Privacy Policy

1. Introduction

firmngin ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services.

Please read this policy carefully. By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. This policy should be read together with our Terms of Service and Refund Policy.

2. Information We Collect

2.1 Personal Data

We may collect the following personal information:

• Identity Data: full name, username, or similar identifier
• Contact Data: email address, phone number, WhatsApp, Telegram, and billing or business address
• Financial Data: payment method details, billing history, transaction records, payout account information, and merchant balance history
• Profile Data: your preferences, feedback, and support requests

2.2 Merchant Verification Data

If you apply for live merchant or monetization features, we may collect additional information for verification and compliance review, such as:

• Business entity type, company name, and business registration details (such as NIB)
• Proof of identity documents (such as KTP or equivalent ID)
• Selfie or photo verification with identity documents
• Business address, proof of address, and point-of-contact details
• Device, service, or demo information submitted as part of the live request review

Verification documents may be stored in secure cloud storage and accessed only by authorized personnel for review, fraud prevention, and legal compliance purposes.

2.3 Guest and End-Customer Data

When end customers pay a merchant through public checkout flows, we may collect information such as customer name, email address, phone number, order details, payment status, IP address, browser or device information, and device fingerprint data used for fraud prevention and transaction processing.

2.4 Technical Data

• Internet Protocol (IP) address and browser type
• Device information, operating system, and platform
• Usage patterns, page interactions, and session duration
• IoT device metadata and telemetry data you transmit through our platform
• Login activity, authentication events, and security-related logs

2.5 IoT Device Data

As an IoT platform, we process data transmitted by your devices including device status, sensor readings, connectivity logs, and firmware version information. This data is processed to provide our services to you.

3. How We Use Your Information

We use your information for the following purposes:

• To provide, maintain, and improve our IoT platform services
• To process subscriptions, merchant transactions, payouts, and refunds where applicable
• To review merchant live requests, verification documents, and operational compliance
• To send administrative information, account notices, operational status updates, security alerts, and support messages
• To detect, prevent, and address fraud, abuse, technical issues, and unauthorized activity
• To enforce our Terms of Service, merchant policies, and applicable legal obligations

4. Data Sharing and Disclosure

We may share your data with:

• Service Providers: third-party vendors who help us deliver our services, including cloud hosting, email delivery, analytics, document storage, and payment processing partners
• Payment Partners: payment gateways and financial infrastructure providers involved in processing merchant payments, settlements, payouts, refunds, or chargebacks
• Legal Compliance: when required by law, regulation, court order, or to protect our rights, users, merchants, and the platform
• Business Transfers: in connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties. Your IoT device data remains your property and is processed on your behalf, subject to the sharing described above where necessary to operate the Service.

5. Fraud Prevention and Security Monitoring

We may analyze account activity, merchant transactions, guest checkout behavior, device fingerprints, and related signals to identify fraud, abuse, or security risks. This may include automated screening, manual review, transaction restrictions, and cooperation with payment partners. Where permitted by law, we may retain related logs and review records for investigation and compliance purposes.

6. Data Security

We implement appropriate technical and organizational security measures to protect your data, including encryption at rest and in transit, access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

7. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes described in this policy or as required by law. This may include retaining verification documents, transaction records, payout history, fraud investigation logs, and support communications for compliance, dispute handling, or legitimate business purposes.

When you delete your account, your personal data is removed within 30 days where feasible, unless retention is required for legal, financial, fraud prevention, or dispute resolution purposes.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate personal data
• Delete your personal data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

Some requests may be limited where we must retain data for legal compliance, active disputes, fraud prevention, financial recordkeeping, or merchant verification obligations.

9. Cookies and Similar Technologies

We use cookies, local storage, session tokens, and similar technologies to operate the Service, keep you signed in, remember preferences, maintain security, and understand how the platform is used.

These technologies may be used for purposes such as:

• Essential operations: authentication, session management, security, and fraud prevention
• Preferences: language, theme, and account-related settings
• Analytics and performance: understanding usage patterns and improving reliability of the Service

You can control cookies through your browser settings. Disabling essential cookies may affect login, checkout, dashboard functionality, or device management features.

10. Data Controller Roles

For platform account data, subscription billing, merchant verification, fraud prevention, and overall operation of the Service, PT Byte Forge Indonesia acts as the data controller (or equivalent role under applicable law).

For goods or services sold through a merchant's public checkout, the merchant is generally responsible for the customer relationship and fulfillment. The merchant may act as an independent controller for customer order and contact information needed to deliver its products or services. Firmngin processes guest checkout and payment-related data on behalf of merchants and the platform to enable transactions, fraud screening, payment settlement, support, and compliance.

Where payment processing is involved, certain data may also be processed by payment partners under their own privacy terms and regulatory obligations. If you are an end customer with a question about a specific purchase, you may need to contact both the merchant and Firmngin depending on the nature of your request.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or business practices. When we make material changes, we will notify you by email, through the Service, or by updating the "Last updated" date on this page.

Your continued use of the Service after the effective date of an updated Privacy Policy constitutes acceptance of the revised policy, unless applicable law requires a different form of consent.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Related policies: Terms of Service, Refund Policy.