Privacy Policy
This policy explains what personal data Officeverse collects and stores, why, who else handles it, how long it is kept, and how you can use your rights under Indonesia's Personal Data Protection Law (UU PDP, No. 27 of 2022) and, where it applies, the GDPR.
Last updated: 22 October 2026
1. Who is responsible
Officeverse is operated by Renaldi Pranata, an individual, in Indonesia. He is the controller of the personal data described in this policy where the policy says so. For anything about your personal data, write to support@officeverse.id.
This policy covers the public website at officeverse.id and the hosted offices at https://<name>.officeverse.id.
The Terms of Service describe the service itself.
2. Our role and your role
- Office content. What you and your agents put into an office (chats, files, meetings, memory and the like) is your working data. For it, you are the controller and Officeverse is the processor: we store and process it only to run the office for you.
- Waitlist, account and billing records. For the waitlist, the sign-in records that tie a person to an office and records about plans and payments, Officeverse is the controller.
If you put other people's personal data into an office, for example a colleague's or a customer's contact details, you are responsible for having a lawful basis to do so.
3. What we collect
The table lists everything the product collects about people, where it comes from, why, and how long it is kept. It is based on what the software actually stores. Retention in more detail is in section 8.
| What | Where it comes from | Why | How long |
|---|---|---|---|
| Waitlist and beta signup. Email, optional company, optional team size, optional plan interest, whether you want the beta, source, and time of signup. | You, on the form at officeverse.id. | To keep a waitlist, invite people to the beta, and send our operator a notification email about each signup. | Until you ask us to remove it, or until we no longer need it for the invitation. |
| Sign-in for hosted offices. A user ID and the sign-in details held for it, such as the email address, the office it belongs to and its role. | You, when the office owner account is created. | To tie a person to an office and its plan. | While the office exists. |
| Office accounts. Username, a one-way hash of the password (Argon2id), time of creation, time of last sign-in, and a disabled flag. Where an email address has been added to the account, that too: it is used only to send that person's invitation and password-reset mail, and as an alternative to the username at sign-in. | You, or the owner or admin who creates your account. | To let you sign in to the office. | While the account exists in the office. |
| People profiles. Name, form of address, language, time zone, role, contact channels (which may include a Telegram or WhatsApp address), desk, appearance, and the last position of your character in the office. | You, and the owner or admin of the office. | To show who is in the office and to route messages and approvals to the right person. | While the person exists in the office. |
| Sessions. A hash of the session token, the person, creation, expiry and last-seen times, and the first 200 characters of your browser's description of itself (the user-agent). Password-reset and invitation tokens are stored hashed too. | Your browser, at sign-in. | To keep you signed in and to show admins which session is which. | 30 days sliding; emailed invitations 7 days; emailed reset links 30 minutes (24 hours for a link an owner or admin makes by hand); the reason a session ended 24 hours. |
| Office content. Chat messages, runs, conversations, notifications, meetings and filed minutes, action items, workflows, KPIs, decisions, artifacts and their versions, uploaded files, email mailbox settings and up to 100 recent sent-message summaries (recipient, subject and up to 4,000 characters of text), messaging route details, the Telegram bot name, and an append-only log of what happened in the office. | You, the people in your office, and your agents. | To provide the office. | For as long as the office exists, unless you delete it earlier. See section 8. |
| Content held by the AI engine. Agent conversations, agent memory, task cards and routines, kept in the office's own storage. Connector credentials (mailbox app passwords, the Instagram sign-in, the Telegram bot token) are kept there as protected files, and the office never shows them back. When you connect Instagram through the Officeverse app, we exchange the sign-in and pass the result to your office; it is not kept centrally (see Deleting your data). | You, your agents and the services you connect. | To run your agents and connectors. | For as long as the office exists, unless you delete it earlier. |
| Messages from connected apps. What people write to your office on Telegram, WhatsApp, Instagram or email: their messages, the name and user ID or phone number the app gives, and comments on your Instagram posts. | The people who write to you, through the app. | So your agents can answer and so you can read the conversation. | As office content: while the office exists, unless you delete it. |
| Browser error reports. When a signed-in browser hits an error, it may send a message (kept to 500 characters), the page and your person ID to your office. A technical trace is accepted but dropped. No IP address or user-agent is stored with the report. | Your browser. | To help diagnose faults in the office. | Only in a short in-memory log of the newest 200 lines, which is lost when the office restarts. |
| Billing. Office name, plan and status; checkout records (amount in IDR, the payment gateway's reference, status and times); and the full verified message the payment gateway sends us about a payment. No invoice table and no stored card exist in the product. | Our own systems and the WASDLabs payment gateway. | To create checkouts, confirm payments and apply plans or storage packs. | While the office exists, and as long as we must keep payment records by law. A trial is free, so a trial office has no payment record until its first payment. |
| Operational usage. Per office: a daily agent count, AI token totals and estimated cost. Our AI model service also logs the office name, model, result, duration and token counts. It does not log message content. | Our own systems. | To measure usage, run the service and spot faults. | While the office exists. |
The checkout we send to the payment gateway carries a generated customer name of the form "Officeverse <name>". It does not carry your real name, email address, phone number, address or tax ID.
