Privacy Policy.

PT Nalar Teknologi Nusantara (“Nalar”, “we”, “us”) operates the website nalarx.com and the Nalar product. We are the data controller (pengendali data pribadi) for the personal data described in this policy.

• Registered address: Soho Capital, Lantai 19, Jl. Letjen S. Parman Kav. 28, Tanjung Duren Selatan, Grogol Petamburan, Jakarta Barat 11470
• Email: hello@nalarx.com

We only collect what you give us through one of our forms, plus a small amount of technical information that comes with any web request. We do not buy personal data from third parties.

When you request closed beta access

Submitted through the form at nalarx.com/beta:

• Your name and work email address
• Your company name
• Your WhatsApp number (optional)
• Your role, your industry, your company size, your annual revenue band, and when you want to start
• Which systems your company runs on today (optional)
• A free-text note about what you would want Nalar to run first (optional)

When you complete the BARI diagnostic

BARI is our Business AI Readiness Index assessment. If you complete it and ask for the report, we collect:

• Your name, email address and WhatsApp number
• Your business name, your role, and a description of your business
• Business profile answers: business model, how long the business has run, monthly revenue band, number of branches, number of decision makers, main pain point, and your Instagram handle if you give one
• Your answers to the assessment questions, including the free-text ones
• The readiness score and tier those answers produce
• Your language preference (English or Indonesian)

Collected automatically

• Your browser's user-agent string and the page that referred you, recorded alongside a form submission so we can tell where a request came from and debug broken submissions
• Your IP address, used only in memory to rate-limit abuse of our forms. It is not written to our database.
• Aggregate page-view counts through Vercel Analytics — see section 9

Stored in your browser, not by us

The BARI assessment saves your in-progress answers in your browser so a reload does not lose your work, and parts of the product remember layout preferences the same way. This stays on your device. Clearing your browser data, or using the restart control in the assessment, removes it.

We do not ask for specific personal data (data pribadi yang bersifat spesifik under UU PDP) such as health, biometric, genetic, financial account or religious information, and you should not put it into the free-text fields.

• To review your closed beta request, decide on it, and set up your workspace
• To generate your BARI report and email it to you
• To contact you about your request or your report — by email, or by WhatsApp if you gave us a number
• To understand, in aggregate, who is asking for Nalar and what they need, so we can prioritise what we build
• To keep the site working, investigate problems, and protect our forms from abuse
• To meet legal obligations that apply to us

We do not sell your personal data, and we do not use it for third-party advertising or ad targeting.

Under Article 20 of UU PDP, we rely on:

• Your consent — you give it by choosing to submit one of our forms. Every field marked optional can be left blank, and you can decline to submit at all.
• Steps taken at your request before entering an agreement — evaluating your beta request and setting up your access.
• Our legitimate interests — securing the site and understanding demand for the product, weighed against your rights and interests.
• Legal obligation, where a law requires us to process or retain something.

We do not sell or rent personal data. We use a small number of service providers that process data on our instructions and are bound by contractual data-protection terms:

• Supabase — our database. Beta requests and BARI results are stored here.
• Vercel — hosting. Serves the website, runs the code behind our forms, and provides the aggregate analytics described in section 9.
• Anthropic— AI processing. When you complete BARI, your assessment answers and business description are sent to Anthropic’s API to write the narrative part of your report.
• Resend — email delivery. Used to send your BARI report to your email address.

We may also disclose personal data where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim. If our business is ever reorganised, merged or acquired, data may transfer to the successor entity, which would remain bound by this policy.

The providers named in section 5 operate outside Indonesia, so your personal data is transferred and processed abroad. Consistent with the international transfer requirements of UU PDP, we only use providers that offer an adequate level of protection and we put contractual data-protection terms in place with them. If you would like more detail on a specific transfer, email hello@nalarx.com.

• Beta requests — for as long as your request is open and while we are in contact with you about Nalar.
• BARI results — for as long as we may need to resend your report or follow up with you about it.
• In both cases we review records that have had no contact for 24 months and delete those we no longer need.
• We delete sooner if you ask us to — see section 8.

Copies may persist briefly in routine backups after deletion and are removed as those backups age out.

Under UU PDP you have the right to:

• Be told what personal data we hold about you and how we use it
• Access it, and get a copy
• Correct or update it if it is wrong or out of date
• Have it deleted or destroyed
• Withdraw a consent you previously gave
• Object to processing, including to decisions made solely by automated means
• Ask us to restrict or delay processing
• Receive your data in a usable format and have it transferred to another controller where technically feasible

How to exercise them: email hello@nalarx.com from the address you gave us, and tell us what you want. If we cannot tell it is you, we may ask for something more to verify your identity before we act — we do this to stop someone else reaching your data. We will respond as quickly as we can, and within 30 days at the latest. There is no charge.

Withdrawing consent stops future processing, but does not make processing we already carried out unlawful. Some requests may be limited where a law requires us to keep a record.

We do not use advertising cookies or cross-site tracking cookies, and we do not run third-party ad pixels.

We use Vercel Analytics to count page views and see which pages are used. It is cookie-less and does not build a cross-site profile of you as an individual; we see aggregate numbers, not a browsing history tied to a person.

Separately, the site stores a few things in your browser’s local storage — your in-progress BARI answers and some interface preferences. These are not cookies, are not sent to advertisers, and you can clear them at any time through your browser settings.

We take reasonable technical and organisational measures to protect personal data: traffic is encrypted in transit over HTTPS, access to the database is restricted, our forms are rate-limited against abuse, and we deliberately keep personal data out of our application logs.

No system is perfectly secure. If a personal data breach affecting you occurs, we will notify you and the relevant authority as required by UU PDP, within the timeframe the law sets.

Nalar is a product for businesses and is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email hello@nalarx.com and we will delete it.

If we change this policy we will update this page and change the “Last updated” date at the top. If a change materially affects how we handle your personal data, we will give you notice before it takes effect — by email where we hold your address, or through a notice on the site. Continuing to use Nalar after a change takes effect means you accept the updated policy.

For anything about this policy or your personal data, email hello@nalarx.com, or write to us at Soho Capital, Lantai 19, Jl. Letjen S. Parman Kav. 28, Tanjung Duren Selatan, Grogol Petamburan, Jakarta Barat 11470.

We would rather hear from you first and put it right. If you are not satisfied with how we handle your request, you may lodge a complaint with the competent personal data protection authority in Indonesia.