesia (“we”, “us”). This policy explains what information the Service collects, how it is used, and the choices you have.

1. Information we collect

• Google sign-in. When you sign in with Google we receive your email address, name, and a flag saying the email is verified. We request only the basic openid, email and profile scopes. We do not access your Gmail, Google Drive, contacts, calendar, or any other Google data.
• Invitations. Project administrators enter the email addresses of team members and clients they invite. Only invited emails (and designated administrators) can sign in.
• Content you create. Brands, projects, posts, replies, attachments, logos, folder links, schedules, and client approval decisions and notes, together with who created them and when.
• Cookies. A strictly necessary session cookie (aergonos_session, HttpOnly, up to 7 days) keeps you signed in, and a short-lived cookie (aergonos_oauth_tx, about 10 minutes) protects the sign-in flow. We do not use advertising or analytics cookies.
• Technical logs. Our server may record standard request information (such as IP address and time) for security and troubleshooting.

2. How we use information

• To authenticate you and decide what you may see and do (team member, client, or administrator).
• To show your name next to posts and replies you write, and to operate, secure, and improve the Service.
• To respond to support and privacy requests.

We do not sell your personal information and do not use it for advertising.

3. Who can see your information

• Team members of a project can see the project’s content, replies, and the email addresses of its team members and clients.
• Clients can only see posts the team has sent to them (including attachments), plus their own decisions and notes.
• Service providers that process data on our behalf: Google (sign-in), Neon (database hosting), and Hostinger (server hosting). They may only use the data to provide their services to us.
• We may disclose information if required by law or to protect the rights and security of users and the Service.

4. Google user data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google account information is used only to sign you in and identify you in the Service.

5. Retention and deletion

We keep information while your project exists and your account is invited to it. Deleting a project, brand, post, attachment, or reply removes it from the Service. Backups may keep copies for a limited period. To have your account access removed or your personal data deleted, contact boris@aexodigital.com.

6. Security

The Service uses HTTPS, role-based access control, and HttpOnly session cookies. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information.

7. Where data is processed

Our servers are hosted in Indonesia, and our database provider may process data in other countries. By using the Service you understand your information may be transferred and stored outside your country.

8. Your rights

Depending on where you live, including under Indonesia’s Personal Data Protection Law, you may have the right to access, correct, or delete your personal data and to object to certain processing. Contact boris@aexodigital.com to make a request.

9. Children

The Service is intended for business use and is not directed to children.

10. Changes

We may update this policy. The “Last updated” date above shows the latest version. Significant changes will be announced in the Service.

11. Contact

Questions about this policy: boris@aexodigital.com.