Privacy Policy
Last updated 23 August 2026
PT Scandium is a company incorporated in Jakarta, Indonesia. This policy explains what personal data we collect when you buy or use GU.Email, why we collect it, and what rights you have. We handle personal data in accordance with Law No. 27 of 2022 on Personal Data Protection (UU PDP).
1. The short version
GU.Email runs on your own server. We do not have access to your email, your mailboxes, your message content or your users' credentials. The personal data we hold is limited to what is needed to sell you a licence and support it.
2. What we collect
- Customer details — name, company name, email address, telephone number and billing address, provided by you at purchase.
- Transaction records — the plan purchased, amount, currency, date, invoice number and payment status.
- Licence data — the licence key issued to you and, when your installation checks licence validity, the server identifier, product version and time of the check.
- Support correspondence — the messages you send us and any technical details you choose to include.
- Website usage — basic, aggregated traffic statistics. We do not use advertising or cross-site tracking cookies.
3. What we never collect
We do not collect the content of your email, your mailbox contents, your mail server logs, your users' passwords, or your DKIM private keys. These remain on your infrastructure. We also never receive your full payment card number — card data is captured and stored by our payment gateway, not by us.
4. Why we use it
To deliver and validate your licence, to issue invoices and meet Indonesian tax and accounting obligations, to provide support, to notify you about updates, security advisories and renewals, and to prevent fraud or licence abuse. We do not sell personal data, and we do not use it for advertising.
5. Who we share it with
- Xendit — our payment gateway, which processes your payment and holds the associated payment data under its own privacy policy.
- Service providers — hosting and email providers who process data on our instruction and under confidentiality obligations.
- Authorities — where we are legally required to disclose information.
6. How long we keep it
Transaction and invoice records are retained for the period required by Indonesian tax and company law, currently ten years. Support correspondence is kept for up to three years. Licence validation records are kept for the duration of the licence and twelve months afterwards.
7. Security
Our website and services are served over TLS. Access to customer records is restricted to personnel who need it, protected by strong authentication. We review our systems regularly and will notify affected customers and the relevant authority of a personal data breach as required by law.
8. Your rights
You may request access to the personal data we hold about you, ask us to correct it, request deletion where we are not legally obliged to retain it, object to certain processing, and withdraw consent for marketing messages at any time. and we will respond within thirty days.
9. International transfers
Our systems are operated in Indonesia and Singapore. Where personal data is transferred outside Indonesia we ensure an adequate level of protection through contractual safeguards.
10. Changes
We will publish any update to this policy on this page with a revised date, and will notify active customers by email of material changes.
11. Contact
PT Scandium
Incorporated in Jakarta, Indonesia
Privacy enquiries: