Privacy and Cookie Policy
Last updated: 18 October 2026
Data controller
PT Ruang Ide Wijoyo, Jalan Prabu Kian Santang, Sangian, Periuk, Kota Tangerang, Banten, Indonesia, is the controller of personal data for the StudIO RuangIde service. Questions or requests about personal data: jurnal.ruangide@gmail.com.
Data we process
- Account: username, name, email, password (stored hashed), role and journal access.
- Content you upload: manuscripts, article metadata (authors, affiliations, abstracts), images and version history. You are responsible for having the right to process any third-party personal data in your manuscripts.
- OJS connection data: journal URL, API token and service account if you store them; kept on the server and never sent to the browser.
- Payments: credit order history and status. We do not store card or bank-account data; QRIS payments are processed by the payment provider.
- Technical and security logs: activity log (sign-in, user changes, settings) and IP address for login rate limiting.
Purposes and legal bases
- Providing the service and performing our contract with you (account, editing, export, billing).
- Legitimate interests: security, abuse prevention and service maintenance.
- Legal obligations, such as keeping transaction records.
- Your consent: for non-essential cookies/storage (below) and promotional email. You can withdraw consent at any time.
Cookies and local storage
| Name | Type | Purpose |
|---|---|---|
jm_session | Essential (cookie, HttpOnly) | Keeps you signed in. Lasts for the configured session length; removed on sign-out. |
jm_consent | Essential (local storage) | Remembers your cookie choice for 12 months. |
jmLang and display settings | Functional (local storage) | Remembers language and display preferences on your device. |
| Google Fonts | Non-essential (requires consent) | Loads fonts from Google servers; Google receives your IP address and browser data. Without consent, system fonts are used. |
We use no advertising cookies or analytics trackers. Change your cookie choice.
Third parties and transfers
- Your OJS: the app reads data from the OJS you connect.
- Crossref (api.crossref.org): DOIs only, when you press DOI verification.
- QRIS payment provider: the order data needed to process payment.
- Email provider (SMTP): the address and content of system emails you receive.
- Google Fonts: only if you consent.
- Hosting provider where the service runs, and Cloudflare R2 as private storage for copies of manuscript images.
Some parties may be outside Indonesia or the European Union. We share only what is necessary and do not sell personal data.
Retention and security
Data is kept while your account is active and as long as needed for the purposes above or legal obligations, then deleted or anonymised. Passwords are hashed, tokens are stored with restricted file permissions, sign-in attempts are rate-limited and access is limited per journal. No system is entirely risk-free; if a data breach affects you, we will notify you as the applicable law requires.
Your rights
Under the GDPR (EU) and Indonesia’s Personal Data Protection Law you may: access your data, correct it, erase it, restrict or object to processing, receive it in a portable format, and withdraw consent. Send requests to jurnal.ruangide@gmail.com; we respond within 30 days and may ask you to verify your identity. You may also lodge a complaint with the data protection authority where you live.
Changes
This policy may be updated; the date above shows the latest revision. Material changes will be announced on this site.