Loading
Last updated [DATE]
Only what is needed to run your project is collected: your account details, your brief and files, and your order history.
Card details never reach JStudio — Midtrans handles payment entirely.
Your files and messages are private, stored in non-public buckets and reachable only through short-lived links after an ownership check.
Nothing is sold, and nothing is used for advertising. You can ask for a copy of your data, or for your account to be closed.
Account: your name, email address, and optionally a phone number, company name and profile photo.
Orders: the brief you write, any reference files you upload, your contact details for that order, and the order and payment history attached to it.
Messages: what you send through the client portal, including attachments.
Contact form: name, email, optional phone, the service and budget range you selected, when you need the work, and your message. A hashed form of your IP address is kept to limit spam — the address itself is not stored.
Technical: standard server logs. These deliberately exclude passwords, tokens, keys and payment signatures.
To create your account and sign you in; to price, produce and deliver the work you ordered; to take payment; to communicate with you about your project; and to keep records of transactions.
Nothing collected here is sold, rented, or used for advertising.
Passwords are handled by Supabase Auth and never stored by JStudio in any readable form.
Every database table enforces row-level security, so one client cannot read another client’s orders, files or messages even if the application had a bug.
Brief files, deliverables and chat attachments live in private storage. They are reachable only through short-lived signed links issued after an ownership check.
No system is beyond compromise. If a breach affects your data, you will be told.
Orders, payments and project records are kept as long as required for accounting and legal purposes, because they are financial records.
Briefs, deliverables and messages are kept while your account is active.
Contact enquiries that do not become projects are kept for [RETENTION PERIOD] and then removed.
You can view and edit your profile at any time in the portal, and change your notification preferences there.
You can request a copy of your data or ask for your account to be closed. Closing an account deactivates it and removes personal details; transaction records are retained where the law requires.
Requests go to the address in the next section.
Questions about this policy, or about the data held on you, can go to [EMAIL].
[PRIVACY — the legal entity and postal address responsible for this data, and a supervisory authority if one applies.]