Phylex Scan Privacy Policy

Effective 2 November 2026 · Updated 7 November 2026 (retention of prospective client check results and reports; earlier on 6 November: legal basis per purpose, transfers outside Indonesia, data breach notification, law enforcement requests, PSE registration, prospective client contacts) · Draft version 2026-11i

1. Who we are
2. Data we collect
3. How we use data
4. Site analytics
5. Where data is stored and who processes it
6. How long we keep data
7. Security
8. Your rights
9. Contact

1. Who we are

Phylex Scan is a web application security scanning service from Phylex (Phoenix Stratos Secura), a business unit of PT FOINIKS DIGITAL, Jl. Kyai Maja No. 31C, Kebayoran Baru, South Jakarta 12120, Indonesia, registered as a Private Electronic System Operator (PSE) with the Ministry of Communication and Digital Affairs (PB-UMKU 812001414217800110001, 6 November 2026). For account and organization data, we are the data controller. For data that comes from the assets you scan, we process it on behalf of, and on the instructions of, your organization.

2. Data we collect

We do not ask for payment card data in the app. We do not use advertising cookies, third-party cookies, or third-party trackers (such as Google Analytics or social media pixels) on the site or in the Phylex Scan console.

3. How we use data

• To run the service: signing in, verifying asset ownership, running scans, and producing findings and reports.
• To make sure scans only target assets you own or are authorized to test. Ownership proof is re-checked before every scan.
• To send notifications: scan summaries, new vulnerability alerts, and ticket replies.
• To provide support, enforce plan limits, prevent abuse, and meet legal obligations.
• To produce the results of assessment services you order (e.g. the PDP Readiness Check report). These are filled in and read only by the Phylex team handling the service, are not used for anything else, and are kept in your organization's workspace.
• To respond to questions you send through the "Contact us" form. We do not use this data for bulk marketing without your consent.
• To follow up with prospective clients who have already communicated with our team (for example by exchanging business cards, chat, phone, or a meeting) and agreed to be contacted by email: preparing discussion material from a light technical check of the company's public website and sending offer emails. Every email is approved by management before it is sent, states why you are receiving it, and includes an unsubscribe link. We do not use purchased email lists or addresses collected without contact.

Legal basis

Each purpose above relies on one of the legal bases in Article 20(2) of Indonesia's Law No. 27 of 2022 on Personal Data Protection (PDP Law):

Where processing relies on consent, you can withdraw it at any time using the contact details in section 9; withdrawal does not affect processing carried out before it. Where processing relies on legitimate interest, you can object and we will assess your objection.

We do not sell your data, and we do not use your scan results to train models or for any third party's purposes.

4. Site analytics

To understand where visitors come from and which pages are useful, we run our own first-party analytics. The data is not sent to any third-party analytics or advertising service.

• What we record per visit: the page opened, the referring site's domain (not its full address), UTM campaign parameters (source, medium, campaign), approximate country and city, the site language used, and device type (phone, tablet, or desktop).
• IP addresses are not stored. Your IP is used only momentarily on our server to estimate your country, either from a header added by our network provider or from a GeoIP database kept on our own server (never sent to anyone else), and to limit excessive requests. It is then discarded.
• Stored as aggregates. Visit data is stored as daily counts (for example, "12 sessions from Google today"), not as a history per person.
• No cookies. Your browser keeps a few values in localStorage: a random session ID (phx_sid), the date and time of your last visit (phx_day, phx_seen), the source of your first visit and current session (phx_ft, phx_st), and your language choice (phx_lang). These values contain no personal data, and you can clear them at any time in your browser settings.
• When you sign up, the source of the session in which you signed up (for example, "Google organic, homepage") is copied to your account, so we can see which channels lead to sign-ups, trials, and subscriptions. In this report our internal team only sees your email in masked form.
• GeoIP database: IP Geolocation by DB-IP (CC BY 4.0 license), stored and used on our own server.
• Bots and crawlers are not counted. If your browser sends a Global Privacy Control or Do Not Track signal, no analytics events are sent.
• Retention: daily aggregates and sign-up attribution records are deleted automatically after 13 months. Attribution copied to your account is kept while the account is active, like other account data.
• Legal basis: our legitimate interest in measuring and improving the service, with data minimized in line with Indonesia's Law No. 27 of 2022 on Personal Data Protection. You can object using the contact details below.

5. Where data is stored and who processes it

Scanning runs entirely on our own infrastructure. Our scanning tools do not send your asset data to third-party services; features that rely on third-party servers (such as out-of-band testing) are disabled. For threat intelligence we only download public catalogs (such as CISA KEV) and never send your data to those sources.

