1. Scope and Data Controllers
This policy applies to the hostlinku.com website, the Hostlinku console, and the Hostlinku API. Hostlinku is the data controller; the business entity’s identity is listed in the Privacy Contact section. This policy was drafted in accordance with Law No. 27 of 2022 on Personal Data Protection (PDP Law) and is part of the Terms and Conditions. If you use the API to process your end users’ personal data, you act as the data controller, and we process that data on your instructions (as a data processor) to the extent necessary to provide the Service.2. The data we collect
Account Data and Authentication
- name, email address, company name (optional), and profile photo, if provided by the SSO provider;
- password hash (we do not store passwords in their original form);
- your account credentials from the SSO provider (e.g., Google, GitHub, Discord) if you log in via SSO;
- email verification status, temporary OTP code, account role, and account status;
- login session data and security audit logs, such as login and logout times, registration, changes to settings, balance adjustments by the admin, and API key activity, along with the associated IP addresses and user agents.
API Key
API keys are stored only as SHA-256 hashes, and we cannot reproduce them. We store the key name, the key prefix for identification, the scope, the expiration date, the credit limit, the last access time, and the revocation status.Metadata Request
For requests that pass authentication and balance verification, we record:- the request time, the requested model, and the API key used;
- the number of input, output, and cache tokens, as well as the charges incurred;
- latency, time to first token, streaming mode, finish reason, status code, and error message;
- the IP address from which the request originated;
- Internal upstream route information that is visible only to Hostlinku administrators.
Balance and Payments
We store a history of top-ups, usage, refunds, and balance adjustments, including the amount, payment method, status, and transaction reference number. Payments are processed by iPaymu (QRIS and virtual accounts) and BlockBee (cryptocurrency). We do not accept or store your full card number, CVV, or banking credentials. For cryptocurrency payments, wallet addresses and transaction hashes may be recorded.Technical and Communication Data
- IP addresses, browser types, devices, and referring pages recorded in server logs and Cloudflare’s security services;
- The content of your correspondence when you contact support, report a bug, or request a refund.
3. Request and Body Logging
The request content (prompt, message, attachments) and the model’s response are processed to be forwarded to the upstream provider and returned to you. By default, this content is not stored in our database; only the metadata described in section 2 is stored. Hostlinku administrators can enable body logging across all platforms for debugging and error investigation purposes. While this feature is enabled:- The request and response bodies are stored along with the corresponding request log;
- Fields containing credentials (such as
authorization,api_key,password,token) and upstream identities are replaced with[redacted]before being saved. This filtering is based on field names, so any secrets you include in the prompt text are not filtered out; - Content that exceeds the size limit will not be saved;
- The content is automatically deleted after the specified retention period—14 days by default—while the request metadata is retained;
- The content can be viewed by the account owner via the console and by authorized Hostlinku administrators.
4. Purpose and Legal Basis for Processing
- Running the Service: authentication, request routing, and response delivery (fulfillment of the agreement).
- Billing: reservations and balance deductions, transaction history, processing of top-ups and refunds (fulfillment of agreements and legal obligations).
- Security: rate limits, abuse and fraud detection, CAPTCHA, audit logs (legitimate interests).
- Support and notifications: OTP, password reset, low balance alerts, notifications of service changes (contract fulfillment).
- Service improvements: aggregate usage statistics for capacity and quality (legitimate interest).
- Legal compliance: responding to requests from legitimate authorities and fulfilling tax or accounting obligations.
5. Data Recipients
Data is shared only to the extent necessary with:- Upstream provider model: receives the request content you send to generate a response. We do not forward your email or account information to them.
- Payment providers: iPaymu and BlockBee for processing top-ups and refunds.
- Email provider: Brevo or Amazon SES for sending OTPs, notifications, and transactional emails.
- SSO identity providers: Google, GitHub, Discord, or another provider you choose to sign in with.
- Infrastructure: Cloudflare (network, security, Turnstile, and R2 object storage) as well as server and database providers.
- Authorities: when required by law or a valid order, or to protect our rights, safety, and property, as well as those of other users.
- Successor entity: in the event of a merger, acquisition, or transfer of the business, while remaining subject to this policy.
6. Cross-border transfers
Some of the recipients listed above, including upstream providers and payment providers, process data outside of Indonesia. We select providers that implement adequate data protection measures and conduct data transfers in accordance with the provisions of the Personal Data Protection Act (PDP Act). By using the Service, you acknowledge that the content of your requests is processed in the jurisdiction where the upstream provider operates.7. Data Retention
- Account data and API keys: retained for as long as the account is active, then deleted or anonymized after the account is closed, unless required to be retained for legal purposes.
- Request and response content: Not stored when body logging is disabled; if enabled, it is automatically deleted after the retention period (default: 14 days).
- Metadata requests and transaction history: retained for as long as the account is active and thereafter for as long as necessary for billing, accounting, tax purposes, dispute resolution, and fraud prevention.
- Security audit logs: retained for as long as necessary for investigations and evidence-gathering.
- OTP and session codes: expire automatically; login sessions are valid for up to 7 days.
8. Security
We implement reasonable technical and organizational measures, including HTTPS connections, password and API key hashing,HttpOnly session cookies, rate limits, CAPTCHA on public forms, admin access restrictions, and audit logs. Further details are available on the Security page. No system is completely secure; in the event of a personal data breach, we will notify you and the relevant authorities in accordance with the provisions of the Personal Data Protection Act.
9. Your Rights
Under the PDP Act, you have the right to:- obtain information about the processing of your personal data;
- access and obtain a copy of your personal data;
- correcting inaccurate data, some of which can be done directly on the console profile page;
- request the deletion of data and the closure of an account;
- withdraw consent or object to specific processing;
- restrict or postpone processing;
- file a complaint with the competent authority in the field of personal data protection.
10. Cookies and Local Storage
hl_sessionand server session cookies: maintain login status; valid for up to 7 days;- SSO state cookie: short-lived to secure the sign-in flow through the identity provider;
- display preference cookies, such as the console sidebar status;
- Cloudflare and Turnstile cookies for protection against bots and attacks;
- Local browser storage for Playground conversation history, which is stored on your device and is not sent to the server unless you send a request.