Privacy Policy
What we collect when you visit fivetwenty.one or send us an enquiry, why we hold it, who else touches it, and how to get it back or have it deleted.
Last updated
Who we are
fivetwentyone is the studio name of PT Optimasi Mesin Pencari, a company registered in Indonesia. We run the website at fivetwenty.one and we decide what happens to the personal data collected through it. In the language of the data protection laws below, that makes us the controller.
Infiniti Office, Permata Regency D/37, Jl. H. Kelik, Srengseng, Kembangan, Jakarta Barat 11630, Indonesia.
hello@fivetwenty.one · +62 818 301 984
Two laws shape this policy: Indonesia’s Personal Data Protection Law (UU No. 27 of 2022), which covers everyone, and the GDPR, which covers readers in the European Union and the United Kingdom. We apply the same standard to everybody rather than sorting visitors by passport.
What we collect
Two kinds of information reach us: what you send us and what your browser reports while you read.
What you send us
The contact form asks for your name, email address, company, the kind of work you have in mind, a budget range and your message. Only the email address and the message are required. Whatever you put in the message field is yours to choose; please keep passwords, card numbers and other secrets out of it, the same as you would with an ordinary email.
Reaching us by email, phone or LinkedIn instead means we hold whatever that exchange contains.
What your browser reports
- Server logs. Every request to the site is logged by our host with an IP address, the URL, a timestamp, the browser’s user agent string and the page you arrived from.
- Analytics. Google Analytics 4 runs on every page and reports visits, pages read and rough location at city level.
- Anti-spam. Cloudflare Turnstile checks that a person is filling in the contact form. Your IP address goes to Cloudflare as part of that check.
- Rate limiting. Our contact endpoint counts submissions per IP address, at most five in any ten minutes. The count lives in memory on the server that handled the request and is never written to disk.
Why we use it
- To answer you. An enquiry exists to be replied to, quoted and followed up. Under the GDPR this is the step taken at your request before a contract.
- To keep the form working. Verification and rate limiting protect a real inbox from automated abuse. Our legitimate interest, and yours, is a form that still works tomorrow.
- To see what the site does. Aggregate traffic tells us which pages earn their place. We rely on the same legitimate interest: a website we can improve without guessing.
- To keep our records straight. Once an enquiry turns into paid work, Indonesian tax and company law requires us to retain the paperwork around it.
Nothing here feeds automated decision-making or profiling. A person reads every enquiry that arrives.
Who else sees it
We do not sell personal data and we do not hand it to advertisers. A short list of suppliers processes it on our instructions, under their own data processing terms:
- Google. Hosting and the database that stores enquiries (Firebase App Hosting, Cloud Firestore), the mailbox that receives them (Google Workspace) and Analytics.
- Cloudflare. Turnstile, the check on the contact form.
Your data goes nowhere beyond those suppliers unless you ask us to introduce you to somebody, or unless a court or a regulator compels us. If that last one ever happens, we will tell you where the law lets us.
Where it lives
The database, the hosting and the mailbox all run on Google infrastructure, which means your data can be processed on servers outside Indonesia, including in the United States and the European Union. Google and Cloudflare each publish the safeguards covering those transfers, the European standard contractual clauses among them.
How long we keep it
- Enquiries. Twenty-four months after the last message between us, then deleted.
- Project records. Once an enquiry becomes a signed project, the commercial paperwork stays for ten years, which is what Indonesian company and tax law asks of us.
- Analytics. Fourteen months, the retention we have set in Google Analytics. The aggregate reports outlive it and identify nobody.
- Server logs. Thirty days.
Your rights
You can ask us what we hold about you, ask for a copy of it, have it corrected, have it deleted, object to a use of it, ask us to pause while a dispute is sorted out, or withdraw a consent you gave earlier. Withdrawing consent leaves everything done before it valid.
Email hello@fivetwenty.one with “privacy” in the subject line. We answer within three working days and finish the request within thirty. We may first ask you to confirm who you are, which usually means replying from the address the data is attached to.
If our answer leaves you unhappy, you can complain to the Indonesian data protection authority, or to your own supervisory authority if you live in the European Union or the United Kingdom.
How we protect it
The site is served over HTTPS only, with a strict transport policy, a content security policy and the usual hardening headers. Enquiries land in a database whose rules make them unreadable to the public and writable only in the shape the form produces. Reading them requires a sign-in from one of a handful of named accounts. Credentials live in Google Secret Manager rather than in our code.
No website can promise perfect security. Should a breach ever put your data at risk, we will notify you and the regulator within 3 x 24 hours, as Indonesia’s Personal Data Protection Law requires.
Children
This site sells software development to companies and founders. It is not aimed at children and we do not knowingly collect data from anyone under 18. Tell us if a child has sent us something and it will be deleted.
Changes to this policy
The date at the top of this page is generated from the commit that last edited it. Nobody types it in, which means it cannot quietly go stale while the words underneath it change.
A change that materially narrows your rights or widens what we collect will be flagged here in plain language before it takes effect. The terms that govern using this site live at Terms of Service.
Questions about any of this
Write to us and a person will answer. We would rather explain a clause than have you guess at it.