KerjaSiap
ID
Log in

Privacy Policy

Effective 26 October 2026 (beta). If anything important changes, you will be asked to accept it again.

This policy explains what personal data KerjaSiap collects, why, who else processes it, how long it is kept, and your rights under Indonesia's Personal Data Protection Law (Law No. 27 of 2022).

1. Data controller

KerjaSiap is operated by Star. For any question or request about personal data, contact support@kerjasiap.com.

2. Data we collect

  • Account: your name and email address from your Google account when you sign in. We do not store your profile photo or your Google password.
  • Documents: CVs, job postings, match checks and cover letters you create or import. Uploaded CV files are read and discarded; only the content you reviewed is stored.
  • AI usage: action type, time, status and token counts. No document content is recorded here.
  • Credits and transactions: credit history, order number, package, amount, payment method and status. Your card, e-wallet or bank details are processed by Midtrans and never reach us.
  • Abuse prevention: a keyed hash of your Google account ID so free credits are only granted once; your IP address is used briefly for rate limiting and the anti-bot check and is not stored in our database.
  • Your consent history, language preference and when you were last active.
  • Cookies: only the cookies the service needs to work: your sign-in session, the Google sign-in flow, and your display theme (light/dark, kept on your device, not in our database). No advertising or tracking cookies.

We do not ask for national ID numbers, full date of birth, religion or marital status. Avoid putting them in your CV; the app warns you when it detects them.

3. Purposes and legal basis

  • Running the service: sign-in, storing documents, AI features and buying credits.
  • Security and abuse prevention (anti-bot, usage limits, admin audit trail).
  • Meeting record-keeping obligations for transactions.

The legal basis is your consent and the performance of our agreement (Terms of Service). We do not sell personal data and use no third-party ads or trackers.

4. Who processes data for us (processors)

  • Cloudflare: app hosting, database (Asia-Pacific region) and the Turnstile anti-bot check at sign-in.
  • Google: sign-in with your Google account.
  • Anthropic (United States): processes your CV, job postings and notes when you use AI features. Under Anthropic's commercial terms this content is not used to train AI models; Anthropic may keep it temporarily for safety purposes under its policies.
  • Midtrans (PT Midtrans, Indonesia): processes payments. We only send the order number, package name and amount.

Some processors handle data outside Indonesia. These transfers rely on the consent you give when you first sign in.

5. Retention

  • Documents: deleted automatically if you do not sign in for 90 days. Your account and credit balance remain.
  • Account and credit balance: until you delete your account. The balance is valid for 12 months after your last purchase.
  • Account deletion: the account is disabled at once; all personal data is permanently deleted within 72 hours. Signing in again before then cancels the deletion.
  • Accounts that never accepted the policy: deleted automatically after 30 days of inactivity.
  • AI usage records (no content): 400 days.
  • Transaction records: kept as long as bookkeeping and tax rules require; after account deletion they are no longer linked to any account.
  • Free-credit claim hash: kept indefinitely to prevent repeated claims; it cannot be turned back into your identity.

Automatic database backups at our hosting provider may still contain deleted data for up to 30 days, after which it disappears on its own. These backups are not used for anything else.

6. Your rights

  • Access and download your data: Settings → Download data.
  • Correct your data: edit your documents directly; name and email follow your Google account.
  • Delete your data and withdraw consent: Settings → Delete account.
  • Object, ask questions or complain by email at the address above.

We respond to requests within 3 × 24 hours.

7. Security and data breaches

Connections are encrypted (HTTPS), sessions are stored as hashes, all data is scoped to its account and admin access is logged. If a personal data breach occurs, we notify you and the authorities within 3 × 24 hours as required by the PDP Law.

8. Changes

If this policy changes materially, you will be asked to read and accept it again before continuing.