Privacy Notice
Last updated: 9 October 2026
1. Who we are and what this notice covers
Claro is a phishing simulation and human risk management platform developed and operated by PT Alpha Code Technologies ("AlphaCode", "we", "us"), a company established in Indonesia. This notice explains how we process personal data when you visit getclaro.tech, when you use the Claro platform as an administrator or learner, and when you use Claro's reporting tools: the Outlook add-in, the Gmail extension and the public reporting portal.
We process personal data in line with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (UU PDP). Where the EU General Data Protection Regulation (GDPR) applies to a client or an individual, we meet its requirements as well.
Claro is offered as a managed service and as an on-premise deployment. In an on-premise deployment the client runs Claro on its own infrastructure and decides where data is stored and which optional external services are switched on, so the hosting and provider details in sections 8 and 9 apply only to the extent the client enables them.
2. Our role: controller or processor
UU PDP distinguishes a personal data controller, which decides why and how personal data is processed, from a personal data processor, which processes it on the controller's behalf. Our role depends on whose data it is.
| Data | Whose data | Our role |
|---|---|---|
| Employee directory, simulation results, training and assessment records, reported emails | Employees and other people a client organisation enrols in Claro | Processor. The client organisation, usually your employer, is the controller: it decides who is enrolled, which simulations run and how long records are kept. |
| Accounts used to run Claro for a client | Client staff with an administrator, campaign manager or analyst role | Processor for the client's workspace; controller for platform security and service communications |
| Website visits, contact and demo requests, Ransomware Exposure Check sign-ups | Visitors to getclaro.tech and prospective clients | Controller |
If a Claro client enrolled you, that organisation is your first point of contact for questions about why you are enrolled and how your results are used, and its own privacy notice governs that processing. We process your data only on its documented instructions and under our agreement with it.
3. Personal data we process
People enrolled by a client organisation
| Category | Examples | Source |
|---|---|---|
| Identity and contact | First and last name, work email address, and a mobile number if the client runs voice, SMS or WhatsApp simulations | The client, by CSV import, directory sync (LDAP or Active Directory), SCIM provisioning, single sign-on or manual entry |
| Work context | Job title, department, groups, manager, preferred language, role in Claro | The client or its directory; you can edit some of these on your profile |
| Simulation activity | Whether a simulated email, SMS, WhatsApp message or call was delivered, opened, clicked, submitted or reported, and when; for web events, the IP address, the browser user agent and the device type and browser derived from it; the keys pressed during a simulated call | Generated when you interact with a simulation |
| Training and assessment | Assigned modules, progress, quiz and exam answers and scores, completion dates, certificates | Generated when you use the learner portal |
| Behaviour and engagement | Individual risk score, points, achievements, streaks, leaderboard position, behaviour observations | Calculated by Claro from the records above |
| Reported emails | Emails you report as suspicious, including headers, body, sender address and subject, and the result of any analysis | You, through the Outlook add-in, the Gmail extension, the reporting portal or the email analysis tool |
| Account and security | Password hash (none for single sign-on users), sign-in activity, audit log entries of actions taken, with IP addresses stored encrypted | Generated when you sign in and use Claro |
Other people in reported emails
When a reported email is not one of our simulations, it is a real email and can contain personal data about people who have no relationship with Claro, such as its sender and other recipients. We store it only so the client's security team can review the report, and it is deleted together with the client's workspace.
Website visitors and prospective clients
- Contact and demo requests: name, company, work email, and optionally phone number, role and message. The form is delivered to our team by email and is not stored in the Claro platform database.
- Ransomware Exposure Check: your work email address (stored encrypted), its organisation domain, the domain you looked up, your language and the results prepared for you, including the PDF briefing.
- Analytics, only if you accept cookies: pages viewed, approximate location, device and browser information, and events such as a submitted form, collected by Google Analytics 4. We never send your name, email address, company or message to Google Analytics.
- Technical data: every request to our servers carries an IP address and browser information, which our infrastructure uses to deliver and protect the service.
4. What we deliberately do not collect
- Submitted credentials. When someone types a username or password into a simulated phishing page, Claro records only that a submission happened. The values typed are never read, stored or logged.
- Call recordings. Simulated voice calls are never recorded. Claro keeps only the keys pressed to move through the call script and the outcome.
- Import files. CSV files uploaded to import people are processed in memory and discarded, not saved.
- Specific personal data. Claro does not ask for the specific categories of personal data listed in Article 4(2) UU PDP, such as health, biometric, genetic, criminal record or personal financial data. Such data can still appear in an email that someone chooses to report.
