Privacy Policy

Last updated November 1, 2026

This policy explains how Kelasi (“we”) collects, uses, shares and protects personal data when you use the kelasi.id website and the Kelasi app. We handle personal data in line with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “PDP Law”).

Who is responsible for your data

Kelasi is used by private tutors, tutoring centers and schools (“organizations”). There are two roles:

Your account data (name, email, password, subscription): we decide how it is processed, so we are its controller.
Data an organization puts in (student lists, grades, assignments, attendance, recorded payments): your organization decides what it is for, so the organization is the controller and we process it on their behalf. Please take requests about this data to your organization first; we will help them handle it.

Data we collect

What you give us

Your name, email address and password (stored as a hash, never in plain text).
Profile and settings, such as photo, time zone and language.
Content you create or upload: courses, materials, questions, quizzes, assignments, answers, grades, comments, messages and files.
Organization data: name, logo, color, own address (subdomain), members and their roles.
Billing data for paid plans: the plan you chose, transaction history, and transfer receipts if you pay by bank transfer.

When you sign in with Google

We receive your Google name, email address and profile picture. We use them only to create your account and sign you in to Kelasi. We do not ask for access to Gmail, Drive, Calendar or any other Google data. Kelasi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What is collected automatically

Technical data: IP address, browser and device type, and error logs.
Usage data: pages opened, materials viewed, quizzes taken and learning progress. Some of this is shown to your organization’s teachers and admins as progress reports.
Local storage and cookies: your sign-in token, theme choice and analytics cookies (see Cookies below).

How we use data

To run Kelasi: create your account, sign you in, show courses, grade quizzes and send notifications.
To process Kelasi subscriptions and payments.
To send service emails, such as invitations, assignment reminders, password resets and activity digests. You can manage notification emails in your account settings.
To generate questions with AI, only when you use that feature.
To understand how Kelasi is used so we can improve it, and to keep the service secure.
To meet legal obligations.

We process data to perform our agreement with you (the Terms of Service), with your consent, for our legitimate interest in keeping the service secure and improving it, and to meet legal obligations.

We do not sell personal data, do not use it for advertising, and do not use your content to train AI models.

Children’s data

Many students on Kelasi are minors. Students usually join because a tutor, tutoring center or school invited them. An organization that invites students under 18 is responsible for getting the consent of a parent or guardian as the PDP Law requires. If you are a parent or guardian and want your child’s data deleted, contact your child’s organization or us.

Inside Kelasi: your organization’s teachers and admins can see your profile, work, grades and progress in that organization. Other members of a course can see your name and photo.

Service providers that help us run Kelasi, are bound by agreements to keep data confidential, and process data only for that purpose:

hosting, database and file storage;
email delivery;
payment processing for Kelasi plans;
usage analytics;
an AI service for question generation, only for material you send to that feature;
Google, if you choose to sign in with Google.

We may also disclose data when the law or a valid order from an authority requires it, or if Kelasi merges with or is acquired by another company (with this policy continuing to apply).

Transfers outside Indonesia

Some of the providers above store or process data outside Indonesia, including in the United States. We only use providers that give adequate protection for personal data, in line with the PDP Law’s rules on cross-border transfers.

How long we keep data

We keep data while your account is active or while your organization needs it. If you ask us to delete your account, we delete or anonymize your data within 30 days, except data the law requires us to keep longer, such as transaction records. Data owned by an organization follows that organization’s decisions; when an organization is deleted, its content is deleted with it.

Security

All connections use HTTPS. Passwords are stored as hashes, access to data is limited by role, and files are stored with restricted access. No system is perfectly secure; if a personal data breach happens, we will notify you and the authorities as the PDP Law requires.

Your rights

Under the PDP Law you have the right to:

be informed about how your data is processed;
access and get a copy of your data;
correct data that is wrong or incomplete;
ask for your data to be deleted or its processing stopped;
withdraw consent you have given;
object to certain processing.

You can change most of your data yourself in your account settings. For anything else, contact us at the address below. We will respond within the time the PDP Law sets.

Cookies and local storage

Kelasi uses your browser’s local storage to keep your sign-in token and theme choice, which the app needs to work. We also use an analytics service, which may set cookies to recognize repeat visits. You can clear or block cookies in your browser settings; Kelasi still works, but you may need to sign in again.

Changes to this policy

We may update this policy. The date above shows the latest change. For significant changes, we will tell you by email or in the app before they take effect.

Contact us

Questions about this page, or want to access, correct or delete your data? Email admin@alfrizk.dev.