Privacy policy

PT Solusi Akal Imitasi, a Perseroan Perorangan registered in Yogyakarta, Indonesia, is the controller for Account administration, Carya billing, security, compliance and other independent purposes described here. NIB: 0206260060829. Privacy requests: hello@carya.page. Safety reports: safety@carya.page.

A Creator ordinarily controls the purpose and use of data collected through their Page, including form submissions, Subscriber lists and Creator order records. Carya processes that data on the Creator's instructions to deliver the Service. Carya is separately responsible as controller for its own legally required accounting, safety or compliance records. A payment or sign-in provider may be an independent controller for its own services.

Contact hello@carya.page for privacy correspondence and information about any privacy officer or regional representative applicable to your processing. Carya publishes any legally required operator, correspondence and officer or representative details in its contact information.

We process data subject to Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP) and other applicable law. EEA and UK protections in this notice apply where their territorial rules apply to the processing; global availability alone does not decide the question. Mandatory rights are not waived by accepting Carya's Terms or acknowledging this notice.

Children's data and certain health, biometric, genetic, criminal-record and financial information are subject to additional protection under UU PDP. We do not invite such information through ordinary forms or content features. If sensitive information is lawfully involved in a safety report, payment record or teen Account, additional restrictions and an appropriate lawful basis are required.

This notice is not a substitute for a Creator's own privacy notice, a lawful transfer arrangement or a data-processing agreement.

Account information: name, email, login identifiers, securely protected password credentials where applicable, age or consent information, guardian contact and confirmation where supported, accepted Terms version and acceptance time. Google or Apple may provide identity and account information when you choose that sign-in method.

Creator materials and collaboration: content, images and files; Page and Publication settings; domain and Handle information; Member invitations, names, roles, permissions and collaboration activity. Invitations contain the invited person's email until acceptance, expiry or lawful removal.

Billing and transactions: plan, renewal or cancellation status, discounts and eligibility information, billing country, transaction amount, currency, status, payment type, platform fee and payment reference. Creator order records may include the Buyer's email and details necessary for delivery or settlement. Payment Providers collect full payment credentials under their own notices; Carya does not store full payment-card numbers under this model.

Connections: authorisations or access credentials issued by a connected service, imported materials and relevant connection or action records. An Agent may receive content you authorise it to access. This paragraph applies only to a connection actually offered and enabled by you.

Communications: support correspondence, form messages, Subscriber email and subscription preferences, report location and reason, supporting evidence, optional reporter contact and related investigation records. Reports may contain information about other people; provide only what is necessary and do not attach suspected child-abuse material to ordinary messages.

Device, usage and security information: IP addresses for specified security events; browser and device signals; page and referral information; approximate connection-derived location where used; usage counts; bot-check signals and diagnostic information as described below. These come from interaction with the Service and providers carrying traffic. We treat a pseudonymous value as personal data where it can reasonably be linked to a person, even though it contains no name.

A guest draft is intended to remain on the device until you choose to create an Account and transfer it. Information already published or given to another person may remain in their possession independently of your Carya Account.

Account and requested services. Creating and authenticating an Account, saving and publishing content, administering Members, fulfilling requested connections and delivering operational messages: performance of our agreement with the person concerned, where necessary for that agreement; otherwise an appropriate lawful basis such as legitimate interests assessed against the person's rights. Contract necessity is not applied automatically to a Visitor who has no contract with Carya.

Creator-directed data. Forms, subscriptions and Creator sales information processed only for the Creator: the Creator must identify and document their lawful basis. Carya processes on lawful documented instructions under the data-processing schedule in the Terms. We do not claim the Creator's contract is automatically our own controller basis.

Billing and compliance. Charging Carya's own fees, recording purchases and administering cancellations: contract where necessary. Tax, transaction records, lawful authority requests and mandatory reporting: compliance with applicable legal obligations. Fraud investigation and dispute defence: legitimate interests where lawful and proportionate, or a legal obligation when applicable.

Security. Protecting Accounts, preventing abuse, checking bot traffic and investigating incidents: legitimate interests in a safe, reliable service, balanced against individual rights; legal obligation where a specific duty applies. Special-category or children's data also requires any additional condition or guardian consent required by law.

Product measurement. Understanding use and fixing defects: legitimate interests for proportionate processing that does not override individual rights. Carya's measurement stores nothing on and reads nothing from your device (section 5). If Carya ever adds measurement that does, it will ask for prior consent where the law requires it.

