Datenschutz

Wie PSP SignalDesk mit den Informationen umgeht, die Abonnenten ihm anvertrauen. Zuerst in klarer Sprache, dann mit den Einzelheiten, die das Gesetz uns Ihnen gegenüber vorschreibt.

Zuletzt aktualisiert am 12. Oktober 2026 · Version 3.1 · Pacific Strategy Partners (PT Pacific Strategy Partners, Jakarta, und Pacific Strategy Partners, Sydney)

Legal · Privacy

How PSP SignalDesk handles the information subscribers place in its care. Plain language first, with the detail the law asks us to give you.

Last updated 12 October 2026 · Version 3.1 · Pacific Strategy Partners (PT Pacific Strategy Partners, Jakarta, and Pacific Strategy Partners, Sydney)

1. Who is responsible for your information

PT Pacific Strategy Partners, WTC 5, Jl. Jend. Sudirman, Jakarta (NPWP 1000 0000 1005 7625) is the controller of personal data processed on PSP SignalDesk. Pacific Strategy Partners, Sydney (ABN 51 908 330 447) is the controller for subscribers who contract through Sydney. Together they are "PSP", "we" and "us".

Our privacy officer (Pejabat Pelindungan Data Pribadi) is reachable at privacy@pspsignaldesk.com.

2. Scope and language

This policy covers pspsignaldesk.com, the subscriber portal, SD Analyst, SignalPulse, the Business Signal Index, our WhatsApp service, the SignalDesk connector for AI assistants, and the email we send. PSP SignalDesk is a decision-intelligence platform for senior leaders and is offered for business use by people aged 18 and over.

For accounts in Indonesia the Bahasa Indonesia version of this policy is the binding text and the English version is its equivalent. For all other accounts the English version applies.

3. What we collect

Account and profile. Your name, work email, organization, role, industry, language, the sectors, markets and geographies you select, the business context you type into your desk, and your sign-in credentials. Passwords are stored as hashes. If you invite colleagues to seats we hold their names and work emails.

Billing. Your billing contact and invoice history. Card details are entered on Stripe and never touch our systems.

Desk activity. The signals you open, your questions to SD Analyst and its answers (kept as conversation threads you can delete), the decisions you save, the inputs and outputs you keep in your workbook, the documents you generate, feedback you send (with a screenshot of your desk if you choose to attach one), and your answers to SignalPulse questions.

Connected systems, only when you connect them. Invoice and contact data from your accounting system; entries from your calendar; a folder in your Google Drive; your WhatsApp number and messages; the credentials that let an AI assistant reach your desk.

Technical. Your IP address, held for one hour to enforce rate limits; sign-in and email delivery logs; and the browser and screen details attached to feedback.

Prospects. If you request a trial, meet us at a forum, or reply to us, we record your name, company, position, email and the history of our contact.

4. Why we use it, and on what legal basis

Under Article 20 of Indonesia's Personal Data Protection Law (UU PDP) each purpose rests on a stated basis.

  • Performing your subscription. Opening and securing your account, calibrating your desk, generating answers and documents, invoicing, and support. Basis: contract.
  • With your consent. Marketing email, WhatsApp messaging, accounting and Google connections, AI-assistant connectors. Each is a separate choice. You can withdraw at any time and we stop within three days. We keep a record of each consent and each withdrawal: the purpose, the date, the language and the version of this notice.
  • Legal obligations. Tax and invoicing records, and lawful requests from authorities.
  • Legitimate interests. Keeping the platform secure, preventing abuse, and measuring use in aggregate to improve the service.

We do not sell personal data, we do not profile you for advertising, and your business context is never shared across accounts.

For subscribers outside Indonesia, the same three bases apply under the law of your country: contract, consent and legitimate interest.

5. How the platform uses AI

SD Analyst answers, generated documents, SignalPulse scripts and Business Signal Index drafts are produced with Anthropic's Claude models under Anthropic's commercial terms. Your content is not used to train any model, and Anthropic deletes inputs and outputs from its systems within 30 days. Each request carries your question, the desk context needed to answer it (name, organization, role, industry, geography, saved decisions, workbook, and a snapshot of any connected system you have asked the desk to use), and the recent turns of the conversation.

AI outputs are decision support. They can contain errors. Verify facts against the cited primary source, and consult a qualified professional before acting on any financial, legal, tax or regulatory matter.

The platform prioritizes and explains information. It does not make decisions that have a legal or similarly significant effect on any individual. If you believe something the platform produced concerns you as an individual, you can ask for human review at privacy@pspsignaldesk.com.

