Privacy Policy
Personal Data Protection & Processing Charter for RUMREN ID
Your personal data privacy and security are our foremost commitments. This Privacy Policy document transparently explains how the RUMREN ID Ecosystem collects, manages, processes, and protects your personal information in compliance with applicable Personal Data Protection statutory regulations.
1. Legal Basis & Privacy Commitment
The RUMREN Unified Ecosystem is fully committed to upholding the privacy and confidentiality of every User's data. Personal data processing within our platform is governed by principles of lawfulness, fairness, transparency, and purpose limitation in accordance with applicable laws.
1.1 Regulatory Foundation (PDP Law No. 27/2022)
This policy is formulated pursuant to the Republic of Indonesia Law Number 27 of 2022 concerning Personal Data Protection (UU PDP) and implementing regulations governing electronic systems and transactions (PP PSTE).
1.2 Roles as Data Controller & Data Processor
In platform operations, RUMREN acts as the Personal Data Controller (Data Controller) for your SSO account credentials, and as a Personal Data Processor (Data Processor) when handling self-recorded entries stored in application modules (such as Monifi or RUMREN Bio).
1.3 Explicit User Consent
By registering an account, performing SSO authentication, or using affiliated applications, you provide valid, conscious, and explicit consent to collect and process your data within the framework defined in this policy.
2. Categories of Personal Data Collected
We only collect personal data that is relevant, proportionate, and strictly necessary to ensure functional platform operation, account security, and transaction fulfillment.
2.1 SSO Account Identity Data
Includes: Full name, email address, telephone/WhatsApp number, Username, Telegram User ID (if connected), profile avatar photo, and email verification status.
2.2 Activity Data & Financial Records
Includes: Stars purchase transaction history, credit balances, Store license redemptions, and self-recorded income/expense records inputted into the Monifi module.
2.3 Technical Logs, Device & Network Data
Includes: IP (Internet Protocol) address, browser type and version, operating system, device identifiers (Device ID/User-Agent), time zone, and authentication timestamp logs.
2.4 Bot Interactions & AI Prompts
Includes: Command text or prompt queries submitted to AI assistant modules or the official Telegram Bot, utilized solely to generate real-time computational responses.
3. Purposes & Legal Bases of Data Processing
Processing of User personal data is carried out based on contractual necessity, legal obligations, and legitimate interests for the following purposes:
3.1 Service Provision & Unified Authentication
Validating SSO login credentials, synchronizing licenses across ecosystem applications (Monifi, RUMREN Bio, etc.), and dispatching OTP verification codes for transaction security.
3.2 Financial Processing & Stars Allocations
Verifying payment invoices, crediting Stars balances, executing AI quota deductions, and recording official digital audit logs.
3.3 System Security & Fraud Prevention
Detecting login anomalies, mitigating brute-force attacks, preventing malicious botnet abuse, and investigating suspected legal violations or system tampering.
3.4 Operational Communications & Essential Notifications
Delivering invoice notices, security updates, scheduled maintenance advisories, and responses to User customer support inquiries.
4. Storage, Security & Liability Boundaries
RUMREN implements industry-standard technical security measures to protect the integrity of user data housed on our servers.
4.1 Encryption Standards & Security Procedures
Data transmission is protected via 256-bit SSL/TLS encryption, and passwords are hashed using modern cryptographic algorithms. Internal access to databases is strictly restricted to authorized system maintenance personnel.
4.2 Disclaimer for Third-Party Cyber Attacks
While RUMREN maintains rigorous defense protocols, no transmission across the Internet is completely immune to sophisticated zero-day exploits. Provided RUMREN has maintained reasonable security procedures, RUMREN is fully released from civil liability claims arising from third-party criminal breaches or credential compromises on the User's personal device.
4.3 Mandatory 5-Year Compliance Retention
Financial transaction data, invoices, and access audit logs must be retained by RUMREN for a minimum of 5 (five) years under tax and Anti-Money Laundering regulations of the Republic of Indonesia, and cannot be destroyed prior to expiration of this statutory period.
5. Data Disclosure & Third-Party Sharing
RUMREN NEVER sells, leases, or trades your personal information to third parties for external marketing purposes. Data disclosure occurs solely under the following limited circumstances:
5.1 Payment Gateway Processing Partners
Transaction parameters (such as billing amounts, invoice IDs, and customer email addresses) are transmitted to licensed payment gateway partners (iPaymu / QRIS) for instant authorization and payment reconciliation.
5.2 Cloud Infrastructure & Messaging Providers
We utilize enterprise cloud hosting providers and official Telegram / SMTP Email APIs to deliver OTP verification codes, support tickets, and system notices requested by Users.
5.3 Law Enforcement & Legal Process
We may disclose limited User data when compelled by a valid court order, lawful subpoena, or formal warrant issued by authorized law enforcement agencies (Police, Prosecution, KPK) or regulatory authorities in Indonesia under the Electronic Information and Transactions Law (UU ITE) and PDP Law.
6. Data Subject Rights & Erasure Exceptions
RUMREN respects User privacy rights pursuant to PDP Law No. 27/2022 subject to statutory constraints protecting operational integrity.
6.1 Right to Access & Self-Service Correction
Users may review and update their profile records independently via the RUMREN SSO account settings dashboard.
6.2 Exceptions to Data Erasure Requests
Requests for data deletion (Right to be Forgotten) do not apply and may be lawfully declined by RUMREN if records are required for: (a) Tax audit compliance and banking statutory mandates; (b) Evidentiary requirements in ongoing legal proceedings; or (c) Maintaining permanent blacklists of accounts flagged for fraudulent activities.
6.3 Anonymized & Aggregate Data for AI Development
Data rendered strictly anonymous (stripped of all personal identifiers) may be freely utilized indefinitely by RUMREN for platform research, market metrics, and artificial intelligence (AI) model training without obligation to pay royalties or compensation to Users.
7. Cookie Policy & SSO Session Tokens
The RUMREN platform utilizes technical cookies and encrypted session tokens to administer user authentication and optimize interface performance.
7.1 Essential Cookies (Authentication & SSO)
These cookies are strictly necessary to allow you to log in and navigate seamlessly across ecosystem modules without re-entering credentials. They are secured with HttpOnly and SameSite=Lax flags to protect against XSS and CSRF attacks.
7.2 Interface Preference Cookies
Used to remember UI configurations such as theme preferences (Dark Mode / Light Mode), language settings, and navigation layout options across sessions.
7.3 User Cookie Controls
You may manage or clear cookies through your browser settings. However, disabling essential cookies will prevent authentication and SSO token synchronization from functioning properly.
8. Data Protection Officer (DPO) & Policy Updates
RUMREN provides dedicated communication channels for Users to submit inquiries, report suspected data breaches, or request the exercise of data subject rights.
8.1 Official Data Protection Officer (DPO) Inquiries
Data subject requests or privacy policy inquiries may be lodged via formal support tickets at the RUMREN Support Center designated under "Data Protection Officer (DPO) Request".
8.2 Security Incident Notification Protocol
In the event of a verified personal data breach impacting Users significantly, RUMREN commits to providing written notice within a maximum of 3x24 hours to affected Users and relevant regulatory authorities as required under the PDP Law.
8.3 Amendments to Privacy Policy
We may update this Privacy Policy periodically. Substantial changes will be communicated through member portal announcements, with the effective date at the top of this document updated accordingly.