Privacy policy

Manggala Cloud is a web and application development studio based in Semarang, Jawa Tengah, Indonesia, and acts as the controller of the data described on this page. For any question about your data, write to hello@manggala.cloud.

Systems we build to order for clients are operated by those clients, under their own privacy policies. The self-serve invitation editor at invite.manggala.cloud is different: we run it ourselves, we process the data inside it, and a separate section below describes that.

On this site, the only place that asks for personal data is the contact form. When you submit it, what gets stored is:

• The name and email address you entered.
• The content of your message.
• The page language and the page path you sent it from, so we know the context and can reply in the same language.
• A fingerprint of your IP address — not the address. What is stored is a salted SHA-256 digest, which cannot be reversed back to the original IP. The only question this answers is “how many times has this sender submitted in the past hour”, because the limit is five messages an hour.
• Your browser's user agent string, truncated at 400 characters, to tell visitors apart from scripts.
• The time of submission.

There are no visitor accounts, no visitor logins, and this site never asks for payment details. Your light/dark theme preference is kept in your own browser's localStorage and is never sent to our servers. The language choice lives in the URL (/id or /en), not in a cookie. The studio's own staff sign in at /admin to publish articles; that sign-in sets a session cookie scoped to /admin only, so it is never sent while you browse the public site.

This section covers invite.manggala.cloud, where you build an invitation yourself, and the published invitation on wedding.manggala.cloud. We operate that service, so we are the controller for the data in it.

What is stored when you use it:

• The email address of your account, from Google or from a sign-in link we send. We never store a password.
• The invitation itself: both partners' names, parents' names, dates, venues, addresses, the greeting — and, if you fill it in, bank account numbers for digital gifts.
• The photographs you upload. Stored in object storage and served through cdn.manggala.cloud.
• The guest list you build: names and, if you fill them in, WhatsApp numbers and groupings.
• Your guests' replies: the name they type, whether they are coming, how many people, and any message they leave.

The guest list and the replies are data about other people, not about you. You decide who goes on that list, so it is on you to be sure you may hold their numbers. We store them on your behalf, use them for nothing else, and never message those people on our own account.

An uploaded photograph has a long, unguessable address that is not listed anywhere, but it is not password-protected: anyone holding the address can open it. That is necessary, because every guest opening the invitation has to load it without signing in. Published invitations are also excluded from search engines.

How long we keep it:

• An unpublished invitation is deleted 30 days after it was last worked on, along with its photographs and its guest list.
• A published invitation is served for one year from payment. After that it stops being shown, and we delete the data on your request.
• Deleting an invitation from your account removes its photographs from storage and its guest list outright, rather than merely hiding them.

Who else processes this: Supabase (database and authentication), Vercel (running the application), Backblaze B2 and Cloudflare (storing and serving photographs and the invitation), Google (if you sign in with a Google account), and Pakasir (payments — they receive an order number and an amount, not your invitation's contents).

To have an invitation, a photograph or a guest list deleted outside the ways above — including a request from a guest who appears on somebody's list — write to hello@manggala.cloud.

• To answer your enquiry and follow up on a project conversation. The basis is the consent you give by pressing send, and our legitimate interest in responding to a prospective client.
• To hold back spam and abuse. That is what the IP hash, the user agent, and the anti-bot check are for.
• To understand which parts of the site are useful, in aggregate.

We do not sell your data, trade it, or use it for targeted advertising.

This site loads two third-party analytics tools on every page. Both set cookies in your browser:

• Google Analytics 4 — visit counts, pages opened, traffic sources, and coarse city- or country-level location. We read it as aggregate figures, not per person.
• Microsoft Clarity — heatmaps and session recordings. To be plain about it: Clarity records your cursor movement, clicks, and scrolling on the page and replays them back as an anonymised session. Form field contents are excluded from the recording, but your behaviour on the page is not.

If you would rather not be included: block third-party cookies in your browser settings, install Google's official Analytics Opt-out Add-on, or use a browser or extension that blocks tracking scripts. The site works fully without either tool — nothing here depends on analytics.

What Google and Microsoft do with that data on their side is governed by their own privacy policies, which we do not control.

We use the following services to run this site. Several of them process and store data outside Indonesia:

• Supabase — the database where contact form messages are stored.
• Resend — delivers the email notification to us when a message arrives. That notification carries your name, email, and message.
• Cloudflare Turnstile — the anti-bot check on the form. Cloudflare receives your IP address as part of that check.
• Google and Microsoft — analytics, as described above.
• WhatsApp (Meta) — only if you choose to reach us through the WhatsApp link yourself. That conversation is governed by Meta's policies, not this page.

We keep contact form messages for as long as they remain relevant to a possible working relationship — an enquiry that never becomes a project does not need to be kept forever.

You can ask us to delete your message at any time by emailing hello@manggala.cloud from the same address you used on the form. We delete it and confirm by reply.

The whole site is served over HTTPS. IP addresses are never stored in their original form. Access to the message database is limited to the people at the studio who need to answer those messages.

No system is entirely proof against failure. If you need to send us something sensitive, the contact form is the wrong channel — email us and we will arrange something appropriate.

Under Indonesia's Law No. 27 of 2022 on Personal Data Protection, you have the right to:

• Know about and access the personal data we hold about you.
• Have inaccurate data corrected.
• Ask for your data to be deleted.
• Withdraw a consent you previously gave.
• Object to particular processing, and request a copy of your data.

Send requests to hello@manggala.cloud. We respond within a reasonable time, and may first ask you to confirm your identity so that one person's data is not handed to another.

Our services are aimed at organisations and businesses. This site is not directed at children, and we do not knowingly collect personal data from them. If you believe a child has submitted data through this site, tell us at hello@manggala.cloud and we will remove it.

When our tooling or our workflow changes, this page follows. The date at the top is when the wording was last reviewed — not when the site was last deployed.

Questions, access requests, or privacy objections: hello@manggala.cloud. We are based in Semarang, Jawa Tengah, Indonesia.