Privacy Policy

Saqina Dev is operated by [COMPANY NAME], [REGISTERED ADDRESS], Indonesia. For any question about this policy or your data, contact us at [CONTACT EMAIL].

Account. When you create an account we store your name, email address and a one-way hash of your password; we never store the password itself. If you sign in with Google, we receive your name, email address and profile picture from Google.

Projects. Everything you enter in a project is stored in our database so it is there when you come back: interview answers, requirements, documents such as the PRD and plan, tasks, memory, decisions, agent preferences, project settings and a log of changes (who changed what and when).

Conversations with Saqina. Your messages to the in-app assistant, its replies, the changes it proposes and the logs of agent runs are stored with the project. Conversations are visible only to you; changes they lead to appear in the project's activity log, which every project member can see.

Integrations. If you connect a repository, an MCP server or an external agent, we store its address and an access token or signing secret, encrypted. We read repository files only when a task needs them (we do not copy your repository), write only to agent branches after a project member approves the change, and never merge or deploy. MCP servers you connect receive the inputs of tools you enable. External agents receive only the context package you review and approve, with recognisable secrets removed.

Clients and billing. If you manage clients in Saqina Dev, we store the client details you enter (name, company, contact details and internal notes), the project scope, payment schedules, invoices and the payments you record. Payment records are entered by you from your own bank statements or receipts; Saqina Dev does not process payments, hold money or connect to your bank. Payments are never deleted: a corrected entry is voided with a reason so the history stays complete.

Client portal. If you invite a client, we store the invited email address and a hash of the one-time invitation link. A client who accepts sees only the projects you enable for the portal, and on those only progress, visible scope items, shared approved documents, issued invoices and confirmed payments. Internal notes, tasks, AI and agent details, integrations and draft invoices are never shown to clients. You are responsible for having a lawful basis to enter your clients' personal data.

Service inquiries. If you send an inquiry from the public AI Services pages, we store your name, company (optional), email address, WhatsApp number (optional), your message, your consent to be contacted, the service you asked about and a one-way hash of your IP address that we use only to limit abuse. Only the platform owner can read inquiries. We use them to reply to you and do not create a contract, invoice or project from them. Inquiries are kept for [RETENTION PERIOD].

Client communication. Requests, messages, approvals and change requests exchanged on the client portal are stored with the project, visible to the project's owners and admins and to the client's portal users. Reminders are sent automatically by the rules you configure and are logged so the same reminder is never sent twice.

Sessions and security. We store your active sessions with the IP address and browser type used to sign in, so you can stay signed in and so we can protect accounts.

Email. We send transactional email only: email verification and password reset links, client portal invitations, and project notifications such as payment and approval reminders. These are sent through [EMAIL PROVIDER]. In-app notifications are stored with your account until you delete it.

Public preview. The interview on the public /start page and the landing page demo run in your browser. Their answers stay in your browser's session storage until you close the tab, unless you choose to import them into a new project after signing in.

Server logs. Our hosting provider, [HOSTING PROVIDER], processes technical data needed to deliver and protect the website, such as IP address, browser type, requested page and time of the request. These logs are kept for [LOG RETENTION PERIOD].

• Session cookie (better-auth.session_token): keeps you signed in. It cannot be read by scripts on the page and expires after 30 days or when you sign out.
• Short-lived sign-in cookies: set only while a Google sign-in is in progress, to protect that flow.
• Language (NEXT_LOCALE): stores only your chosen language code (en or id) and is deleted when you close your browser.

We use no analytics, advertising or tracking cookies.

• We do not use analytics, advertising or social media trackers.
• We do not sell or rent personal data.
• We do not load fonts or scripts from third-party servers; fonts are served from our own domain.
• We do not send your project data to an AI provider unless the platform owner has configured one. When a provider is configured, only the project context needed for a request is sent to it ([AI PROVIDER], [CONFIRM: each provider's data retention and model-training terms]). Without one, answers come from deterministic rules on our servers. Changes to your project are always validated by our own rules before they are applied.

We process account and project data to provide the service you signed up for, which is the performance of our agreement with you. We process server logs and session data on the basis of our legitimate interest in operating and securing the service, and to comply with legal obligations.

We handle personal data in line with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (UU PDP) and its implementing regulations.

Data is processed on our behalf by [HOSTING PROVIDER] (hosting), [DATABASE PROVIDER] (database), [EMAIL PROVIDER] (transactional email), the AI providers configured by the platform owner ([AI PROVIDER]), and the Git hosts, MCP servers and agents you connect yourself, as data processors or on your instruction. If you sign in with Google, Google processes that sign-in under its own terms. We disclose data to authorities only when Indonesian law requires it.

These providers may store data outside Indonesia, in [HOSTING REGION]. Where data leaves Indonesia, we rely on the safeguards required by UU PDP for cross-border transfers.

Some output in Saqina Dev is produced by an AI model: the AI review of an interview, analysis of meeting notes, requirements read from your documents, assistant replies and agent proposals. It is marked "AI" wherever you see it, because it can be wrong. Nothing an AI proposes changes your project until a person approves it. We do not use your content to train models; the providers' own terms apply to what is sent to them.

Project data is kept until you delete the project; deletion in project settings is immediate and permanent. Account data is kept while your account exists. After an account is deleted, residual copies in backups are removed within [BACKUP RETENTION PERIOD].

• Notifications you have read: 90 days after you read them.
• Webhook delivery records: 7 days.
• Per-request AI usage records (model, tokens, duration; never your content): 13 months.
• Audit trail of platform changes: 24 months.
• Expired sessions and sign-in codes: removed automatically every day.

Under UU PDP you may, among other things:

• ask what personal data we hold about you and receive a copy;
• ask us to correct or complete inaccurate data;
• ask us to delete data or stop processing it;
• withdraw consent you have given;
• object to processing based on our legitimate interest;
• file a complaint with the competent personal data protection authority in Indonesia.

You can edit or delete your projects yourself at any time. In Settings you can download a copy of your data as a JSON file and delete your account yourself. Deletion removes your account, sessions, keys, notifications and the projects only you belong to; what you wrote in projects that others use stays, without your name. You cannot delete an account while you still own a project or organization that other people use, or if you are the only platform owner: hand it over first. For anything else, write to [CONTACT EMAIL].

The website is served over HTTPS [CONFIRM AT DEPLOYMENT]. Passwords are stored only as one-way hashes, sessions are validated on the server for every request, and every project operation checks that you are a member of that project. Access to production data is limited to people who need it to operate the service.

Saqina Dev is meant for adults planning software projects. If you are under 18, use it with the involvement of a parent or guardian.

Real agent execution, integrations with services such as GitHub or Vercel, and payments arrive in later phases and will change what we process. We will update this policy before those features go live and show the new date at the top of this page.