How Katamusikku protects your personal data, what we collect, and your rights under UU No. 27/2022 (PDP) and GDPR.
Katamusikku is an independent Indonesian music publication committed to privacy-by-design. We collect and process personal data strictly in compliance with Indonesian Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Perlindungan Data Pribadi / UU PDP) and the General Data Protection Regulation (GDPR). We process data either with your explicit consent or under legitimate editorial and security interests.
We strictly practice data minimization. We collect only what is essential to deliver independent music journalism and maintain site security:
• Newsletter Subscriptions: If you voluntarily subscribe to our newsletter, we store your email address, subscription timestamp, verification status, and chosen topics of interest to deliver our weekly music editorial.
• Reader Verdict Reactions: When you participate in community sentiment voting on reviews (Agree, Too Low, Too High, Classic), we generate a salted cryptographic SHA-256 hash of your IP address. We never store your raw IP address or track your browsing activity across other websites. The hash is used solely to prevent vote spamming and velocity abuse (anti-brigading rate limits).
• Analytics & Telemetry: If you accept optional analytics via our Consent Manager, we collect privacy-respecting, anonymized pageview metrics (operating system, browser family, country-level geography) to understand readership trends. If you decline, no tracking cookies or telemetry scripts are loaded.
• Server Security Logs: Our web infrastructure automatically logs standard HTTP metadata (request timestamp, user agent string, status code) retained for 30 days solely for DDoS mitigation, intrusion detection, and system debugging.
Katamusikku is not a data broker. We do not sell, rent, monetize, or disclose your personal information to third-party advertisers, data aggregators, or marketing networks. We do not construct advertising profiles or behavioral dossiers on our readers.
To provide our services, we partner with reputable infrastructure providers bound by confidentiality and data processing agreements:
• Database & Hosting: Supabase Inc. (PostgreSQL database with encryption at rest and TLS in transit) and Vercel Inc. (edge hosting and CDN).
• Email Dispatch: Resend Inc. (transactional and newsletter email delivery, supporting one-click RFC 8058 unsubscribe).
• Media & Asset Storage: Amazon Web Services (AWS S3) and Cloudflare R2 for compressed editorial imagery and album artwork.
Newsletter subscriber records are retained until you unsubscribe or request deletion. Security and access logs are automatically rotated and purged after 30 days. Anonymized reaction aggregates and editorial sentiment tallies are retained indefinitely as historical cultural records.
You maintain full sovereignty over your personal data. Under applicable data protection legislation, you are entitled to:
• Right of Access & Portability: Request an export of all personal data tied to your email address in a readable, structured format.
• Right to Rectification & Erasure: Request immediate correction of inaccurate data or complete deletion (right to be forgotten) from our databases.
• Right to Withdraw Consent: Unsubscribe from newsletters at any time via the link in every email, or adjust your analytics consent preferences directly via the on-site consent manager.
If you have questions, complaints, or wish to exercise any of your data rights, please contact our Data Protection Officer directly at privacy@katamusikku.com. We respond to all formal inquiries within 72 hours.