Privacy Policy

1. Who We Are

ELTSCODE ("we", "us", or "our") is an independent IT consulting and software development team based in Indonesia. We build web platforms, mobile applications, and system integration solutions.

As the data controller, we are responsible for how your personal data is collected, used, and protected across our website and applications. Contact us at hello@eltscode.com.

2. Scope — Website vs. Applications

This policy applies to two distinct contexts, each with different data practices:

• eltscode.com (website) — our marketing and information site. Consultation bookings, WhatsApp messages, email enquiries, and website analytics may involve personal data.
• ELTSCODE Applications — software products published by ELTSCODE, such as TrackPOS. Each app's specific data practices are described in Section 6 below.

3. What Information We Collect

3a. Website

The website itself hosts no contact form. Personal data reaches us only when you choose to get in touch or book a consultation:

• Name, email address, time zone, and any notes you enter when booking a consultation through our scheduling provider (Cal.com)
• Messages or inquiries you send us by email or WhatsApp
• Usage data (pages visited, session duration, browser type, approximate geographic location) collected by our analytics tools when they are enabled. This data is pseudonymous — we do not use it to identify you personally — but it is not fully anonymous
• Two first-party preference cookies that store only your language and light/dark theme choice

3b. TrackPOS Mobile App

TrackPOS is an offline-first application. All business data you enter (products, transactions, store configuration) is stored entirely on your device using SQLite (Android) or IndexedDB (Web). We do not transmit or store this data on any ELTSCODE server.

The app collects or accesses the following:

• Crash & diagnostic data — via Firebase Crashlytics (Android release builds only). This includes crash stack traces, device model, Android OS version, and app version. No personally identifiable information is included.
• Device storage / media — the app requests permission to read images from your device gallery (READ_MEDIA_IMAGES on Android 13+,READ_EXTERNAL_STORAGE on older versions) solely to let you attach product photos. Images are stored locally on your device; they are not uploaded to any server.
• Camera — optionally used to capture product photos. Camera access is only requested when you choose to take a photo; no images are transmitted externally.

We do not collect names, email addresses, contacts, location, or any other personally identifiable information through the TrackPOS app.

4. Legal Basis for Processing

We process personal data based on the following legal grounds under UU PDP:

• Consent — by submitting a form or using our app, you consent to data handling as described in this policy
• Legitimate interests — improving our products and services through aggregated crash and usage data
• Legal obligation — where required by applicable Indonesian law

You may withdraw consent at any time by contacting us at hello@eltscode.com.

5. How We Use Your Information

• Respond to inquiries and consultation requests (website)
• Improve app stability and diagnose crashes (crash reports)
• Improve the performance and content of our website

We do not use your data for advertising, targeted marketing, automated decision-making, or profiling.

6. App-Specific Data Safety (Google Play)

The following summarizes the data practices for TrackPOS as declared in the Google Play Data Safety section:

Data collected by Firebase Crashlytics is governed by Google's Privacy Policy. You can opt out of crash reporting by uninstalling the app.

7. Children's Privacy

Our applications and website are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at hello@eltscode.com so we can delete it.

8. Third-Party Services & SDKs

We use the following third-party services that may collect data independently:

• Firebase Crashlytics (Google LLC) — crash and diagnostics reporting for Android release builds. See Firebase Privacy
• Google Analytics (website only, if active) — website usage data tied to a pseudonymous identifier rather than to your name or email. See Google Privacy Policy
• Cal.com (website only) — the scheduling provider behind our consultation booking page. Anything you enter to book a call (name, email, time zone, notes) is processed by Cal.com. See Cal.com Privacy Policy
• Cloudflare (Cloudflare, Inc.) — hosting and CDN for eltscode.com, plus Cloudflare Web Analytics when enabled. Cloudflare may log IP addresses and request metadata for security and operational purposes. See Cloudflare Privacy Policy
• WhatsApp(Meta) — if you choose to contact us on WhatsApp, your message and phone number are handled under WhatsApp's own terms

9. Cookies & Analytics

eltscode.com sets two first-party cookies of its own: your language choice and your light/dark theme choice. Each stores nothing but that preference and is never used for tracking or advertising.

When analytics is enabled, Google Analytics may additionally set cookies and record pages visited, browser type, and general geographic location. That data is pseudonymous rather than fully anonymous. Cloudflare Web Analytics, when enabled, is cookieless.

You can disable cookies in your browser settings at any time without affecting your ability to access our website.

10. Data Sharing

We do not sell, rent, or trade your personal data. We may share data only with:

• Trusted service providers necessary to operate our services (e.g., hosting, crash reporting), bound by contractual data-protection obligations
• Authorities when required by Indonesian law, court order, or legitimate legal process

11. International Data Transfer

Our website is hosted on infrastructure that may be located outside Indonesia. Firebase Crashlytics processes data on Google's global infrastructure. Where such transfers occur, we ensure appropriate safeguards are in place consistent with UU PDP requirements.

12. Data Security

We implement reasonable technical and organizational measures to protect your personal data from unauthorized access, loss, or misuse. For TrackPOS, all data is stored locally on your device; we have no server-side access to your business data. No transmission method over the internet is completely secure — please contact us immediately if you believe your data has been compromised.

13. Data Retention

We retain personal data only as long as necessary to fulfill the purpose it was collected for, or as required by applicable Indonesian law. Crash and diagnostic data is retained according to Firebase's default retention policies. You may request deletion at any time by contacting us.

14. Data Deletion Requests

For TrackPOS: because all your app data is stored locally on your device, you can delete it at any time by uninstalling the app. This permanently removes all local business data.

For any other data we may hold (website inquiries, crash reports), you can request deletion by emailing hello@eltscode.com and we will respond within a reasonable time.

15. Your Rights Under UU PDP

As a data subject under UU No. 27 Tahun 2022, you have the right to:

• Request information about personal data we hold and how it is processed
• Access and obtain a copy of your personal data
• Correct or update inaccurate personal data
• Request deletion or destruction of your personal data
• Withdraw consent for processing at any time
• Object to processing based on legitimate interests
• Request restriction of processing in certain circumstances
• Receive your data in a portable, machine-readable format
• Not be subject to solely automated decision-making that produces significant effects
• Seek compensation if your rights under UU PDP have been violated

To exercise any of these rights, email hello@eltscode.com. We will respond no later than as required by applicable law.

16. Supervisory Authority

If you believe we have not handled your personal data in accordance with UU PDP and your concern is not resolved after contacting us, you may lodge a complaint with the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital / Komdigi).

17. External Links

Our website and applications may contain links to external sites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

18. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top will be revised accordingly. For significant changes, we will make reasonable efforts to notify users. Continued use of our website or applications after changes constitutes acceptance of the updated policy.