Optional communications. Carya promotional messages: separate consent where required, with unsubscribe and withdrawal controls. Creator newsletters: the Creator's lawful subscription permission. We do not use personal data for targeted advertising or sell it to data brokers.

Consent. When consent is the applicable basis, we request a specific, informed affirmative choice separately from mandatory Terms acceptance and retain an appropriate record. You may withdraw it without affecting earlier lawful processing. Withdrawal stops the affected consent-based use; it does not automatically delete your entire Account or manufacture a new basis for the same use. If a requested feature genuinely cannot be delivered without that processing, we explain the consequence and available alternatives.

Carya's Insights provides Page visit statistics and measures use of Carya's own website. It uses no advertising cookies and does not track visitors across unrelated sites. Neither published Pages nor carya.page store a visit identifier on your device. IP and browser information may be used transiently to form a daily-changing pseudonymous counting value, and the source data is discarded from that calculation. Network and security providers may still process IP addresses in carrying traffic.

The live view of visits to carya.page and to published Pages keeps each visit's approximate city and country, with the location rounded to about ten kilometres, for up to one hour. It keeps no IP address or visitor identifier with them. This is not precise location data. We still treat it as personal data where it can be linked with other reasonably available records.

On published Pages, Insights also counts taps on a Page's own buttons (buy, offer, chat, link and tip buttons) and forms sent, as daily totals by button and by where the visit came from.

On carya.page, measurement may include visited pages, referral origin without query strings, screen width, campaign attribution, interaction or download events and browser/device category.

Because Carya's measurement stores nothing on and reads nothing from your device, Carya does not ask for a cookie choice for it. Retained events that can reasonably be linked to people remain personal data, even where statistical summaries are also produced.

Carya records IP addresses for Account creation, sign-in, publication and reports for 30 days, with routine deletion thereafter. Legal holds or necessary child-safety evidence may require separate restricted preservation. We use such records for security and abuse investigation, not advertising.

Error reports are intended to be minimised, avoiding unnecessary content, credentials and contact details, and deleted 30 days after the relevant error was last observed. We cannot promise that no personal data will ever appear in an unexpected diagnostic event; we minimise, restrict and remove incidental data appropriately.

Operational logs are retained only for justified service and security purposes and no longer than necessary for those purposes or a lawful preservation duty. Contact hello@carya.page for information about the applicable log and provider-retention schedule.

Carya uses Cloudflare Turnstile on protected interactions: sign-up, sign-in, password reset, the report form, Page forms, Buy buttons and password-protected Pages. It processes signals such as IP address, browser information, security characteristics and the site being accessed to distinguish bots from people. Cloudflare says it acts as processor for securing customer sites and as a separate controller when improving its bot-detection capabilities. Its Turnstile Privacy Addendum explains those separate purposes: https://www.cloudflare.com/turnstile-privacy-policy/ .

A failed automated security check may limit an interaction. Contact hello@carya.page if it wrongly prevents legitimate access. Carya does not enable Turnstile's pre-clearance, so Turnstile sets no clearance cookie for Carya (Cookies Policy section 7).

The Creator's notice should identify them, purposes, lawful bases, recipients, relevant transfers, retention and rights. Contact the Creator first about their own use of information you supplied; if you cannot reach them or need help identifying the controller, contact Carya. We assist within our role and cannot disclaim our own duties.

A form may be forwarded to a destination chosen by the Creator. That destination's processing may be independent. A Subscriber can use the unsubscribe facility included in Issue emails; unsubscribing does not necessarily erase a legally needed suppression record. Consent and suppression records must be limited to their purpose.

Creator checkout information is processed through HitPay's Platform API and the Creator's connected sub-merchant account. Transaction and status information supports automatic allocation of the platform commission at the point of sale and direct payment of Creator proceeds to their bank. The platform fee is not collected by invoicing Creators after the sale. Off-platform QR, external shop or messaging payments may be outside Carya's order records. The Provider, seller and purposes must be identified before payment.

Pay by UPI. When a Buyer tells a Creator they have paid the Creator's UPI ID, Carya keeps the contact the Buyer chooses to give (an email address or WhatsApp number) and the UPI reference (UTR) they enter with that order, for the Creator to match and confirm the payment and for telling the Buyer the outcome. They are kept and stripped like other order details under section 12. Carya never receives the payment.

Carya may use reports, automated tools, human review or a combination to assess unlawful or harmful content. This is not a claim that every file, Page, draft, custom domain or delivery route is scanned or that all unlawful content will be detected.