6. Uploaded documents and the workbook

A document you upload for analysis is sent directly to Anthropic's Files API and is never written to PSP storage. It is deleted from Anthropic at the end of your analysis session, and Anthropic's 30-day deletion applies in every case. Figures you choose to keep in your workbook stay there until you delete them. Figures you type into an exercise follow the same rule: they are stored only if you save them.

7. Connected systems

Accounting (Accurate, Kledo, Xero). Read-only connections pull recent invoices, items and contacts, which can include the names and email addresses of your customers and suppliers. This data is cached for six hours, sent to Anthropic only for the analysis you request, and deleted when you disconnect. Access tokens are encrypted. By connecting, you confirm that you are entitled to share this data with us; we process it only for you.

Google. PSP SignalDesk asks for two Google permissions, and only when you connect them yourself from your Subscription page. Google Drive uses drive.file, Google's narrowest Drive permission: the desk sees and touches only files it created in its own PSP SignalDesk folder and any spreadsheet you select through Google's file picker. Google Calendar uses calendar.readonly: the desk reads your primary calendar for the next fourteen days and keeps only the start time, end time, title and location of up to twenty-five entries for thirty minutes. Attendees, descriptions and attachments are never stored. Google user data is used only to provide the features you asked for, is never used for advertising, lending or credit decisions, is never sold, and is never used to develop, improve or train AI or machine-learning models. Calendar entries used for meeting preparation are passed, for that request alone, to Anthropic under terms that forbid training. PSP SignalDesk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnecting deletes the stored credential and the cached calendar immediately and revokes the permission at Google. Documents already filed in your Drive stay yours.

WhatsApp. You link your number by entering it and confirming a code. Messages travel through Meta's WhatsApp Business Platform, where Meta acts as our processor and may hold message content for up to 30 days. The desk keeps a working memory of your last twelve turns for 24 hours so that a conversation can continue, then discards it. Send STOP, or unlink from your Subscription page, to end the service.

AI assistants (Claude, ChatGPT, Microsoft Copilot). The SignalDesk connector reaches your desk under your own sign-in. Connector keys are stored as hashes; refresh credentials expire after twelve months of disuse. Each request carries only your question and the desk context needed to answer it. You can revoke a connection from your Subscription page and it stops immediately.

Microsoft 365 (AI Governance). An administrator of your company can connect Microsoft 365 from the AI Governance page or the Subscription page. Through Microsoft Graph, read-only, the desk then reads the applications in your tenant, the permissions granted to each and by whom, and your user list with names and sign-in addresses. From this it lists which applications reach company mail, files and calendars, which of them are AI services and how many staff granted them, and records the result on your AI register. The scan runs once at connection and once a night. The findings are shown only to your account's owner, never to other staff or to PSP's team, and the stored credential is encrypted. By connecting, you confirm that you are entitled to share this data with us; we process it only for you. Disconnecting removes SignalDesk's permission from your tenant and deletes the stored credential; findings stay on your register until you remove them.

8. Who receives your information, and where

RecipientRoleCountryWhat reaches it
Cloudflare, Inc.Hosting, runtime and storageUSA; global network including Jakarta and SydneyEverything the platform stores; encrypted at rest
Anthropic PBCAI analysisUSAQuestions, desk context, uploaded documents; no training; deleted within 30 days
Resend, Inc.Email deliveryUSARecipient name and email, message content
Stripe, Inc.PaymentsUSAEmail, organization, subscriber reference. Stripe processes payment data outside Indonesia under its Indonesia terms
Meta PlatformsWhatsApp Business PlatformUSA and IrelandPhone number, message content
ElevenLabs, Inc.Voice for SignalPulse and editorial audioUSAEditorial scripts only; never subscriber data
Google LLCDrive and Calendar, when connectedUSAAs described in section 7
Accurate, KledoAccounting, when connectedIndonesiaOAuth tokens; invoices and contacts pulled
Xero LimitedAccounting, when connectedNew Zealand; hosted in the USAOAuth tokens; invoices and contacts pulled
Netlify, Inc.Website deliveryUSARequest traffic to pspsignaldesk.com

Most processing therefore takes place outside Indonesia. We transfer personal data under adequate and binding safeguards in each processor agreement (processing only on our instruction, no training, deletion on request, breach notice to us), and during 2026 we also ask for your explicit consent to these transfers when you open your account. We will adopt the standard contractual clauses once the Indonesian data protection authority issues them. For subscribers in Australia, these are overseas disclosures to the countries listed above under Australian Privacy Principle 8. We give 30 days notice of any new sub-processor on our compliance page before it handles your data.

