Privacy policy

Sidik Dokumen is run by CERIS. We decide how your data is processed (the personal data controller).

Questions, requests or complaints about your data: contact us on WhatsApp at +62 822-8852-1900.

When you mark a document: the file you upload, the recipient names and note you type, and the file’s name, size, type and digital fingerprint (SHA-256). Of the owner key we store only its fingerprint, never the key.

When you check a document: the file you upload for checking.

If you create an account and buy a plan: your email, a fingerprint of your password (not the password), your orders and plan periods, the sender name and bank you give when you report a transfer, and which documents were marked through your account.

Key vault (Pro plan): your owner keys and history are encrypted in your browser with your passphrase before they are sent. We store only the encrypted result and cannot read it.

IP address: only in scrambled (hashed) form, to limit use per day and per hour.

In your own browser, not on our server: the history of documents you marked with their owner keys, and cookies for your sign-in session and language choice. We use no advertising or third-party tracking cookies.

To run the service you ask for: making marked copies, offering downloads, and showing the recipient when you check a document with the matching owner key.

To prevent abuse, for example by limiting requests per IP address.

To match transfers, activate plans, and contact you about your order or when your plan ends.

For combined usage numbers, such as documents per day, that help us improve the service. These numbers do not point to any person.

We do not sell your data and do not use it for advertising.

Original files are deleted as soon as the copies are made. Marked copies are deleted when their download window ends: 24 hours on the free version, 7 days on Lite, 30 days on Pro. Files uploaded for checking are deleted as soon as the check is done.

Recipient names, notes, file names and fingerprints are kept while the service runs, because that is what lets you check a leaked document months later. You can ask us to delete them; after that, the document can no longer be checked.

Hashed IP addresses are deleted within 48 hours.

Account data is kept while your account exists. Payment records are kept for as long as bookkeeping rules require, also after an account is deleted.

The server provider Sidik Dokumen runs on, which stores data on our behalf.

Telegram, which we use for notifications to the admin. When you report a transfer, your account email, the amount, and the sender name and bank are sent to the admin through Telegram. Telegram’s servers are outside Indonesia.

Banks: your transfer is handled by your bank and the receiving bank.

Law enforcement, only when the law requires it.

Connections to the site use HTTPS. Passwords are stored as a fingerprint (scrypt), not as text. Owner keys are never stored. Only Sidik Dokumen admins can open the admin pages.

No system is completely secure. If a data breach affects you, we will tell you and the authorities as the rules require.

You have the right to ask for a copy of your data, correct wrong data, delete your data and account, and withdraw consent you have given.

Send your request on WhatsApp to +62 822-8852-1900. For an account, give its email; we may ask you to confirm the account is yours. We respond within 3 x 24 hours.

Documents marked without an account are not linked to your identity. To delete their data, include the owner key so we know which documents you mean.

If this policy changes, the date above changes too. We announce important changes on the site before they take effect.