Privacy Policy

This policy covers personal data handled by CuanPunya through the website at cuanpunya.com and the client dashboard. CuanPunya is an independent SEO content service based in Jakarta, Indonesia, and is the controller of that data.

Enquiry form: your name, work email, WhatsApp number, company or brand, website, niche, stated goal, expected volume, current traffic band, and any message you add.

Client accounts: the email address used to sign in (authentication is by one-time code — we do not store a password), and your engagement and billing status. Payments are handled by Midtrans; we do not receive or store your card or bank credentials.

Service data: the website content and the Google Search Console data you authorise us to access in order to run and report on the service.

Automatically: standard server logs (IP address, request time, user agent) for security and reliability, and basic, privacy-friendly traffic measurement with no cross-site tracking and no advertising cookies. We use only essential cookies — your sign-in session and your language preference.

To respond to your enquiry and prepare a proposal.

To provide, operate, support, and bill the service, and to produce your reports.

To secure the service and investigate misuse.

To meet legal, tax, and accounting obligations.

We process data to take steps at your request before entering a contract and to perform that contract; for our legitimate interest in operating and securing the service; to comply with law; and, where required, with your consent (which you can withdraw at any time).

We use a small set of third-party providers who process data on our behalf, by function: hosting and database, authentication, transactional email, payment processing, AI text generation (used to draft client content), and keyword / search-result data. We also use the Google Search Console API to read the Client’s own site data, with the Client’s authorisation. A current list of the named providers is available on request at the contact address below.

We do not sell personal data and do not share it for advertising.

Some providers operate outside Indonesia. Where data is transferred abroad, we rely on the provider’s contractual and technical safeguards to keep protection consistent with this policy and applicable law.

Enquiries that do not become engagements are kept while they may still be relevant, then deleted.

Client data is kept for the term of the engagement and a limited period afterwards to handle wind-down, then deleted or anonymised. Billing and tax records are kept for as long as the law requires.

Subject to applicable law, you may ask us to access, correct, delete, or export your data, to restrict or object to certain processing, or to withdraw consent. To make a request, email us at the address below. We may need to verify your identity first.

Data is encrypted in transit. Access is limited to what is needed to run the service, and third-party credentials are stored encrypted. No system is perfectly secure, but we take reasonable measures appropriate to the data.

The service is for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.

We may update this policy. Material changes are noted on this page with a new "last updated" date.