4. Cookies and browser storage
| Name | Where | Purpose | Details |
|---|---|---|---|
ko_session |
Cookie, office | Keeps you signed in. Essential. | HttpOnly, SameSite=Lax, Secure on HTTPS, 30 days sliding. |
ko.token |
Browser storage, office | An access token you paste into the Connection dialog, if you use one. | Stays in your browser until you remove it. |
ov.currency |
Browser storage, public site | Remembers whether you view prices in IDR or USD. | A preference you set yourself. |
ov.setup-token |
Tab storage, office | Holds the first-run setup secret for the current tab. | Cleared after setup. |
ov.stale-reload |
Tab storage, office | Stops an old browser page from reloading in a loop when the server is newer. | Cleared after a valid update. |
Officeverse uses no advertising cookies, no third-party analytics and no tracking pixels, anywhere in the product or on the public site. The items above are strictly necessary or a preference you set yourself, so there is no consent banner. The only external embed is YouTube, which the optional lounge TV in the office can play. YouTube then sees your browser's requests to it.
5. Why we use it and our legal basis
| Purpose | Legal basis (UU PDP article 20; GDPR article 6) |
|---|---|
| Running the waitlist, sending beta invitations and notifying our operator of signups. | Your consent, given when you submit the form. You can withdraw it at any time. |
| Providing the office: accounts, sessions, content, agents, connectors and the records that tie an office to its plan. | Performance of the agreement between you and us (the Terms of Service). |
| Creating checkouts, confirming payments and applying plans and storage packs. | Performance of the agreement, and our legal obligations on payment records. |
| Keeping the service secure and diagnosing faults: rate limiting, error reports, usage and model-service logs, backups. | Our legitimate interest in running a secure, working service. |
We do not sell personal data, and we do not use it for advertising.
6. Who else processes data
These companies and services handle personal data for us, or on your instruction when you switch a connector on.
| Who | What they see |
|---|---|
| Biznet Gio Nusantara (Indonesia), the hosting provider of our main server | Everything stored on that server: the offices hosted on it, our sign-in and billing records, the public site, and the encrypted backup copies of the offices on our second server. |
| Google Cloud (Google LLC), Jakarta, for our second server | Everything stored on that server: the offices placed on it, and the encrypted backup copies of the offices on our main server. |
| Cloudflare | DNS and, for the public site and most offices, routing and TLS, so it sees the traffic to the public site and to the offices behind it. |
| Hostinger (email) | Operational email sent from our own address: waitlist notifications, beta invitations and alerts, so recipient addresses and message text. |
| The email provider of the mailbox your office sends invitations and password-reset emails from | The recipient's address and the email, including the one-time link in it. |
| WASDLabs payment gateway (pay.wasdlabs.com) | The checkout and payment: the merchant reference, the amount in IDR, the generated "Officeverse <name>" name, and whatever you enter on its hosted checkout page. |
| AI model providers, through our AI model service | See below. |
| Microsoft, for the default read-aloud voices | The text of an agent reply that you play aloud with an Edge voice, which is the default voice of every agent. |
| YouTube (Google) | Your browser's requests, if you play the lounge TV. |
| Connectors you switch on: Meta (Instagram), Telegram, WhatsApp, Notion and the other apps in the catalog, and your own mail provider over IMAP and SMTP | The messages, posts, media, recipients, pages and account details that those connectors carry. |
Our sign-in and billing system is software we run ourselves, on our own servers; no outside company holds it.
AI model providers
An office that uses the AI access provided by Officeverse sends prompts, conversation history, tool calls and results, and any office content that is part of a request, through our AI model service to the third-party AI provider that serves the chosen model. That means a third-party large-language-model provider processes that content. We choose and change those providers ourselves. Our model service's own logs keep the office name, model, result, duration and token counts, not message content. A recording made with the microphone in chat is sent the same way to a speech-recognition provider.
If you connect your own key through "Connect your AI" (OpenAI, Anthropic, Google Gemini, OpenRouter or a custom OpenAI-compatible endpoint), the same content goes to that provider instead, under your agreement with it.
Do not put into an office data that you are not allowed to send to a third-party AI provider.
7. International transfers
Our own servers are in Indonesia. AI model providers and some of the other services above operate outside Indonesia, so personal data is transferred abroad when you use them. We require the recipients' own terms and security commitments to apply to that data, and we send them only what is needed to do what you asked for. By using a feature that sends data to one of them, you agree to that transfer.
8. How long we keep data
| Data | Kept for |
|---|---|
| Sessions | 30 days, extended each time you use the office. Expired rows are swept. |
| Reasons for ended sessions | 24 hours |
| Password-reset and invitation links | An emailed invitation is valid for 7 days, an emailed reset link for 30 minutes, a link made by hand for 24 hours; each works once. Used and expired links are swept. |
| Deletion request | The office name, the owner's email address and language, the request and deletion dates and the status, kept while the request waits (7 days). Once the office is deleted the email address is erased; the record that an office of that name was deleted, and when, stays. |
| Uploads not attached to a message | 6 hours |
| Agent activity replay | 1 day |
| Operational events (restarts, model failures) | At most 14 days and at most the newest 5,000 rows, whichever is smaller. |
| In-memory office log, including browser error reports | Newest 200 lines, lost on restart |
| Artifact share links | 1 hour |
| Decision records | Newest 200 |
| Email metadata | Up to 100 sent summaries per mailbox, 40 activity entries and 500 seen message IDs. These are count caps, not time limits. |
| Server logs | Rotated at 20 MB per file, 3 files per program |
| Conversation history held by the AI engine | 90 days after a conversation ends. Your office deletes them itself, every day, and a conversation still running is never touched. You can clear them sooner, down to one day, in Settings → Storage. |
| What you send to the AI models | The service that passes your requests to the models stores none of it: no question, no answer, no file. It keeps one line per request with the time, the model and the sizes, so that usage can be counted; that line holds no message text. |
| Backup copies | The newest 7 nightly copies of each office; see section 9. |
Office content (chats, files, artifacts, meetings, agent memory and the log of events) is kept for as long as the office exists, because it is your working data. Apart from the limits in the table above, the only thing deleted for you is the conversation history the AI engine keeps once it is older than 90 days. You can manage the rest yourself:
- clear an agent's chat, which deletes that agent's chat messages and any attachments no other message uses;
- delete attachments (the file is removed and the chat shows that the file was deleted);
- delete an artifact or a non-final version of one, which removes its files;
- prune ended agent conversations older than a number of days you choose, from 1 to 3,650;
- remove a mailbox, which removes it and its sent-message summaries;
- remove a person, which removes that person's account, email address, sessions, reset links and saved position.
Removing a person does not by itself delete messages, runs, meeting records or artifacts that mention them. Deleting the whole office does. The owner can do both of these in the office, under Settings → Your data:
- Download everything as one zip: your office's data, with passwords, sign-in sessions, keys and access tokens left out. Files your agents keep in their own working space, and what the AI engine stores for itself, are not in it; write to us if you need them.
- Ask for the office to be deleted. We email the owner when the request is recorded and again when it is done. The deletion happens 7 days after the request, and the owner can cancel until then. It removes the office and all of its stored data (database, files, agent memory, conversations and workspace), and it cannot be undone. In our own plan records the office is marked cancelled.
Our waitlist, sign-in and billing records are deleted on request, except what the law requires us to keep.
9. Backups
Every night each of our two servers makes an encrypted copy of every office it hosts and sends it to the other server. Both servers are in Indonesia. The newest 7 nightly copies of each office are kept; older ones are overwritten. The same run copies our own sign-in and billing records.