9. How long we keep it

InformationKept for
Account, profile and desk contextLife of your subscription, then deleted within three days of closure
SD Analyst threads, saved decisions, workbookUntil you delete them, or at closure
Uploaded documentsNot stored by PSP; deleted from Anthropic at session end (section 6)
Accounting snapshots6 hours; deleted on disconnect
Calendar view30 minutes; deleted on disconnect
WhatsApp working memory24 hours; link record until you unlink
SignalPulse answers120 days
Feedback and screenshots180 days
Connector refresh credentials12 months of disuse, or until revoked
Sign-in, email delivery and activity logs12 months
Prospect recordsUntil you ask us to stop, or 24 months after last contact
IP addresses and rate-limit keys1 hour to 48 hours
Invoices and tax records10 years, as Indonesian and Australian law require

Deletion. You can close your subscription from the portal or by writing to us. Within three days we delete your personal data from our live systems and instruct each processor to delete its copy (Anthropic completes deletion within 30 days; Meta and Resend within their published windows). We keep only invoicing and tax records required by law and, if you asked not to be contacted, the minimum needed to honor that request.

10. Security

Traffic is encrypted in transit and stored data is encrypted at rest on Cloudflare's network. Connection tokens for accounting and Google are encrypted with a separate key. Access is governed by short-lived signed sessions scoped to your subscription; administrative functions require a separate 30-minute credential held by the platform administrator alone. Rate limits protect sign-in, messaging and generation, and access logs are kept for review. Our own staff work on the narrowest access that serves you.

11. Cookies and browser storage

We store only what the product needs to work. A secure, HTTP-only cookie holds your refresh session for 30 days. Your browser's local storage holds your session token, language, brand and layout preferences, and your last screen. Session storage holds your current subscriber profile, a cache of your SD Analyst conversation and business context you type, and is cleared when you close the tab. We run no advertising trackers and no third-party analytics.

12. Your rights and how we respond

You can ask for information about our processing, access to and a copy of your personal data, correction, deletion, restriction, a machine-readable export, and withdrawal of any consent, and you can object to any processing that is solely automated. We respond within three days of a request, as UU PDP requires, and we complete deletion on our systems within three days. Subscribers in Australia have the access and correction rights in Australian Privacy Principles 12 and 13, which we meet within the same period and without charge. Write to privacy@pspsignaldesk.com or correct your details directly on your Subscription page.

Wherever you are. Subscribers in Singapore have the rights in the Personal Data Protection Act 2012, including access, correction and withdrawal of consent. Subscribers in the European Union and the United Kingdom have the rights in the GDPR and the UK GDPR, which this policy meets. Subscribers in the United States and in every other country receive the same rights on request, and where your national law gives you a further right we honour it.

13. If something goes wrong

If a breach of personal data protection occurs, we notify affected subscribers and the competent authority in writing within three days of confirming it, stating what data was affected, when and how, what we have done, and whom to contact. For subscribers in Australia we also follow the Notifiable Data Breaches scheme.

For subscribers in the European Union and the United Kingdom, a breach is also notified to the competent supervisory authority within 72 hours where the law requires. Complaints may also be made to the Personal Data Protection Commission in Singapore, or to your supervisory authority in the European Union or the United Kingdom.

14. Children

PSP SignalDesk is a business service for people aged 18 and over. We do not knowingly collect personal data from children, and we will delete any we discover.

15. When this policy changes

We update the date and version above and flag material changes on your desk before they take effect.

16. Contact and complaints

privacy@pspsignaldesk.com · Pacific Strategy Partners, Jakarta and Sydney. We resolve concerns directly first. You may also complain to the Indonesian data protection authority (pending its establishment, the Ministry of Communication and Digital Affairs, Komdigi) or, in Australia, the Office of the Australian Information Commissioner.

Erfahren Sie, warum Unternehmen auf PSP SignalDesk setzen

Vierzehn Tage mit Ihrem eigenen Desk, ab dem ersten Morgen auf Ihre Branche und Ihre Märkte abgestimmt.

14 Tage kostenlos testen
Möchten Sie wissen, wie wir mit Ihren Informationen umgehen?
Auf dieser SeiteKostenlos starten
Ask SignalDesk

Wie können wir Ihnen helfen, vorn zu bleiben?

Jede Antwort ist datiert und belegt.