Privacy Policy

1. Who we are

Stowage.id ("we") operates the stowage.id website, the application at stowage.id/app, the API at api.stowage.id, the embed widget and related services. For account, billing, marketing and security data we act as the Personal Data Controller under the PDP Law.

For data you or your organisation put into a workspace (for example packing lists, load plans, consignee contact details, client data in RFQs), your organisation is the Controller and we process it on your organisation's behalf as a Personal Data Processor, solely to provide the service.

Our Data Protection Officer (DPO) can be reached at privacy@stowage.id.

2. Data we collect

Data you provide

• Account: name, email address, profile photo and Google account ID when you sign in with Google, language and unit preferences.
• Organisation: company name, team member roles, invitations and settings.
• Cargo data: item lists, dimensions, weights, consignee groups, load plans, versions, comments and files you upload (for example Excel). This is usually not personal data but may contain names and contacts.
• Billing: billing name and address, tax ID (NPWP) if provided, invoice history. Card and bank details are processed directly by the payment provider; we never receive or store card numbers.
• Marketplace: RFQ contents, quotes, messages, reviews; for vendors also business registration (NIB/OSS) and legal documents for verification.
• Communications: emails to our team, support requests and survey answers.
• Cargo Data Request links: when a vendor sends you a link, the data you enter (name, company, contact, packing list) is sent to that vendor's organisation.

Data collected automatically

• Technical: IP address, browser and device type, requested pages, timestamps and error codes, for security and reliability.
• Product usage: aggregated events such as a tool used, a plan created or a checkout started, to understand and improve the product. We do not use third-party advertising cookies.
• Essential cookies: the sign-in session (httpOnly, Secure), the CSRF token stw_csrf and your language preference. These are required for the service to work.

What we do not collect

The calculators and the 3D Planner compute in your browser. Calculator inputs are not sent to our servers unless you copy a result link, open the result in the planner, save or share.

3. Purposes and legal bases

We process personal data only for specific purposes and on a lawful basis as set out in Article 20 of the PDP Law:

We do not take decisions based solely on automated processing that have legal effects for you. Container recommendations, directory ranking and AI suggestions are aids you are free to ignore.

4. Marketing consent

We only send marketing emails if you explicitly tick the consent box. It is never pre-ticked. You can withdraw consent at any time via the unsubscribe link in every email or in Account settings. Withdrawal does not affect earlier lawful processing.

5. Who we share data with

We do not sell personal data. We share data only with the following parties, and only as far as necessary:

Every processor is bound by a data processing agreement and may only process data on our instructions. In the event of a merger or transfer of business, we will notify you before personal data is transferred and becomes subject to a different policy.

6. Transfers outside Indonesia

Cloudflare's infrastructure is global and some processors (for example Resend, Paddle, Google) are located outside Indonesia. In line with Article 56 of the PDP Law, we only transfer data to parties that apply an equal or higher level of protection, secured through data processing agreements and standard contractual clauses, and only as far as needed to provide the service.

7. How long we keep data

When a retention period ends, data is deleted or anonymised so that it no longer identifies you.

8. Your rights as a Data Subject

The PDP Law gives you the following rights. Most of them you can exercise yourself in the app:

• Information about how your data is processed (this policy).
• Access and a copy of your personal data — download all account data as JSON in Account settings.
• Correction and update of inaccurate data — edit your profile in Account settings.
• Erasure of personal data — delete your account in Account settings. Your personal organisation is deleted with it.
• Withdrawal of consent to marketing at any time.
• Restriction or suspension of processing, and objection to processing based on legitimate interest.
• Portability: obtain and move your data in a common machine-readable format (JSON, CSV/Excel for items and plans).
• Objection to decisions based solely on automated processing.
• Legal action and compensation for unlawful processing of personal data under applicable law.

For requests not available in the app, email privacy@stowage.id from your account email address. We may ask you to verify your identity and will act on your request within 3 × 24 hours of receiving a complete request, as required by the PDP Law. If your data sits in another organisation's workspace, we will forward the request to that organisation as the Controller.

9. Data security

We apply appropriate technical and organisational measures: per-organisation data isolation, encryption in transit and at rest, MFA, role-based access control, audit logs, rate limiting and encrypted backups whose restore is tested regularly. Details are on our Security page.

10. Personal data breach notification

If a personal data protection failure occurs, we will notify affected Data Subjects and the personal data protection authority in writing within 3 × 24 hours of becoming aware of it, as required by Article 46 of the PDP Law. The notice describes the data exposed, when and how it happened, and the steps taken to handle and recover from it. Where required, we will also inform the public.

11. Stowage AI Copilot

When you use the Copilot, your questions and the plan context you send are processed by models running on Cloudflare Workers AI. Conversations are not used to train third-party models. AI answers are always labelled and are never official tariffs, customs rulings or legal advice.

12. Children

The service is intended for users aged 18 and over. If learners under 18 use the Academy through a school or university licence, the institution is responsible for obtaining parental or guardian consent in line with Article 25 of the PDP Law. If you become aware that a child has given us data without such consent, contact us and we will delete it.

13. Changes to this policy

We may update this policy. Material changes are announced by email or in-app notice at least 14 days before they take effect. The "Last updated" date above shows the version in force.

14. Contact

Data Protection Officer: privacy@stowage.id. General questions: halo@stowage.id. If you are not satisfied with our response, you have the right to lodge a complaint with the personal data protection authority.