Privacy Policy

1. Scope & Covered Domains

ALTIA DEV ("we", "our", or "us") operates digital software engineering services, consulting solutions, and custom software platforms. This Privacy Policy applies to personal data collected across all ALTIA DEV online assets, specifically including:

• Our primary promotional and studio website: https://altia.dev
• All affiliated client portals, web applications, dashboards, API services, and staging environments operating under subdomains (including *.altia.dev)
• Interactive features, such as our project inquiry forms and instant project estimators
• Single Sign-On (SSO) and third-party authentication services integrated into our applications

By visiting our website, submitting your details via any of our forms, or signing in to any of our subdomain portals, you acknowledge the terms described in this Privacy Policy.

2. Information We Collect

We only gather personal information when there is a clear, legitimate operational purpose. The data collected falls into three categories:

A. Information Provided via Website Forms

• Contact & Discovery Form (altia.dev/contact): Your name, business email address, selected service domain (Web, Mobile/Desktop App, AI Automation), estimated budget tier, and project brief.
• Project Estimator Wizard (altia.dev/estimator): Your name, email, phone / WhatsApp number, company name, selected architectural features, and timeline specifications.

B. Information Collected via Authentication (Google Sign-In)

For client portals and specialized software tools hosted on our subdomains (such as *.altia.dev), we offer authentication via Google OAuth 2.0. We request only the basic identity scopes:

• Unique Google Identifier (sub): An immutable token used to securely link your login session with your user account.
• Primary Email Address: Used for account identity, service access validation, and transactional notifications.
• Full Name & Given Name: Used to display your name across the application dashboard.
• Profile Picture URL: Used strictly to display your user avatar within the platform interface.

Important Notice: We do not request, access, or store your Google account password, contact lists, calendar events, Google Drive documents, or any sensitive scopes beyond basic profile identification.

C. Technical & Diagnostic Information

• System Logs: IP address, browser type and version, device category, referring URLs, operating system, and timestamp of requests.
• Security Diagnostics: Rate-limit counters, firewall challenge records, and runtime error logs to prevent unauthorized access.

3. Google Sign-In & Third-Party Authentication

Our subdomain applications provide a streamlined "Sign in with Google" button. When you authorize access:

1. You are redirected securely to Google's official OAuth consent screen.
2. Google authenticates your credentials directly on their secure servers; we never see or handle your password.
3. Upon your consent, Google issues a secure cryptographic token returning your basic profile details (Name, Email, Google User ID, Avatar).
4. Our backend verifies this token, registers or logs you into the subdomain application, and creates a cryptographically signed session cookie.

4. Google API Services User Data Policy Compliance (Limited Use)

In accordance with the Google Limited Use specifications, we adhere to the following strict guidelines:

• No Commercial Sale: We never sell, license, rent, or trade Google user data to third-party data brokers, marketing firms, or advertising networks.
• No Advertising Use: We do not use or transfer Google user data for serving advertisements, including retargeting, interest-based, or personalized advertisements.
• No Generalized AI Training: We do not use Google user data to train, fine-tune, or validate generalized artificial intelligence (AI) or machine learning (ML) models.
• Restricted Human Inspection: No human is permitted to read Google user data unless:
  1. You provide explicit, affirmative consent for technical troubleshooting of a specific issue;
  2. It is necessary for security purposes (such as diagnosing abuse or investigating security incidents);
  3. Required to comply with applicable statutory laws; or
  4. The data is aggregated and anonymized for internal performance metrics.

5. How We Use Your Information

Your information is processed strictly for legitimate business and technical operations:

• Authentication & Account Management: Validating identity, issuing secure sessions, and maintaining accounts across subdomain portals.
• Responding to Inquiries: Reviewing project briefs submitted via our contact forms and preparing architectural proposals.
• Project Estimator Processing: Calculating scope complexity, scheduling discovery calls, and providing technical estimates.
• Platform Security: Detecting bot abuse, preventing brute-force login attempts, and maintaining server integrity.
• Service Notifications: Sending critical administrative updates, security notices, or project milestone reports.

6. Third-Party Service Providers & Subprocessors

We do not sell personal data. To provide high-availability digital solutions, we rely on established third-party infrastructure providers who process data under confidentiality agreements:

7. Data Security Measures

We implement modern, industry-recognized technical and organizational controls to protect your data:

• Transport Layer Security: All data transmitted between your browser, altia.dev, and our subdomains is encrypted via modern TLS 1.3.
• Session Protection: Authentication tokens are stored using HTTP-only, secure, same-site cookies to mitigate cross-site scripting (XSS) and CSRF attacks.
• Access Control: Administrative and database access requires multi-factor authentication (MFA) and strict role-based access controls (RBAC).

8. Data Retention & User Data Deletion

We retain personal information only for the duration required to satisfy the purposes outlined in this policy:

• Website Form Inquiries: Stored for the duration of the business relationship or project scoping cycle. Inactive inquiries are purged periodically.
• Application Accounts: Retained as long as your account remains active on our subdomain platforms.

How to Delete Your Data or Revoke Google Access:

* All verified deletion requests are executed across our active production databases within 30 days of receipt.

9. Your Privacy Rights

In compliance with global standards and Indonesia's Personal Data Protection Law (Undang-Undang No. 27 Tahun 2022 tentang Perlindungan Data Pribadi / UU PDP), you have the right to:

• Request confirmation of whether we process your personal data.
• Access and obtain an electronic copy of personal data associated with your account.
• Request rectification of inaccurate, incomplete, or out-of-date information.
• Request the permanent erasure or anonymization of your data.
• Withdraw consent previously granted for data processing without prejudice.

To exercise any of these statutory rights, please write to us at hello@altia.dev.

10. Cookies & Tracking Technologies

We believe in privacy by default. We do not employ invasive third-party cross-site advertising cookies, behavioral tracking pixels, or data profiling tools.

We only use essential session cookies and local storage strictly necessary to:

• Maintain your authenticated login state when browsing subdomain applications
• Store CSRF tokens to safeguard form submissions against cross-site forged requests
• Remember your preferred language locale (English or Indonesian)

11. Contact & Legal Entity

If you have inquiries, complaints, or feedback regarding this Privacy Policy, our data handling practices, or Google OAuth integration, please contact our privacy representative: