Introduction

AI Pajak ('we', 'us', or 'our') operates an AI-powered tax filing platform under Indonesian law. This Privacy Policy is prepared in compliance with Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP / Indonesian Personal Data Protection Law) and explains how we collect, process, store, and protect your personal data when you use our services.

Personal Data We Collect

We collect the following categories of personal data to provide our tax filing services:

Identity data: Full legal name, Nomor Induk Kependudukan (NIK), Nomor Pokok Wajib Pajak (NPWP), date of birth, marital status, and number of dependents
Contact data: Email address, phone number, and residential address
Tax data: Income sources, salary information, tax withholding certificates (bukti potong), deduction details, and SPT form data (1770SS, 1770S, 1770, 1771)
Financial data: Bank account details for refund processing, payment transaction records, and subscription billing history
Technical data: Access logs, IP address, browser type, device information, and session data for security and service improvement purposes

Purpose of Data Processing

We process your personal data for the following lawful purposes:

Tax calculation and filing: To prepare, calculate, and submit your Surat Pemberitahuan (SPT) tax returns to Direktorat Jenderal Pajak (DJP)
AI-assisted analysis: To provide AI-powered tax calculations, deduction optimization suggestions, and document classification using Anthropic's AI technology
Service communication: To send tax deadline reminders, filing status updates, and respond to your support inquiries
Service improvement: To analyze usage patterns (in anonymized/aggregated form) to improve platform features and user experience
Legal compliance: To fulfill our obligations under Indonesian tax law, anti-money laundering regulations, and other applicable laws
Security: To detect, prevent, and respond to fraud, unauthorized access, and other security incidents

Data Storage and Infrastructure

Your personal data is stored in Supabase (PostgreSQL) databases with encryption at rest and in transit. Our application is hosted on Vercel's serverless infrastructure. All tax data is protected by Row Level Security (RLS) policies, ensuring that only authorized users can access their own data. Platform administrators are strictly blocked from accessing customer tax data as a core security principle.

Security Measures

We implement comprehensive security measures in accordance with UU PDP requirements, including: end-to-end encryption for data in transit (TLS 1.3) and at rest; Row Level Security (RLS) at the database level ensuring data isolation between users; role-based access control (RBAC) with strict separation of duties; comprehensive audit trails for all tax-related operations; regular security assessments; and secure authentication through Supabase Auth with session management.

Third-Party Data Sharing

We share your data with the following third parties only as necessary to provide our services:

Direktorat Jenderal Pajak (DJP): Your tax data is submitted to DJP as required for tax filing through our authorized integration. This is a legal obligation under Indonesian tax law.

Anthropic (AI Provider): Tax document data may be processed by Anthropic's AI models for calculation, classification, and optimization purposes. Data sent to Anthropic is used solely for processing your request and is not used to train AI models.

Midtrans (Payment Gateway): Payment card details and transaction data are processed by Midtrans, a PCI DSS-compliant payment provider licensed by Bank Indonesia, to facilitate subscription payments.

Jakarta Tax Consulting (JTC): As our authorized tax consulting partner, JTC consultants may access your tax data to provide professional tax advisory services under a Power of Attorney arrangement.

We do not sell, rent, or trade your personal data to any third party for marketing or other purposes.

Data Retention

We retain your tax information for a minimum of 5 (five) years from the end of the relevant tax year, in accordance with Indonesian tax regulations (UU KUP Pasal 28 ayat 11). After the retention period expires, your data will be securely deleted or anonymized, unless a longer retention period is required by law or ongoing legal proceedings. You may request earlier deletion of non-tax data at any time, subject to our legal obligations.

Your Rights Under UU PDP

Under Indonesia's Personal Data Protection Law (UU PDP), you have the following rights:

Right to access: Obtain information about your personal data that we process, including the purpose of processing and the parties with whom it is shared
Right to correction: Request correction or update of inaccurate or incomplete personal data
Right to deletion: Request deletion of your personal data when it is no longer necessary for the original purpose (subject to the 5-year tax retention requirement)
Right to restrict processing: Request that we limit the processing of your data under certain circumstances
Right to object: Object to the processing of your personal data for specific purposes, including automated decision-making
Right to data portability: Receive your personal data in a structured, commonly used format and transfer it to another service provider
Right to withdraw consent: Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise any of these rights, please contact our Data Protection Officer at dpo@aipajak.com or through your account settings. We will respond to your request within 3x24 hours as required by UU PDP.

Cookies and Session Management

We use cookies strictly for session management and authentication purposes. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Session cookies are automatically deleted when you log out or after your session expires. You can configure your browser to reject cookies, but this may affect your ability to use our services.

Children's Data

AI Pajak services are intended for individuals who are 17 years of age or older and who have tax obligations. We do not knowingly collect personal data from children under 17 years of age. If you become aware that a child has provided us with personal data, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email and/or in-app notification at least 14 days before they take effect. Continued use of our services after the effective date constitutes your acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how we handle your personal data, please contact us:

Data Protection Officer: dpo@aipajak.com

Support: support@aipajak.com

Jakarta, Indonesia