Privacy Policy

1. Who we are

Ferflow is operated by FERFLOW SOFTWARE INC, Indah Street, South Jakarta, Indonesia ("we", "us"). We are the controller of the personal data described here. Questions or requests: support@ferflow.com. Company details are on the company page.

2. What this policy does not cover: your Ferflow install

Ferflow is self-hosted software. Once installed, it runs on infrastructure you control, and the dashboards, queries, users and data inside it never reach us. For that data you are the controller, and we are neither controller nor processor. The only thing an install sends us is license activation, described below and on the security page.

3. What we collect, and why

• Your account. Your name, email address and Google account identifier when you sign in with Google, or your email address alone when you start a free trial. Used to give you access to your orders, downloads and support conversations. Basis: performing our contract with you.
• Orders and licenses. The package and term you buy, amounts and payment status, the payment provider's reference for your transaction, your serial number, the hardware ID of each server you register, and a record of any license moves between servers. Used to issue, deliver, renew and support your license. Basis: contract, and our legal obligation to keep transaction records.
• License activation. When your install activates online, it sends your serial number, its hardware ID and whether it runs Linux or Windows. Used only to issue the matching license. Basis: contract.
• Free trials. Your email address, the IP address the request came from, and when it was made and confirmed. Used to send your trial link and to limit trials to one per address. Basis: our legitimate interest in preventing abuse, and steps you asked for before a contract.
• Support and contact messages. What you write to us, and our replies. Used to answer you. Basis: contract or legitimate interest.
• Security records. IP address and browser information for sign-in sessions, and a log of account actions such as orders, downloads and license moves. Used to keep accounts secure and to investigate misuse. Basis: legitimate interest.
• Site statistics. If enabled, anonymous, cookie-free visit counts from Cloudflare Web Analytics, which does not identify you or follow you across sites. Basis: legitimate interest.

The live demo needs no personal data. It gives each visitor a temporary, anonymous workspace that is deleted within 24 hours.

We do not sell personal data, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

4. Who processes it on our behalf

• Google - sign-in.
• PayPal and Xendit - payments. They collect your payment details directly; we never receive card numbers.
• Hostinger - hosting for this website, and our email.
• Cloudflare - site statistics, if enabled.

Each handles data under its own terms and security obligations. Some of them process data outside Indonesia; where that happens, we rely on the safeguards Indonesian law requires for cross-border transfers.

5. How long we keep it

• Account, order and license records: for as long as your account exists, and afterwards for as long as Indonesian tax and accounting law requires us to keep transaction records.
• Support messages: for as long as your account exists, unless you ask us to delete them sooner.
• Demo workspaces: deleted within 24 hours.
• Security records: for as long as needed to protect accounts and investigate misuse, then deleted.

6. Your rights

Under Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022) you can ask us to tell you what data we hold about you and give you a copy; to correct it; to delete it or stop processing it, where we are not required to keep it; to withdraw any consent you gave; and to object to processing based on our legitimate interests. Email support@ferflow.com from the address on your account, and we will respond within the time the law sets. You may also complain to the Indonesian data protection authority.

Deleting your account does not remove a license already installed on your server - that runs offline, on your infrastructure - and transaction records we must keep by law are retained for that period.

7. Security

Sign-in sessions are signed and time-limited, trial links are single-use and stored only as hashes, payments are handled by the payment providers, and access to our systems is restricted. The security overview describes this in detail, and how to report a vulnerability.

8. Children

Ferflow is a business product and is not directed at anyone under 18. We do not knowingly collect their data.

9. Changes

We update the effective date above whenever this policy changes, and email account holders about any change that materially affects how their data is used.