5. Purposes and legal bases
Article 20 UU PDP requires a legal basis for each purpose. Where we act as processor, the client organisation determines the legal basis, typically its legitimate interest in protecting its systems or a legal obligation such as those set by OJK. Where we act as controller, we rely on the bases below.
| Purpose | Data used | Legal basis |
|---|---|---|
| Running simulations, training, assessments, risk analytics and compliance reporting for a client | People enrolled by a client (section 3) | Carried out for the client as its processor, under our service agreement |
| Creating and protecting accounts, including sign-in and audit trails | Identity, account and security data | Performance of our contract with the client; our legitimate interest in keeping the platform secure |
| Answering a contact or demo request and following up | Contact request data | Steps you ask us to take before a contract; our legitimate interest in responding to business enquiries |
| Preparing your Ransomware Exposure Check briefing and sending the verification email | Exposure Check data | Fulfilling the request you made; our legitimate interest in following up with your organisation about the results |
| Website analytics | Analytics data | Your consent, given through the cookie banner, which you can withdraw at any time |
| Operating the service, diagnosing errors and preventing abuse | Technical data, logs and error reports | Our legitimate interest in a secure and reliable service |
| Meeting legal obligations and responding to lawful requests | Only the data the obligation requires | Compliance with a legal obligation |
We do not sell personal data, and we do not use client data for advertising.
6. AI features
AI features are switched on per client, and the client chooses the provider: Anthropic, OpenAI, NVIDIA, or a model it hosts itself. When a feature is used, Claro sends the provider only what that feature needs.
- Personalised simulations: the recipient's first and last name, job title, department, manager's name and language, with the scenario written by the client's administrator. Email addresses and phone numbers are never included.
- Email threat analysis: the content of an email that someone submits or reports for analysis, with technical signals Claro derives from it.
- Template generation and behaviour nudges: the administrator's instructions and the context needed to tailor the content, such as job title, department and language.
A client administrator reviews and approves every AI-personalised simulation email before it is sent, and AI-written text in Claro reports is labelled as such.
7. Risk scores and automated decisions
Claro calculates an individual risk score from simulation results, reporting behaviour and training activity, and it can automatically assign training when someone fails a simulation. This is profiling. Claro itself makes no decision with legal or similarly significant effect about anyone: scores are a tool for the client's security team.
Under Article 10 UU PDP you may object to a decision based solely on automated processing, including profiling, that has legal consequences or a significant impact on you. Raise this with the organisation that enrolled you, and we will support it.
8. Service providers and other recipients
We share personal data only with the providers below, with the client organisation that enrolled you, and with authorities when the law requires it. Optional providers receive data only when a client switches on the related feature.
| Provider | Purpose | Data involved | Location | When used |
|---|---|---|---|---|
| Google Cloud Platform | Hosting the application, database, cache and file storage | All platform data | Jakarta, Indonesia | Always, for the managed service |
| Coralogix | Application log aggregation | Application logs, which are designed to exclude email addresses and secrets | Jakarta, Indonesia | Always, for the managed service |
| Email delivery | Sending simulation, training and account emails | Recipient email address and message content | The client's own sending domain, or Claro's system email provider when the client has none | Always |
| Sentry | Error monitoring | Error reports, with email addresses, phone numbers and access tokens removed before sending | Outside Indonesia | When enabled for the deployment |
| Anthropic, OpenAI, NVIDIA | AI features (section 6) | As described in section 6 | Outside Indonesia | Only if the client enables AI and selects that provider |
| Twilio | Simulated voice calls and SMS | Recipient phone number, message text or call script | Outside Indonesia | Only for voice or SMS simulations, through the client's own Twilio account |
| Meta (WhatsApp Business Platform) | Simulated WhatsApp messages | Recipient phone number and message content | Outside Indonesia | Only for WhatsApp simulations, through the client's own account |
| ElevenLabs | Generating the voice used in simulated calls | Call script text | Outside Indonesia | Only if the client uses voice generation |
| Microsoft (Graph, Teams), Slack | Mail allowlisting and notifications | Mailbox and tenant configuration, notification content | As configured by the client | Only if the client connects them |
| Google Analytics | Website analytics | Analytics data (section 3) | Outside Indonesia | Only on getclaro.tech, and only after you accept cookies |
| Threat intelligence sources | Ransomware Exposure Check results | The domain you look up, never your email address | Outside Indonesia | When you use the Exposure Check |
When a client connects its own systems, such as a single sign-on provider, SCIM directory, SIEM or webhook endpoint, Claro exchanges data with those systems on the client's instructions. They belong to the client and are not our providers.
9. Where data is stored and cross-border transfers
For the managed service, the application, database, cache and file storage run on Google Cloud Platform in Jakarta (region asia-southeast2), and application logs are sent to Coralogix in Jakarta. In the default configuration, client personal data does not leave Indonesia.
Data leaves Indonesia only when a client uses an optional feature that relies on a provider outside Indonesia (section 8), or when you accept analytics cookies on our website. Article 56 UU PDP permits such a transfer where the receiving country offers protection equal to or higher than UU PDP, where adequate and binding safeguards are in place, or with the data subject's consent. The client decides whether these features are enabled for its workspace.
