1. Data controller
PlnExo acts as the controller of the personal data you provide while using this service.
2. Data we collect
- Account data: name, email address, password (stored hashed, never as plain text), and a profile photo if you upload one.
- Learning data: completed modules, quiz results, badges, and certificates.
- Transaction data: orders, payment status, and coupons used. Card details never touch our servers — payments are processed by Midtrans.
- Technical data: IP address, browser type, and access time in server logs, used for security and troubleshooting.
3. Basis and purpose
Data is processed to perform our agreement with you (granting course access, processing payment), to meet legal obligations (transaction records), and to keep the service secure.
4. Profile photos
Photos you upload are re-processed: cropped, resized, and re-encoded. This also strips EXIF metadata from the original file — including the location coordinates phone cameras often embed.
5. Sharing
We do not sell personal data. It is shared only with:
- Midtrans, to process payments;
- our email provider, to send verification, password resets, and account-related notices;
- authorities, where required by law.
6. Retention
Account data is kept while your account exists. Transaction records are kept longer where tax and accounting rules require it.
7. Your rights
Under Indonesian Law No. 27 of 2022 on Personal Data Protection, you may access, correct, and request deletion of your personal data, and withdraw consent. Some data may be retained where the law still requires it. Requests can be sent to our support email address.
8. Cookies
We use cookies necessary for the service to work: the login session, CSRF protection, and your language, theme, and display-currency choices. We do not set advertising cookies.
9. Security
Passwords are stored using argon2id hashing, all forms carry CSRF tokens, and sign-in is rate limited against repeated attempts. No system is perfectly secure, but we take reasonable care with your data.
10. Changes
This policy may be updated. The last updated date appears at the bottom of this page.