Skip to main content
Dalang.ioHosting
en
Log in
Menu

Privacy

The platform-level privacy policy — including your rights under UU 27/2022 (the Indonesian PDP Law) and the data controller — is on the dalang.io privacy page.

This page explains the hosting-panel-specific additions: what the panel stores, where, and for how long.

Platform privacy policy (dalang.io/privacy) →

1Data the panel stores

  • Session and identity: the panel stores no password. Login is via dalang.io (SSO); the panel only forwards your session cookie to the Dalang.io API for verification.
  • Hosting services: account name, domain/subdomain, PHP version, placement node, status, and term.
  • Domains: domain name, registration status, and a copy of the owner email (owner_email) for domain notifications.
  • Transactional email queue: recipient address, language, and event data (receipt/ticket).
  • Audit trail: who, when, which action, which account — for operational audit.
  • Balance and transactions live in the Dalang.io API; the panel only reads them. The panel stores neither payment-gateway keys nor card numbers.

2Where the data is stored

  • Panel data lives in a SQLite database on the panel control plane, which runs in our data centre in Singapore.
  • Your site files, MariaDB databases, and logs live on the hosting node where your account is placed — that node is in the same data centre, in Singapore.
  • The panel keeps no copy of your site files itself: it accesses them through the agent with paths confined to your account home, and a download passes through the panel only when you ask for it.

3Backup and retention

  • The control-plane database is snapshotted hourly (VACUUM INTO); local retention is the last 48 snapshots, about 2 days.
  • The off-site copy (site 3 of 3-2-1) is prepared for S3-compatible object storage, but its credentials are not filled in yet — so off-site backup is not active.
  • Account backups: retention of 7, 14, or 30 days depending on the plan; the plan-to-days mapping is not yet established.
  • Service data is not deleted when an account is suspended for non-payment; paying restores it.
  • Account data is kept while the account is active, plus a retention period for tax/audit obligations (platform policy: typically 5 years after closure).

4Logs

  • Panel, nginx, MariaDB, and system logs on the node are bounded in size and rotated (journald, logrotate, auditd).
  • Logs are not shipped off the node; log shipping is not yet decided.
  • You can view your site's access and error logs in the panel yourself.

5Sharing with third parties

  • Payments: Xendit. CDN/DNS/DDoS: Cloudflare. Domain registration: the registrar (DewaBiz).
  • Transactional email is sent through the Dalang.io platform sender ([email protected]).
  • We do not sell your personal data.

6Your rights and cookies

  • The rights to access, correct, erase (subject to retention obligations), and withdraw consent are set out on the dalang.io privacy page (UU 27/2022).
  • The panel uses a session cookie (auth_token) and a language-preference cookie (lang). There is no advertising tracking.

Contact

For privacy requests (access, correction, erasure):

[email protected]