10. How long we keep data
We keep personal data only as long as its purpose requires, the client's settings allow or the law obliges.
| Data | Retention |
|---|---|
| Profiles of people enrolled by a client | Until the client removes the person or its subscription ends. A client can erase a person's identity at any time; their results then remain only in anonymised form. |
| Simulation activity | As set by the client, between 30 days and 10 years. If the client sets no limit, until its subscription ends. |
| IP address and browser data captured when a simulation is opened or clicked | Removed from the intake queue within 24 hours. The encrypted copy stored with the simulation result follows the row above. |
| Audit logs | As set by the client, at least 5 years to meet OJK POJK 11/2022 and at most 10 years. If no limit is set, until the subscription ends. |
| Training, assessment and certificate records | For the life of the client's subscription, as the client's compliance evidence |
| Reported emails | For the life of the client's subscription |
| Generated compliance reports | 5 years, then deleted automatically |
| Ransomware Exposure Check sign-ups | 24 months, then deleted automatically |
| Contact and demo requests | In our business email for as long as needed to handle the enquiry and any business relationship that follows |
| Database backups | Up to 7 days, on a rolling basis |
When a client leaves
When a client ends its subscription, its workspace is suspended and scheduled for deletion after a grace period of 30 days by default, during which the client receives an export of its audit log. When the grace period ends, every database record and stored file belonging to the client is permanently deleted from our live systems, and its encryption key is destroyed last. Database backups taken before that point are not changed by this: until they expire within the backup period above, they still hold the client's data, including its encryption key and fields that are never encrypted, such as names, job titles and the content of reported emails. Our restore procedure requires every completed deletion to be applied again before a restored system is used, so a backup cannot bring a deleted workspace back. We keep a record that the deletion took place, which contains no personal data.
11. How we protect data
- Email addresses, phone numbers, IP addresses and the credentials of connected services are encrypted at the application level with AES-256-GCM, using a separate encryption key for each client.
- Searches on encrypted fields use keyed one-way hashes, so values do not need to be decrypted to be found.
- Every record belongs to exactly one client workspace, and every query is filtered by that workspace.
- Access within a workspace is limited by role (administrator, campaign manager, analyst, learner), and clients can require single sign-on through SAML 2.0.
- Administrative actions are recorded in an audit log that the client can review and export.
- Connections to Claro are encrypted in transit with TLS.
- Logs and error reports are designed to exclude email addresses, phone numbers and access tokens.
Names and job titles are not encrypted at field level, so administrators can search for people; they are protected by the access controls above. No system is perfectly secure: if you believe you have found a security issue, contact us at the address in section 17.
12. Your rights
Under UU PDP you have the right to:
- be informed of the controller's identity, the purpose and legal basis of processing and how your data is used;
- access your personal data and obtain a copy of it;
- correct data that is inaccurate or incomplete;
- end the processing of your data and have it deleted or destroyed;
- withdraw consent you have given;
- object to decisions based solely on automated processing, including profiling (section 7);
- have processing delayed or restricted in proportion to its purpose;
- obtain your data in a commonly used, machine-readable format and have it sent to another controller; and
- claim compensation for a violation in the processing of your data.
How to make a request
If an organisation enrolled you in Claro, send your request to that organisation, because it is the controller. Its administrators can export everything Claro holds about a person in a machine-readable file, correct profile data and erase a person's identity directly in Claro. If you contact us instead, we will pass your request to the organisation and help it respond.
For data we control (section 2), email privacy@alphacode.tech. We may ask you to confirm your identity first. UU PDP sets response deadlines, for example 3 x 24 hours to give access to or correct personal data. We respond within the deadline that applies to your request, and if we cannot fulfil it we tell you why.
Some requests have limits. A client may need to keep audit logs for 5 years under OJK regulations, and erasure in Claro removes a person's identity while keeping anonymised results as the client's compliance evidence.
14. Personal data breaches
If a personal data breach occurs, we contain it and assess its impact. Where we are the controller, we notify the affected individuals and the authority in writing within 3 x 24 hours as Article 46 UU PDP requires, stating the data involved, when and how the breach occurred, and how it is being handled. Where we process data for a client, we notify the client without undue delay and give it the information it needs to meet its own notification obligations.
15. Children
Claro is designed for workplaces and is not directed at children, and we do not knowingly collect children's personal data through our website. If a client enrols anyone under 18, for example a student, the client is responsible for obtaining the parent or guardian consent required by Article 25 UU PDP.
16. Changes to this notice
We update this notice when our processing changes and revise the date at the top. When a change materially affects how we process data for clients, we also inform client administrators.
17. Contact us
Send privacy questions, requests and complaints to:
Privacy contactPT Alpha Code Technologiesprivacy@alphacode.techIf you are not satisfied with our response, you may complain to the personal data protection authority established under UU PDP.