- Each copy is encrypted before it leaves the server, with a one-time key that is itself locked with a public key. The matching private key is held only on the operator's own computer, not on any server, so the copy cannot be read on either server.
- The copy contains the office's stored data: its database, files, agent memory and conversations, and the credentials of the connectors.
- It exists so that an office can be brought back after a server fails. It runs once a night, so up to a day of work can be lost.
- When an office is deleted, its backup copies are not removed automatically. We remove them by hand when you ask, by replying to either of the two deletion emails or by writing to support@officeverse.id, so a deleted office leaves no copy behind once we have done it. Until then, a copy can remain.
10. Your rights
Under UU PDP you have the right to:
- be informed about the identity of the controller, the purposes and the basis for processing your data;
- access your personal data and obtain a copy;
- correct inaccurate or incomplete personal data;
- have your personal data deleted or destroyed;
- withdraw consent you gave;
- delay or restrict the processing of your data, in line with the purpose it was collected for;
- object to decisions made solely by automated processing that have legal or similarly significant effects on you;
- receive your data in a usable form and have it moved, where this applies (portability);
- complain, and seek redress, if you think your data was processed in breach of the law.
How to use them today
- Content you control inside an office. Use the office itself: edit your profile, clear chats, delete attachments and artifacts, remove mailboxes, prune old conversations (see section 8), and ask an owner or admin to change or remove a person.
- A copy of your data, and deletion of the office. The owner does both under Settings → Your data (see section 8). If you cannot use the page, write to support@officeverse.id and a person handles it.
- Everything else, including the waitlist, sign-in and billing records, and the removal of backup copies: write to support@officeverse.id.
- A connected Instagram account. Disconnect it in Settings → Integrations → Instagram, or remove Officeverse in the Instagram app. The step-by-step version, and what is stored where, is on Deleting your data.
- If you are an end user in someone else's office, the controller of your office content is the organization that holds the office. We will pass your request to them or help them handle it.
We answer without undue delay and within the time Indonesian law sets for each kind of request; a deletion is completed within 30 days. We may need to confirm who you are first. You may also complain to the Indonesian authority responsible for personal data protection.
11. If the GDPR applies to you
Officeverse is built for businesses in Indonesia. If you are in the European Union or the European Economic Area and the GDPR applies to what we do with your data, then in addition to the above:
- the legal bases in section 5 are those of GDPR article 6 (consent, contract, legal obligation and legitimate interest);
- you have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to withdraw consent at any time;
- transfers outside the EEA are described in section 7;
- you may complain to the data protection authority of the country where you live or work.
Write to support@officeverse.id to use these rights; the process is the one in section 10.
12. Security
What is in place today:
- Passwords are stored only as Argon2id hashes. Session and password-reset tokens are stored only as hashes.
- The session cookie is HttpOnly and SameSite=Lax, and Secure on HTTPS. State-changing requests are checked to come from the same origin.
- Failed sign-ins are limited to 10 per 15 minutes, and the API has rate limits.
- Permissions are role-based (viewer, member, admin, owner), and anything not explicitly granted is denied.
- The office and the public site send a Content-Security-Policy and related security headers.
- Traffic uses HTTPS everywhere, through Cloudflare and our own gateway with Let's Encrypt certificates.
- Every office has its own programs and storage. The agents' working computer has a read-only system and no access to the office's data.
- Our central records use row-level security.
- Backups are encrypted before they leave the server (section 9).
The limits you should know about:
- There is no application-level encryption of live data beyond the disk it sits on.
- Connector credentials are held in a file in the office's own storage, protected by file permissions, not by separate encryption.
- Backups run nightly, not continuously, and are checked by hand rather than automatically.
If a personal data breach happens, we will notify those affected and the authority as the law requires.
13. Children
Officeverse is a service for businesses and is not intended for children. We do not knowingly collect personal data from children. If you think a child has given us data, write to support@officeverse.id and we will delete it.
14. Changes to this policy
We may update this policy. We post the new version on this page and change the "Last updated" date. If a change materially affects how we use personal data you have already given us, we will tell you before it takes effect where we can reach you. This policy is published in English and in Indonesian (Kebijakan Privasi); if the two differ, the Indonesian version prevails.
15. Contact
Questions, requests to use your rights, and complaints about privacy go to support@officeverse.id. Reports of abuse go to abuse@officeverse.id.
