Skip to content

Privacy Policy

Last updated: 2026-09-28

This policy explains what data PT Dico Solusi Digital ("we") collects when you use Smart Merge PDF (the desktop app, the web app at https://smartmergepdf.com/app and this website), what it is used for, and your rights, including under Indonesia's Personal Data Protection Law (Law No. 27 of 2022).

1. In short

  • Your files are processed on your device. Merging, splitting, compressing, editing, redaction, form filling and OCR run on your computer or in your browser. Whole files are never uploaded to our servers.
  • The AI reads only the pages you allow. That page text or image is sent to an AI model provider for processing, and we do not store it.
  • We keep only what we need: account data, credit usage records and payment records.

2. Data we collect

  • Account data: email address, name and profile picture (if you sign in with Google, Microsoft, Apple or another provider), and an account ID.
  • Plan & payment data: your plan, order history (order number, amount, currency, status, time) and subscription status. Card and bank details are handled directly by the payment providers; we never receive or store them.
  • AI usage records: token and credit counts, the AI model used, the kind of action (e.g. chat or data extraction) and the time. Document content and conversations are not included.
  • Daily allowance records: for limited features on the free plan we record the feature, the date and a fingerprint (SHA-256 hash) of a file identifier. File names or locations cannot be read from it.
  • Website data: cookieless, aggregated visit statistics via Cloudflare Web Analytics, and technical server logs (e.g. IP address, request time) for security.

3. Document content and the AI assistant

When the AI assistant needs a document's content, the app asks for your permission and names the file and pages to be read (unless you choose "Always allow" in the settings). The permitted page text or images are sent through our server to Google (Gemini API) for processing, and the answer is returned to your app.

Our server stores neither document content nor conversations; it only records usage for credit billing. Google processes that data under the Gemini API terms. Chat history is stored locally on your device and can be deleted from the app at any time.

You control AI access to document content: "Ask every time" (default), "Always allow" or "Never".

4. How we use data

  • To provide the service: sign-in, keeping your plan and credits in sync across web and desktop, and running the AI assistant.
  • To process payments, issue receipts or tax invoices and meet tax obligations.
  • To keep the service secure and prevent abuse.
  • To contact you about your account, payments or important changes.

We process data to perform our agreement with you, to meet legal obligations (such as tax) and with your consent (such as when you let the AI read a page).

5. Processors we use

We use the following providers, some of which process data outside Indonesia, and share only what each one needs:

  • Supabase: database, authentication and server functions (AWS data centre in Canada).
  • Google: the Gemini AI model, only for pages you allow; also a sign-in provider if you choose it.
  • Midtrans: Rupiah payments (QRIS, bank transfer, e-wallets).
  • Creem: international card payments; Creem acts as the merchant of record and handles the buyer's local tax.
  • Cloudflare: hosting of this website and the web app, content delivery and cookieless visit statistics.
  • GitHub: distribution of desktop app updates.

We do not sell your personal data.

6. Storage on your device

The app keeps settings, chat history, AI recipes and recent folders on your device. In the desktop app, the sign-in session and signatures are encrypted with the operating system keychain. In the web app they are kept in this site's browser storage (localStorage/IndexedDB). This website uses no tracking cookies.

7. How long we keep data

  • Account data: while your account is active; deleted after you ask us to delete your account.
  • AI usage and allowance records: used for billing; daily allowance records are deleted automatically after 7 days.
  • Order and payment records: as long as tax law requires (up to 10 years).

8. Your rights

You can ask to access, correct or delete your personal data, withdraw consent and object to certain processing. Email support@smartmergepdf.com from your account address. We respond within the time required by law (within 3×24 hours for requests under Indonesian law).

9. Security

We protect data with encrypted connections (HTTPS), database access rules (each user can read only their own data), API keys kept on the server only and a strict content security policy in the web app. If a personal data breach occurs, we will notify you and the relevant authorities as the law requires.

10. Children

The service is intended for users aged 18 and over, or under the supervision of a parent or guardian.

11. Changes

We may update this policy. We will announce important changes in the app or by email before they take effect.

12. Contact

PT Dico Solusi Digital, Jl. Blok AG 11 No. 7, Citra Indah, Kabupaten Bogor, Jawa Barat, Indonesia. Email: support@smartmergepdf.com. See also the contact page.