Privacy Policy
Last updated 30 Oct 2026
DorsEase helps creators track brand deals, payments, and invoices, and share a rate card. This policy explains what we collect, why, who handles it for us, and what you can do about it. It follows Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022).
Who is responsible
DorsEase is run by its founder, who decides why and how your data is used (the data controller). Contact us at hello@dorsease.web.id for anything in this policy.
What we collect
- Account: your email, password (stored only as a hash), and the time you signed up.
- Profile: username, name, bio, photo, social media handles, and time zone.
- Your work: campaigns, deliverables, fees, payments, and tax withheld.
- Billing details: legal name, bank account, tax ID (NPWP), and address you enter for invoices. Only you can see them, and they appear only on invoices you create.
- Documents: files you upload to a campaign, such as briefs and contracts.
- Rate card: packages, prices, audience stats, niches, terms, and contact details you choose to publish.
- Usage: when someone opens your public rate card or clicks its contact or sign-up links. We store the event and the time only: no IP address, device, or visitor ID.
- Errors: technical error reports, which include your account ID but not your email, name, or the contents of your forms.
We don't use advertising trackers or analytics tools. We set one essential cookie that keeps you signed in.
Why we use it, and on what basis
- To provide the service you signed up for (contract): your account, campaigns, payments, invoices, and documents.
- To publish your rate card (your consent): your profile, packages, stats, and contact details become public only when you turn the rate card on, and private again when you turn it off.
- To keep the service secure and working (legitimate interest): bot protection, error reports, rate limits, and backups.
- To understand how the product is used (legitimate interest): counts of sign-ups, campaigns, and rate card visits, taken from our own database.
Who handles your data for us
We use these providers. Some are outside Indonesia, so your data is transferred abroad when you use DorsEase.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Sydney, Australia |
| Amazon Web Services | Runs the application | Sydney, Australia |
| Cloudflare | File storage (R2) and the Turnstile bot check | Cloudflare's global network; files are stored where we created the bucket |
| Resend | Sending sign-up and password emails | Tokyo, Japan |
| Sentry | Error reports | United States |
We don't sell your data or share it for advertising.
How long we keep it
We keep your data while your account is open. When you delete your account in Settings, we delete your profile, campaigns, payments, invoices, documents, files, and rate card straight away. Encrypted backups made before the deletion are removed within 14 days.
Your rights
You can:
- see and correct your data, in the app;
- download a copy of it: Settings, Account, Export my data;
- delete your account and all of it, in the same place;
- withdraw your consent to publish by turning your rate card off;
- ask us anything else, or complain, at hello@dorsease.web.id.
If something goes wrong
If a data breach puts your personal data at risk, we will tell you and the authority within 3 × 24 hours, with what happened, what data was involved, and what we are doing about it.
Changes
If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. The date at the top shows the latest version.