How VECTOR protects your data

Effective 26 October 2026. This English version is provided for convenience; the Indonesian version is the binding one.

In short. Companies use VECTOR to record and handle social incidents around their operating sites. We collect only the data needed for that: your account, the reports you create with their evidence and location, and device data so notifications reach you.

We do not sell data, show ads, or use third-party analytics or tracking. Location is captured only when you mark an incident location, never tracked in the background.

1. Scope of this policy

This policy applies to the VECTOR Android app, the web backoffice at app.vectorsolution.co.id, the services behind both, and the website vectorsolution.co.id. In this policy, "we" means VECTOR as the service provider, and "you" means anyone who uses VECTOR.

The vectorsolution.co.id website itself uses no cookies, forms, or tracking scripts.

2. Our role and your company's role

VECTOR has no public sign-up. Your account is created by the admin of the company you work for, which subscribes to VECTOR for its operational needs.

Under Indonesian Law No. 27 of 2022 on Personal Data Protection, your company is the personal data controller: it decides who gets an account, what is reported, and who may see it. We are the personal data processor, running the service under our agreement with your company. Questions about your company's internal policies are best directed to your company admin.

3. Data we collect

Type of data	What it contains	Where it comes from
Account data	Name, email address, phone number, employee ID (NRP), role and site assignments with their history. Passwords are stored only as hashes.	Your company admin, and you when you change your password
Report content	Incident description, incident type, issue category, time, follow-ups, comments, and evaluations.	You and other users at your company
Involved parties	Names and contact details of people outside the company who are connected to an incident, such as community or organization representatives, as far as they are recorded in a report.	The user who creates the report
Attachments	Photos, videos, and documents you attach as evidence.	You
Incident location	Coordinates marked in a report, from the phone's GPS or from a point you pick on the map.	You, when you mark a location
Device and session data	Push notification token, device name, browser or app type (user agent), IP address, and sign-in and last-active times.	Your device, automatically when you sign in and use VECTOR
Activity log	Who changed what and when, for every change to reports and company data.	Recorded automatically by the system

We do not collect the contacts on your phone, your location history, health data, personal financial data, or the contents of other apps.

4. Android app permissions

The app asks for a permission only when you use the feature that needs it. You can deny or revoke a permission at any time in your phone's Settings. Other features keep working; only the feature that needs that permission becomes unavailable.

Camera: to photograph incident evidence directly from the app.
Photos and media: to choose existing photos, videos, or documents on your phone as attachments.
Location, only while the app is in use: to fill in the incident location automatically. Location is not captured when the app is closed or running in the background.
Notifications: to tell you about new reports, follow-up tasks, and status changes you need to know about.
Internet: to send data to and fetch data from the VECTOR server.

So that it can be used without signal, the app keeps a copy of the reports you are allowed to see on your phone. When you sign out, that copy is deleted. Reports that have not yet been sent stay on the phone until you sign in again and they are sent.

5. What the data is used for

Running the service: creating, routing, and showing reports to the authorized people at your company.
Sending in-app notifications, push notifications, and service emails, such as the code for resetting your password.
Keeping accounts secure: checking permissions on every request, limiting failed sign-in attempts, and revoking sessions that are no longer entitled.
Keeping an audit trail so every record can be accounted for.
Building dashboards and summaries for your company.
Providing technical support when you or your company contact us.

Your data is not used for advertising, not sold, and not used to build profiles beyond what this service needs.

6. Third parties

Your data can be seen only by users at your company within their authority, and by the VECTOR team when needed to run or fix the service. Beyond that, a few third-party services are involved:

Google Firebase Cloud Messaging: delivers push notifications to phones and browsers. It receives the device token and the short notification text.
OpenStreetMap: provides map imagery. When a map is shown, your device fetches map tiles from OpenStreetMap servers, so your IP address is visible to them. Address searches in the backoffice are made by our server to OpenStreetMap's Nominatim service, without your account data.
Server provider: rents the servers that the VECTOR service runs on.

We disclose data to authorities only when required by applicable law.

7. Storage and security

All traffic between your device and the server goes over HTTPS.
Passwords are stored as hashes and cannot be read by anyone, including us.
Sign-in tokens on the phone are kept in Android's secure system storage.
Attachments can only be opened by people entitled to see the report.
A deactivated account loses access immediately, including on devices that are still signed in.
The database is backed up regularly.

No system is completely immune. If a data protection failure involving your data occurs, we will inform your company as required by applicable rules so that you can be told promptly.

8. How long data is kept

Reports, attachments, and activity logs are kept for as long as your company subscribes, because they serve as auditable records. An attachment removed from a report is kept temporarily before permanent deletion, so that the removal itself can be traced.
Account data is kept while your account is active. When you no longer work at that company, the account is deactivated and its history is kept so that old reports can still be traced to their author.
Sessions are revoked when you sign out, change your password, or when the account is deactivated. Device notification tokens are deleted when you sign out from that device or when the account is deactivated.
After the subscription ends, company data is handed over or deleted as agreed with your company.

9. Your rights

Under the Personal Data Protection Law, you have the right to:

know about and obtain a copy of your personal data;
correct personal data that is wrong or incomplete;
request deletion or restriction of the processing of your personal data;
object to the processing of your personal data.

Because your company is the data controller, requests are handled fastest through your company admin. You can also contact us directly at support@vectorsolution.co.id. We will forward the request to your company and help carry it out.

10. Deleting your account and data

VECTOR accounts are created and managed by your company, so there is no delete-account button inside the app. To request account deletion:

Contact your company admin, or
Email support@vectorsolution.co.id from the email address registered on your account, with the subject "VECTOR account deletion request" and your company name.

Once the request is confirmed with your company:

your account is deactivated so it can no longer be used to sign in;
all your sessions are revoked and your device notification tokens are deleted;
other profile data that is no longer needed, such as your phone number, is deleted if your company as the data controller agrees.

Reports, comments, and activity records you created remain part of the company's records, because they may be needed for an audit. Your name stays listed as their author. We will respond to your request within 30 days of receiving it.

11. Age limit

VECTOR is a work application for company employees and is not intended for anyone under 18.

12. Changes to this policy

This policy may be updated as the service changes. The effective date is always shown at the top of this page. For important changes, we inform your company first.

13. Contact us

Questions about this policy or about your data can be sent to support@vectorsolution.co.id.