Credible risk may result in temporary restriction or account suspension. Where a country's law requires it, a Page may instead be withheld from Visitors in that country only (Terms sections 9.4, 9.5 and 26.2). Where an automated decision has a legal or similarly significant effect, you may seek human review and exercise any applicable objection or challenge right. Notices and ordinary appeals may be limited where law, child safety or an investigation requires it. A review request does not require restored access to suspected illegal material.

Necessary child-safety information may include reported files, the uploader's Account, IP and activity records, timestamps and report details. It may be preserved with restricted access and disclosed to competent authorities or, where appropriate and lawfully available, NCMEC. Carya discloses it only with a lawful basis and any additional conditions that apply to sensitive data; a report is not permission for unrestricted sharing.

Carya handles child-safety material under a restricted procedure, with a lawful reporting and preservation basis, restricted evidence handling and defined preservation start and end points. A person decides ordinary reviews and appeals, which automated checks may help prepare. Carya acknowledges them within seven business days and decides them within fourteen business days after sufficient information is received, subject to lawful safety exceptions and urgent statutory duties. This does not promise comprehensive scanning or NCMEC account approval.

Carya does not train generative AI models on your content or personal data or sell/license them for that purpose. Automated security tools, including suppliers' independently disclosed security improvement purposes, are not described as a blanket "no AI" policy.

Your external Agent may process the information it is authorised to access under its own provider's terms. Consider its permissions and data practices before connecting it. Carya remains responsible for enforcing its own disclosed access controls.

Public Pages can be read or copied by third parties. Crawler preferences request compliance and cannot bind a third party that ignores them. A restricted Page should not be publicly pictured through a preview contrary to its settings. No confidentiality guarantee is created by making a Page unlisted.

Authorised providers receive only information needed for the relevant service, under appropriate agreements where they act as processors. Carya uses a cloud database provider to store service data in the United States, and a cloud infrastructure provider for hosting, delivery, file storage, email, security and automated safety checks across its network.

Other providers process information in their own roles: HitPay for Creator checkout; Polar, the merchant of record for Carya's Paid Plans, for plan billing; Google and Apple when you choose to sign in with them; and services you choose to connect. When you buy a Paid Plan, the payment form loads a script from Polar's payment processor, which takes your card details in its own frames and checks the payment for fraud using signals such as your IP address, device, browser and how the form is used. When you buy a domain through Carya, the registrant details you enter go to Name.com, Inc., the registrar, and to the registry for that domain, under ICANN's rules; WHOIS privacy is on by default. Turnstile's separate controller purpose is explained in section 6. Connected Agent providers and Creator-chosen form destinations may have independent duties.

Published content is shared with the public according to your settings. Authorised Members may see collaborator information and Page data permitted by their roles. Creators may access the submissions, Subscribers and orders they control.

Disclosures to authorities and other necessary recipients are limited to lawful obligations or another established basis for protecting rights and safety. We assess requests, minimise disclosed data and preserve confidentiality where required. Absolute reporter anonymity cannot be guaranteed against lawful orders.

For a merger, acquisition, restructuring or dissolution involving data, we provide notices before and after the transfer where UU PDP requires, and maintain applicable protections. A successor must establish a lawful basis for any different purpose rather than relying on the old notice alone.

Carya keeps its provider and subprocessor list current with the services and regions actually used. Processor recipients are bound by appropriate arrangements, and additions or replacements follow the notice and objection process in the Terms. Contact hello@carya.page for current recipient and safeguard information.

Information may be processed in Indonesia, in the United States, where Carya's database provider stores it, and in other countries where its infrastructure provider or a service you choose operates. Protection may differ by country. We must establish a lawful transfer mechanism before making a covered transfer.

Under UU PDP Article 56, the assessment follows this order: an equivalent or higher level of protection in the recipient country; if not satisfied, adequate binding protection; and only if neither preceding condition is satisfied, the individual's consent. Consent is not the default substitute for assessing protection.

Contractual safeguards may include appropriate binding provider DPAs and transfer terms. Where GDPR/UK GDPR requires them, the applicable approved Standard Contractual Clauses, UK Addendum or IDTA, any required assessment and supplementary measures must cover the actual exporting/importing parties, roles and transfers. Merely linking a vendor DPA does not establish that Carya has entered or can rely on it.

Carya puts the applicable safeguards in place for each transfer before it takes place. Contact hello@carya.page for the basis and safeguards applicable to your data.

