Privacy notice
How PT Lindara Data Indonesia handles personal data on this website, in enquiries, and in Halo.
Last updated:
1. Who we are
PT Lindara Data Indonesia (“Lindara”, “we”) is a company registered in Indonesia with business registration number (NIB) 2907260099981. Our registered address is Perum Citra 6 Blok H5 No. 19, Tegal Alur, Kalideres, Jakarta Barat, DKI Jakarta 11820, Indonesia. William Ang Kisjanto Surya, our founder, is responsible for how we handle personal data. Contact us about privacy at support@lindara.id.
For this website, enquiries and the staff accounts and records that run Halo, we handle personal data as a controller. A controller decides why and how personal data is used. For photos processed in Halo, each school is the controller and we act as the school’s processor. Section 4 explains that.
2. This website
This website uses no cookies, analytics, advertising trackers or contact forms. It is hosted on Google Firebase Hosting, which delivers pages through the Fastly network. To deliver and protect the site, Google and Fastly process technical details of each request, such as your IP address and browser type. We rely on our legitimate interest in running a secure website.
3. When you contact us
If you email us or message us on WhatsApp, we receive what you choose to send, such as your name, school, contact details and message. We use it to reply, arrange a demo and prepare any agreement with your school. We rely on your request and on our legitimate interest in replying to schools. If your school becomes a customer, we also use these details to perform the agreement and to meet our tax and accounting duties. Please do not send student photos with your enquiry.
Our email runs on Google Workspace, so Google stores the email you send us. WhatsApp handles messages under its own terms. We delete enquiry details 24 months after our last contact with you. If your school becomes a customer, we keep contact details while the agreement lasts, and invoices and other financial records for as long as Indonesian tax and company law requires.
4. Photos processed in Halo
Each school is the controller of the photos it processes in Halo. The school decides which photos Halo processes, which staff can access them and how long they are kept. Lindara is the school’s processor. We process the photos only to provide Halo to that school and only on its instructions. We do not use school photos for our own purposes, and we do not use photos or any other personal data to train AI models.
School photos usually show children, and Indonesian law treats children’s personal data as specific personal data that needs extra protection. Before uploading a photo, the school must have a lawful basis for processing it, including the consent of a parent or guardian where the law requires it. Only school staff use Halo. Children do not.
Halo runs on Google Cloud and stores photos in Google Cloud’s Jakarta region. To change faces, Halo sends the photo to two Google services. Google Cloud Vision finds the faces in the photo so staff can choose which ones to change. Google’s Gemini model, through Google Cloud Vertex AI, edits the faces staff select. Both services are reached through Google’s global endpoints, so these steps can run outside Indonesia. Section 7 says more.
Before a school uses Halo with real photos, we give it a written description of our providers, where photos are stored and processed, how long they are kept and how they are deleted. Schools can also ask us for our Data Protection and Security Pack.
If you are a parent, student or staff member with a question about a school photo, please contact the school first. If you contact us, we pass your request to the school and help it respond.
4.1 How long photos are kept
Each school’s retention periods are agreed with the school before it starts using Halo and are set in Halo for that school. Halo shows the resulting time for each photo as Available until.
| Data | Kept for |
|---|---|
| Uploaded photo and its edited result | Access ends at the Available until time shown in Halo. The school’s periods set this time from when processing finishes, from when staff first view the result and from a download. Halo then deletes the stored copies automatically. Deletion can take longer when processing is unfinished or a technical problem delays it. |
| Photos a school deletes | Halo stops showing the photo at once and issues no new links to it. A download link issued in the previous 5 minutes keeps working until it expires. Halo then deletes the stored copies automatically. |
| Titles and file names of uploaded photos | Kept with the photo’s record while the school uses Halo. Please do not put student names in titles or file names. |
| Records of uploads, views, review decisions, downloads and deletions | Kept while the school uses Halo, so the school can account for each photo. When the school stops using Halo, we delete or return them as agreed. Backup copies contain no photos and are kept for up to 14 days. |
| Downloaded copies | Held by the school under its own arrangements. |
5. Running and measuring Halo
We keep an account for each staff member who uses Halo. Our sign-in service, Google Identity Platform, holds what Google sign-in provides, which is the work email address, name and profile picture, and the authenticator app enrolment used for two step sign-in. Halo’s own records hold an account ID, the school, the role and whether access is active. For each school we also keep its name and a contact email address.
Halo records what staff do, such as uploads, photo views, review decisions, downloads and deletions, with the account ID of the staff member. Each school can download a report of its own records. Google Cloud, which runs Halo, also logs technical details of each request, such as IP address, browser type, the address requested and the time. Most of these logs are kept for 30 days. Google also receives these details when you use Google sign-in.
To check the quality and speed of photo editing, we record processing measurements such as timings, retries and face quality scores. These records do not contain photos. We use them to monitor how well the system performs and to fix and improve photo processing.
