LEGAL
Privacy Policy
This page explains what happens to personal data when you visit foxible.palanda.app, email us, message us on WhatsApp, or send the contact form. It is written to be read once and understood.
We collect very little. There are no visitor accounts, no newsletter, no advertising pixels, and no data sold to anyone.
Who we are
FOXIBLE™ is a website design and development studio. We work remotely from Indonesia, and the studio is run by Devan Palanda.
For data protection purposes, FOXIBLE is the controller of the personal data described here. We decide why and how it is used, and we are the ones you contact about it.
Email hello@foxible.com for anything in this policy. Job applications go to talent@foxible.com.
What we collect
Only a few kinds of data reach us, and each one comes from something you chose to do.
- When you contact us, by email, on WhatsApp, or through the form on our contact page: your name, your email address, the subject and the message you send, plus any attachment you add.
- Email metadata. Our mailbox provider records delivery details such as the time a message arrived and the address it came from.
- WhatsApp data. If you message us there, we see your phone number, your WhatsApp profile name and the conversation. WhatsApp is operated by Meta, and what happens inside that app is also covered by their privacy terms.
- Technical data in server logs. When a page is requested, our host records the IP address, the browser and operating system, the URL requested and the time. We use this to keep the site online and to spot abuse.
- Aggregated analytics, only if you allow them. Page views, referrer, country and device type. These are counts, not profiles, and they are not linked to you as a person.
We do not ask for sensitive data and do not want it: health information, biometrics, religious or political views, or bank account numbers. Please leave those out of your first message.
Why we use it, and on what legal basis
Every purpose below has a legal basis. Under the Indonesian PDP Law (UU No. 27/2022) and, where it applies, the GDPR, we rely on the following.
| What we do | Why | Legal basis |
|---|---|---|
| Reply to your enquiry and discuss a project | You asked a question, we answer it | Contract, or steps taken at your request before a contract |
| Keep the site online and secure | Server logs, rate limits, firewall rules | Legitimate interests: running a working, safe website |
| Measure traffic with analytics | To know which pages are useful | Consent, which you can withdraw at any time |
| Keep invoices and project records | Accounting and tax rules for client work | Legal obligation |
| Consider job applications | You sent us your CV | Consent, or steps taken before a contract |
Where we rely on legitimate interests, the processing stays narrow: security logs, and nothing that builds a profile of you.
Cookies and analytics
We set one cookie, for the studio's own login at /admin. Visitors never receive it. Your cookie choice is stored in your browser, not on our server.
Analytics are off until you turn them on. When you do, we load Vercel Web Analytics and Speed Insights, served from our own domain. They measure page views and loading performance in aggregate, without cookies and without identifiers that follow you to other sites.
The full list of cookies and storage entries, with durations and how to change your choice, is in our Cookie Policy: /cookies
Who we share it with
We do not sell personal data, and we do not share it for advertising.
- Vercel. Our host and CDN. It serves the site, keeps request logs and runs the analytics you can opt into. Vercel processes this data on our instructions.
- Our email provider. The service that runs the hello@ and talent@ mailboxes stores and delivers the messages you send.
- WhatsApp (Meta). Only if you choose to message us there. The conversation is processed under WhatsApp's own terms before it reaches us.
- Authorities. Where a valid legal request requires it, or to defend a legal claim.
Photographs on this site are optimised and served from foxible.palanda.app. The original files come from Unsplash and Imgur, which our host fetches on our behalf, so your browser does not connect to those sites.
International transfers
We are in Indonesia. Vercel runs a global edge network, and our email provider may store messages outside Indonesia. Your data can therefore be processed in another country.
When data leaves Indonesia, we transfer it with the safeguards the PDP Law requires for cross-border transfers. When it leaves the EEA or the UK, we rely on the Standard Contractual Clauses in our agreement with the provider. You can ask for a copy of those terms.
How long we keep it
Data stays only while it has a purpose.
| Data | How long |
|---|---|
| Enquiries that did not lead to a project | 24 months from the last message, then deleted |
| Client project correspondence | For the project, then up to 24 months after handover |
| Invoices and accounting records | 10 years, as Indonesian tax rules require |
| Server logs | Rolling window at our host, no longer than 30 days |
| Aggregated analytics | Up to 14 months, then cleared |
| Cookie consent record (foxible-consent) | 12 months, after which we ask again |
| Job applications | 12 months, unless you ask us to keep them longer |
If you ask us to delete something earlier, we do, unless a legal obligation requires us to keep it.
Your rights
You can ask us to do any of the following. We answer within 30 days.
- Confirm whether we hold personal data about you, and give you a copy.
- Correct anything that is wrong or incomplete.
- Delete it, where we no longer have a lawful reason to keep it.
- Send you the data you gave us in a portable format.
- Restrict how we use it, or object to processing based on legitimate interests.
- Withdraw consent for analytics at any time. This does not affect what happened before you withdrew.
Write to hello@foxible.com and say what you want. We may ask one or two questions to confirm the request is really yours.
Indonesia, the EEA and the UK
If you are in Indonesia, these rights come from UU No. 27/2022 on Personal Data Protection. The PDP Law also gives you the right to be informed about how your data is used, to withdraw consent, and to claim compensation for a violation of your rights.
If you are in the EEA, your rights come from the GDPR. In the UK, from the UK GDPR. They cover the same ground, with the same 30-day response period.
If you think we got it wrong, tell us first. We would rather fix it. You can also complain to the Indonesian personal data protection supervisory authority. In the EEA, complain to your national data protection authority. In the UK, to the Information Commissioner's Office at ico.org.uk.
How we protect it
The site runs over HTTPS with HSTS and sends a strict Content Security Policy. The admin session lives in an httpOnly, SameSite=Strict cookie that is Secure in production, and login attempts are locked after five failures.
We hold little data, in few places. That is deliberate: the safest record is the one we never created.
No system is perfect. If a breach affects your data, we notify you and the relevant authority as the law requires.
Children
This site is not aimed at children. We do not knowingly collect personal data from anyone under 18, the age of consent for data processing under the PDP Law.
If you believe a child has sent us personal data, write to hello@foxible.com and we will delete it.
Changes to this policy
When this policy changes, we update the date at the top of the page. If the change is significant, we say what changed on the page instead of quietly editing a paragraph.
Earlier versions are available on request.
Contact
FOXIBLE, Indonesia. Email hello@foxible.com.
For anything about this policy, a data request or a complaint, use that address with “privacy” in the subject. We reply within two working days and resolve requests within 30 days.
The rules for using this site are in /terms, and the cookie detail is in /cookies.