Carya's providers store your data in the United States and, for hosting, delivery and security, handle it in data centres around the world. This is how Carya runs your Account. Carya doesn't ask for your consent to it; it relies on the second route in section 11.2. Each of these providers is bound by written data processing terms with Carya: they act only on Carya's instructions, keep your data confidential and secure, report incidents to Carya and delete your data when their service ends. For data from the EU, EEA, Switzerland and the UK, those terms include the European Commission's standard contractual clauses and the UK addendum, or the provider is certified under the EU–US Data Privacy Framework. The risk is that the United States has no general data protection law like Indonesia's, and its authorities can sometimes require a provider to hand over data. Carya limits that by giving each provider only what its service needs and by protecting your data as section 15 describes. Accepting the Terms isn't consent to this transfer. You can ask which safeguards apply to your data (section 11.6), or delete your Account at any time (section 12).

Contact hello@carya.page to request information about the safeguards applicable to your data, including an appropriate copy or explanation subject to lawful confidentiality redactions.

Routine Account information and content are kept while needed to provide the Account. When you delete your Account, your owned Pages go offline at once and a 14-day restoration period starts; final routine deletion follows unless a legally required shorter deadline or a lawful retention duty applies. Deleting a single Page is immediate, after you confirm it. Collaborator content on another owner's Page is not automatically erased by deleting the collaborator's Account.

Security-event IP records: 30 days ordinarily. Error reports: 30 days after the error was last observed. Approximate live-view location: up to one hour. These schedules do not authorise a separate provider's retention beyond its lawful role.

Forms and Subscriber lists: until removed on lawful Creator instructions, the relevant Page/Publication closes or the data is otherwise no longer needed, subject to required consent/suppression records and legal exceptions. Identifying data must not be kept indefinitely because a count or statistical summary remains useful.

Routine order records are kept for up to 30 days after Page deletion to settle late payment updates, then unnecessary buyer contact/details are stripped; final Account deletion also strips those routine details. Amount, fee and payment reference may remain in accounting records. Legally required fields are retained separately under section 12.5.

Mandatory records: statutory transaction, tax, accounting, authority-preservation and litigation records are kept only for the required or justified period, with access and use limited accordingly. Where Indonesia's e-commerce rules (PP 80/2019) apply, financial records are kept for at least ten years and other required records for at least five years. The routine 30-day stripping of buyer details never removes records the law requires. Ordinary visitor events are not kept for those periods.

Child-safety evidence: necessary content and associated Account/activity evidence may be preserved in restricted access for approximately one year from the applicable preservation trigger, or another legally required period or continuing legal hold. It is not available for ordinary user download or publication. Evidence preservation and release/deletion require a lawful basis and defined start/end triggers.

Disconnected-service credentials are removed or revoked when no longer needed, subject to justified security records. Deleted Handles are ordinarily reserved for 30 days; safety or legal restrictions may remain longer.

Backups are not a separate purpose for indefinite retention. Routine deleted data expires through an established maximum overwrite schedule and must not be restored for ordinary use without reapplying deletion. Support, report, consent, suppression, log and financial records are limited to their justified purpose and applicable legal period. Contact hello@carya.page for the schedule applicable to a particular record.

Retention may be restricted instead of deleted where a legal obligation or a valid legal claim requires preservation. We explain the applicable exception when responding to a rights request where law permits.

Subject to lawful conditions and exceptions, you may obtain information about processing; access and copy your data; correct or complete it; request deletion/destruction, restriction or suspension; withdraw consent; receive data in an applicable machine-readable form or request portability; challenge qualifying solely automated decisions; and claim compensation where the law provides.

Where GDPR/UK GDPR applies, you may also object to processing based on legitimate interests, including related profiling, and object to direct marketing at any time. We must stop direct marketing on objection. Other objections are assessed under the applicable legal test; a request is not rejected merely because processing is convenient for Carya.

Use available Account settings/export tools or hello@carya.page. If an automated export fails or omits older information, request assistance; it does not limit your right to a complete legally required response. We may request proportionate information to verify identity without collecting unnecessary new data.

UU PDP specifically requires access and correction within 3 x 24 hours after receipt of the respective request (Articles 30 and 32), and cessation after consent withdrawal or applicable suspension/restriction within 3 x 24 hours (Articles 40 and 41), subject to lawful exceptions. Where GDPR/UK GDPR applies, we respond without undue delay and normally within one month; a lawful extension up to two further months must be explained within the initial month. A longer GDPR allowance does not displace a shorter applicable Indonesian duty.