We use this data only to provide Halo, keep it secure and working, and measure and improve how well photo processing performs. We rely on our agreements with schools and on our legitimate interest in running a secure and reliable service. We do not use it for advertising or marketing, sell it, share it for others’ own purposes, use it to train AI models or use it to profile individual staff, students or visitors. We keep these records only as long as needed for these purposes and as agreed with each school.
Halo does not measure or report energy use or carbon emissions yet. We are developing a carbon report that will use estimates our cloud provider publishes for our cloud projects. Those estimates contain no personal data. We will update this notice before any report starts.
Halo stores a few small items in your browser so that it can work. Browser storage is a space that websites use to remember things on your device. It is not a cookie, and it is not sent to other websites. Halo keeps most items only while the tab is open. They include your sign-in session, your language setting and a short-lived key that stops a repeated request from being sent twice. They are deleted when you close the tab or window. Your display preference, light or forest, stays until you clear your browser data. Google’s sign-in software also keeps two small technical records that contain no personal details. Halo sets no cookies and uses no advertising or analytics tools. Google’s own sign-in pages may set cookies under Google’s privacy policy.
6. Who else processes data
These providers process data for us under their data processing terms. We do not sell data or share it with anyone for their own purposes.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Google Cloud | Runs Halo. Stores photos, results and records. Keeps technical and security logs | Photos, results, records of actions, technical request details | Jakarta. Some logs can be stored outside Indonesia |
| Google Cloud Vision | Finds faces in each uploaded photo so staff can choose which faces to change | The uploaded photo | Can run outside Indonesia |
| Google Gemini, through Google Cloud Vertex AI | Edits the faces staff select | The photo, a map of the selected faces and, when staff ask for a new edit, the original photo | Can run outside Indonesia |
| Google Identity Platform | Signs staff in with their school Google account and checks the authenticator app code | Work email address, name, profile picture and sign-in details | Can run outside Indonesia |
| Google Firebase Hosting and Fastly | Deliver this website and the Halo app. No school photos pass through this service | IP address, browser type, pages requested | Pages are served from the location nearest each visitor, which can be outside Indonesia |
| Google Workspace | Carries and stores email sent to support@lindara.id | Your email address and message | Can run outside Indonesia |
Some services work under their own terms rather than for us. WhatsApp handles messages you send us on WhatsApp, and Google handles your Google account when you sign in. Each follows its own privacy policy.
7. Data processed outside Indonesia
Photos, edited results and Halo’s records are stored in Jakarta. These steps can run outside Indonesia.
- Face finding and face editing by Google.
- Google sign-in.
- Delivery of this website and the Halo app.
- Email to support@lindara.id.
- Some of Google Cloud’s technical logs.
Google processes this data under its Cloud data processing terms. These include security and confidentiality duties and limit how Google may use the data. Google’s Vertex AI terms also say that Google does not use customer data to train or improve its AI models without permission, and Halo switches off Gemini’s optional data caching. Google’s terms allow it to log some requests to detect abuse of its services. We rely on these terms to protect personal data that leaves Indonesia.
8. How we protect data
We protect personal data with technical and organisational measures, including these.
- Google Cloud encrypts photos and records when stored and when they move.
- Staff sign in with their school Google account and a code from an authenticator app.
- Halo checks each staff member’s school and permissions on every request.
- Each school’s photos and records are kept in a separate Google Cloud project.
- Halo never creates a link for viewing or downloading an original photo, and download links for edited results expire after 5 minutes.
- Halo records each upload, view, review decision, download and deletion, so a school can account for every photo.
9. If something goes wrong
If a security incident affects personal data, we act at once to contain it. We tell each affected school as soon as we learn of an incident that affects its data, so the school can meet its own duties, and we help it respond. Where we are the controller, we tell the people affected and the authority the law names in writing within 3 x 24 hours, as the law requires. We say what happened, which data is affected and what we are doing about it. The contact for incidents is William Ang Kisjanto Surya at support@lindara.id.
10. Your rights
Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) you have these rights.
- Ask how we use your personal data, and ask to see, copy, correct, update or delete it.
- Ask us to stop or restrict processing.
- Withdraw consent where we rely on it.
- Receive your data in a form you can use elsewhere.
- Object to decisions made only by automated processing. Halo makes no automated decisions about people.
- Claim compensation if a breach of the law causes you loss.
To make a request, email support@lindara.id. We may need to confirm your identity first. We respond within the time the law sets, which for some requests is 3 x 24 hours. For school photos the school decides how to respond, so we pass your request to the school and help it. If you are not satisfied with our answer, you can complain to the Indonesian data protection authority or go to court.
11. Changes to this notice
We update this page when our practices change and show the date of the latest version above. If a change affects how we process photos for schools, we tell each school by email before the change takes effect. The website terms are on a separate page.
12. Language
This notice is published in English and in Bahasa Indonesia. If the two versions differ, the English version applies.