Privacy Policy — Engine Stack

This Privacy Policy explains how PT Engine Stack Teknologi (“Engine Stack,” “we,” “us,” or “our”) collects, uses, shares, and protects personal data when you use our website, platform, and related services (the “Services”). It applies to site visitors, account holders, and the individuals whose contact data our customers process through the platform. This Policy should be read together with our Terms and Conditions.

Information We Collect

Account and billing data: your name, work email, company, role, login credentials, chosen plan, and payment details. Payment card data is processed by our payment provider; we do not store full card numbers.

Customer-provided data: contact lists, prospect and lead records, message and campaign content, knowledge-base material, and data from integrations you connect in order to run outreach, qualification, and follow-up.

AI Avatar media: images, video, and voice recordings you submit to generate an AI Avatar, which may include biometric identifiers such as facial geometry or voice patterns.

Usage and technical data: log data, device and browser information, IP address, pages viewed, feature usage, diagnostic events collected through our own product analytics and cookies, and support-chat transcripts when you contact us.

How We Use Information

We use personal data to provide, operate, secure, and improve the Services; to create and manage accounts; to process payments and send service and billing notices; to generate and deliver the AI Avatar and outreach outputs you request; to provide support; to monitor for abuse, fraud, and security incidents; to produce aggregated analytics; and to comply with legal obligations. We do not sell personal data, and we do not use customer-provided data or AI Avatar media to train shared or third-party AI models.

Legal Bases for Processing

Where required by law, we rely on one or more of the following: performance of a contract with you; our legitimate interests in operating and securing the Services; your consent (for example, for certain cookies or biometric processing); and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

How We Share Information

We share personal data with infrastructure and hosting sub-processors; payment processors; third-party AI model and infrastructure providers that power certain features; messaging-channel and integration providers you choose to connect; product-analytics and live-chat vendors; and professional advisors. We may also disclose data to comply with law, enforce our agreements, or in connection with a merger, acquisition, or sale of assets. A current list of sub-processors is available on request. We do not sell personal data.

Data Security

Engine Stack is built on infrastructure certified to ISO 27001, ISO 27701, ISO 9001:2015, SOC 2 Type II, HIPAA, GDPR, and CASA Tier II standards. Data is encrypted at rest using AES-256-GCM and in transit using TLS 1.3. Production access is restricted to authorized personnel under least-privilege principles, with mandatory MFA, role-based access control, full audit logging, and immediate access revocation. Our development process includes mandatory code reviews, security testing, and annual third-party penetration testing. Systems are monitored 24/7 with documented incident response procedures. We will notify you within a reasonable time of any data breach affecting your account. A Data Processing Agreement (DPA) is available on request.

International Data Transfers

Personal data may be processed in countries other than the one in which you are located. Where we transfer data across borders, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms recognized under applicable law.

Data Retention and Deletion

We retain personal data for as long as your account is active and as needed to provide the Services, then delete or anonymize it within a reasonable period unless a longer period is required by law. You may request deletion of your data at any time. Where AI Avatar creation involves biometric identifiers, you may request deletion of the source materials and generated avatar models on account closure or written request, subject to our retention obligations under applicable law.

Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at support@enginestack.ai. If your data was uploaded to the platform by an Engine Stack customer, that customer is the controller of your data — please direct your request to them, and we will assist them as a processor.

Cookies and Analytics

We use strictly necessary cookies to operate the site, a privacy-focused product-analytics tool (OpenPanel) to understand feature usage and improve the Services, and a live-chat tool (Crisp) to provide support. You can control non-essential cookies through your browser settings. We do not use third-party advertising cookies.

Children’s Privacy

The Services are not directed to children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to This Policy

We may update this Policy from time to time. Material changes will be notified by email or in-product at least 14 days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

Contact

Questions or requests about this Policy or your personal data may be sent to PT Engine Stack Teknologi at support@enginestack.ai or through the contact page at enginestack.ai/contact.