We will explain any lawful refusal or limit, and available complaint routes. Where Carya is processor, the Creator leads the response and Carya assists; Carya still handles its own controller information directly. Requests must not be postponed indefinitely because a Paid Plan remains active.

You may complain to the competent Indonesian personal-data authority and, where GDPR/UK GDPR applies, to the competent EEA supervisory authority or the UK Information Commissioner's Office. Contact hello@carya.page for assistance identifying the applicable complaint channel. This does not prevent other legal remedies.

Account, Member and managed subscription features are not intended for children under 13. A person aged 13 to 17 needs a parent's or guardian's consent: at sign-up Carya asks for the parent's or guardian's email address and sends them a confirmation link, and until they confirm, the Account can make drafts but cannot publish. Any higher local age threshold or mandatory consent rule also applies. Selling, connecting payment accounts and buying Paid Plans are for people aged 18 or older.

The guardian confirmation records the guardian's email address and the time of confirmation. An entered email address alone is not treated as verified consent in every case, and Carya may ask for further proportionate confirmation of the guardian's authority.

Parents or guardians can contact hello@carya.page for review, access, consent withdrawal or deletion. If we discover a user below the minimum age, we restrict the relevant feature and address deletion or legally required preservation. Incidental viewing of a public Page is not treated as a child's consent to marketing or financial activity.

Children's-data processing must meet UU PDP Article 25 and, where applicable, GDPR Article 8 and UK children's-design requirements. Applicable age/guardian checks and guardian rights processes cover Account holders, Members and Subscribers as relevant. The free-feature age rule does not waive statutory children's-data safeguards.

We use technical and organisational safeguards appropriate to the data and risk, including controlled access, secure credential handling, protected transmission, permission controls and incident response. No system is perfectly secure; report concerns promptly to hello@carya.page.

Carya maintains privacy accountability through an accountable contact, processing records, vendor and transfer assessments, appropriate high-risk impact assessments and access procedures. A formal DPO or regional representative is appointed and identified where legally required. Contact hello@carya.page for the contact applicable to your processing.

If a failure of personal-data protection requiring notice under UU PDP occurs, Carya will notify affected individuals and the competent authority in writing within the statutory 3 x 24-hour period. Carya's operational target is to notify within 72 hours of awareness, without suggesting that this wording lengthens any statutory clock.

The notice will describe the affected data, when and how the failure occurred and response/recovery measures, with contact information and practical protective steps where appropriate. Public notice will be given where required. Further information may follow as the investigation develops.

Where Carya acts as processor, it notifies the Creator without undue delay and assists with the Creator's obligations. Where GDPR/UK GDPR applies, applicable authority notification, risk thresholds, reasons for any delay and notice to affected people where high risk exists must also be addressed. These conditions do not weaken a broader Indonesian notification requirement.

Carya keeps an incident procedure with an accountable owner, an escalation route, statutory clock tracking, authority contacts, notification templates and records.

Service messages may include authentication, invitations, billing, guardian confirmation, security, rights-request and policy notices. Necessary legal or transactional messages may continue after marketing unsubscribe, but may not be repurposed as promotional messages without the required permission.

Carya marketing needs a lawful basis and separate consent where required, with easy unsubscribe. Issue messages are sent on the Creator's behalf with an unsubscribe facility. Creators may not use Account-service communications to evade Subscriber choices.

The Cookies Policy describes sign-in storage, selected preferences, draft storage, page-unlock cookies and bot protection. It covers cookies and similar technologies, not cookies alone. Carya uses device storage only for features you use and asks first, where the law requires, before adding any optional use.

External embeds can send information to their provider as soon as they load. On published Pages, Carya's embeds request nothing from the embedded service until the Visitor clicks to load it.

The effective date is publication. Non-material updates may take effect at any time on publication. Carya gives affected Account holders at least thirty days' direct advance notice of material policy changes, with separate consent for any new consent-based purpose. Binding requirements that lawfully require earlier changes take priority to the extent required. Silence or mere continued use is not consent. Changes apply prospectively and cannot retrospectively legitimise unlawful processing.

The Terms' notice process applies to material contractual policy changes; this notice explains processing and does not waive rights. A legally reviewed Bahasa Indonesia translation will be published alongside English, aligned with its meaning and any mandatory language requirements.

Privacy requests and concerns: hello@carya.page. Safety: safety@carya.page. Operator: PT Solusi Akal Imitasi, Yogyakarta, Indonesia.

Carya publishes working correspondence and privacy-officer details, and any EEA/UK representative it is required to appoint, in its contact information.