Private Mode does not retain PDFs. Workspace stores a PDF only after an authenticated user explicitly selects Save to account.
Scope and controller
This Policy applies to the public FariDocs website, its twenty document generators, Blog, guide, Workspace, and related administrative operation.
PT Farino Teknologi Indonesia acts as the personal data controller for service analytics and operational records. Address: GMI Building, Jl. Srengseng Sawah No.4, RT.2/RW.7, Srengseng Sawah, Jagakarsa, South Jakarta, DKI Jakarta 12630. Data protection PIC: support@farinotech.id.
Data processed
The business funnel links a random visit ID to a company registering in the same browser and records its first document and first paid plan milestones. Milestones remain while the account exists and contain no document copy. Performance measurements retain LCP, INP, CLS, page category and device category for 90 days through cleanup cron, without form contents or private document URLs. Performance collection respects Do Not Track and Global Privacy Control.
Document input may include company details, tax ID, bank account details, recipient and shipping details, dates, transaction items, notes, terms, payment information, logos, and signatures that you choose to enter.
Operational analytics may include IP address and an IP hash, country, device type, browser, operating system, user agent, device token hash, action, document type, and timestamp.
Workspace security history records successful, failed, and blocked sign-in attempts with account email, IP address, country, device, browser, operating system, time, and result so users and administrators can investigate unauthorized access.
Limited document metadata may include document type and number, language, title, company name, bill-to text, currency, calculated amounts, option flags, item count, and creation or expiry time.
Website traffic statistics separately count public page requests, visit sessions, browser, operating system, device category, language, and visits that successfully generate a PDF. These records use a random session identifier and are kept for up to 90 days through scheduled cleanup. Raw IP addresses, full user agents, private workspace paths, form contents, and referral URL query strings are not stored in these traffic tables.
Document-source analytics also records a referring domain and campaign tags (UTM source, medium, and campaign) when available. Referral URL paths and query strings are not retained in document metadata. The identified visit source is kept in the existing session for up to 30 minutes of inactivity and attached to newly generated document metadata under its configured retention.
Language preference, security session data, and CSRF tokens may be stored in the session or browser as necessary for functionality and security.
How data is used
Data is processed to generate the requested PDF, calculate totals, preserve a draft while switching language, prevent abuse, apply any configured daily limit, troubleshoot errors, measure aggregate usage, maintain security, and administer the service.
We do not sell document content or personal data, and we do not use document content for unrelated advertising.
PDF files, browser profile, Workspace storage, and image processing
In Private Mode, generated PDF files are not retained as downloadable files on the server and temporary output is removed after delivery.
The optional sender-profile feature stores only company name, company address, tax ID, bank account details, and a compressed WebP logo copy in this device’s browser local storage after you explicitly select Save on this device. Customer, recipient, shipping, and item data are excluded from that profile. You can update or delete the saved profile from any generator.
Browser Form History automatically stores the latest text, numeric, option, item, label, and document-layout entries separately for each generator in this device’s local storage and loads them automatically on the next visit. It is not synchronized to the FariDocs server, can be cleared from the active generator, and excludes uploaded logo and signature image files.
In Workspace Mode, a PDF and its document data are retained only when an authenticated user explicitly selects Save to account. Stored files are isolated by account, count toward the user’s storage quota, and can be downloaded or deleted from My Documents.
Creating or using a Workspace account requires affirmative acceptance of the Terms of Service, this Privacy Policy, and the Workspace data-storage agreement. Continued Workspace use remains subject to those agreements.
Uploaded JPG, JPEG, PNG, or WebP logos and signatures are limited to 25 megapixels, validated, re-encoded without EXIF or location metadata, resized proportionally when needed, and processed for PDF generation.
Legal basis and your instructions
Processing needed to generate a requested document is performed at your instruction to provide the service.
Security, abuse prevention, essential analytics, and legal compliance are performed for legitimate operational purposes and applicable legal obligations. Where consent is required, you may withdraw it subject to lawful retention requirements.
Retention
Private Mode PDFs are not retained. A language-switch draft is kept temporarily in browser session storage and is designed to expire after a short period.
Browser Form History remains in this device’s local storage until you select Clear history for that generator, clear the site’s browser storage, or remove browser data.
An opted-in sender profile remains in this device’s browser until you select Delete saved data, clear the site’s browser storage, or remove browser data. It is not synchronized to the FariDocs server.
Workspace PDFs and document data remain in the user account until deleted by the user, removed by an authorized administrator, or the account is closed, subject to legal requirements. OTP records expire automatically and account sessions are security-controlled.
A Deleted Workspace account is initially access-revoked rather than immediately destroyed so an authorized administrator can recover business records. A permanent deletion request remains subject to identity verification, lawful retention, and backup cycles.
General document metadata and login/IP security history follow the retention configured or reasonably required for abuse prevention, auditing, dispute handling, and legal obligations.
Backups, if used by the hosting provider, may take additional time to cycle out under the provider’s backup schedule.
Sharing and processors
Data may be processed by hosting, infrastructure, security, or maintenance providers only as needed to operate the service and under appropriate safeguards.
Data may be disclosed when required by law, a valid authority request, or when necessary to protect rights, safety, and service integrity.
If infrastructure processes data outside Indonesia, the operator will apply safeguards required for cross-border personal data transfers.
Security
Reasonable technical and organizational controls are used, including input validation, access controls, CSRF protection, administrator authentication, restricted file types and sizes, temporary-file cleanup, and minimized PDF retention.
No online system is risk-free. Users should avoid entering unnecessary sensitive personal data and should protect downloaded PDFs after they leave the service.
Your rights
Subject to applicable Indonesian law, you may request access, correction, completion, deletion or destruction, withdrawal of consent, restriction or objection where applicable, and information about processing.
We may need to verify your identity and the relevant record before acting on a request. Some information may be retained where required by law or necessary to establish, exercise, or defend legal claims.
Children, cookies, and external links
The service is intended for business users and is not directed to children. Do not enter a minor’s personal data unless you have proper authority and a lawful reason.
Only essential session or preference technologies are intended by default. If optional analytics or marketing cookies are introduced, this Policy and any consent controls should be updated first.
External links are governed by the privacy practices of their respective operators.
Updates, Indonesian framework, and contact
This Policy may be updated when the service, processing activities, or legal requirements change. The effective date below identifies the current version.
The service is designed with reference to Indonesia’s Personal Data Protection Law, electronic systems regulation, and the amended Electronic Information and Transactions framework.
Privacy requests or questions can be sent to support@farinotech.id.