Requests from law enforcement

We do not sell data. As a registered private PSE, we provide access to our Electronic System and Electronic Data for supervision and law enforcement only as required by law and through official requests; no other party is given access to our systems. We disclose personal data to investigators, prosecutors, judges, or other competent authorities only on a valid written request that states the legal authority, the data subject, the type of data, and the period concerned (Government Regulation 33/2026, Article 155). Our Personal Data Protection Officer verifies each request for authenticity and completeness, limits the disclosure to relevant data, hands it over securely, and records it. For data we process on behalf of your organization, we notify the organization owner unless the authority or the law prohibits it. We do not act on verbal requests or requests sent by text message.

Transfers outside Indonesia

Some personal data is processed outside Indonesia by the providers in the table above, in line with Article 56 of the PDP Law:

• Google Firebase Authentication: sign-in data (email, name, profile photo) may be processed in Google data centers outside Indonesia.
• Google Vertex AI (global location): only masked finding data and questions, plus domain names and technical check results for prospective client discussions, as described above.
• Resend: recipient email addresses and notification summaries are processed on Resend servers outside Indonesia.

The core service data (organizations, assets, scan results, findings, tickets, invoices, and audit logs) stays in Google Cloud in the Jakarta region. For every transfer outside Indonesia we ensure adequate and binding safeguards: data processing terms that bind the provider to process data only on our instructions and keep it secure, encryption in transit, and minimizing and masking data before it is sent. You can ask for more information about these transfers using the contact details in section 9.

The Phylex Assistant is the only feature that sends finding data outside the Jakarta region, and only in the masked form described above. "Ask the Assistant" chat history is stored in Google Cloud in Jakarta with your organization data and is deleted when you click "Mulai percakapan baru" (start a new conversation) in the Assistant panel.

6. How long we keep data

• Raw scan output files in cloud storage are deleted automatically after 90 days.
• Findings, reports, and triage history are kept while your organization's account is active, so you can see trends and evidence of fixes for audits.
• Assets you delete are hidden and their schedules stopped; their scan history is kept as an audit trail until you request deletion.
• Assessment service results (e.g. the PDP Readiness Check) are kept in your organization's workspace while the organization is active, so they can be compared with a later re-assessment. You can download them any time from Account & data and ask for their deletion any time at support@foiniks.com; we delete them within 14 days of the request. Other material you send for the session (outside the workspace) is deleted 30 days after the report is delivered.
• Prospective client contacts who do not become clients are reviewed and deleted no later than 24 months after the last communication. If you unsubscribe, we keep only a fingerprint (hash) of your email address so you are not emailed again.
• Light technical check results and quick check reports on a prospective client's website (HTTPS/TLS check, clean-site check from search engine results, and numbered PDF reports) are deleted automatically 12 months after they are created, or 90 days after we mark the prospect as not proceeding. Reports can be deleted earlier on request.
• Site analytics aggregates and sign-up attribution are deleted automatically after 13 months.
• Organization closure and account deletion: as soon as you make the request, new processing (scans, schedules, intel alerts, the Assistant, invites, new bills) stops. Data is permanently deleted after a 14-day grace period, or within an hour if you choose "Delete now". Deleted: assets, scan login credentials, scan history and raw files, findings, alerts, tickets, Assistant conversations, invites, assessment service results, memberships, profile, and sign-in account.
• After deletion we keep only what the law requires or permits:
  • bills, tax invoices, and transfer receipts for 10 years (tax record retention, Indonesian General Tax Law Art. 28(11)), without the creator's email;
  • audit log and RoE documents of a closed organization for 2 years, as proof that every scan was authorized by the asset owner; IP addresses of users who deleted their account are cleared;
  • the company email domain of a closed organization for 2 years, to prevent repeated free trials.
  After that period the data is deleted automatically.
• Outside the Phylex database: server logs in Google Cloud Logging (which may contain an email address when sending fails) are deleted automatically after 30 days, and email delivery records at Resend follow Resend's retention. "Contact us" form messages from the same email address are deleted along with the account.
• If you want retained data (bills, audit log, RoE) deleted earlier, send a request from your account email to support@foiniks.com. Bills and payment receipts cannot be deleted before 10 years because of a legal obligation; for the audit log and RoE we assess your request and reply in writing.
• If a member deletes their account, the organization's data (assets, findings, tickets) stays with the organization; their name on tickets becomes "Deleted user" and their email is removed from organization records.

7. Security

• All connections use HTTPS. Data in Google Cloud is encrypted at rest.
• Data access is isolated per organization; users from other organizations cannot see your assets or findings.
• Phylex staff access is limited by role (executive, security analyst, customer service) and recorded in the audit log.
• Every report download is logged.
• The site analytics report can only be opened by the Phylex executive role; access is enforced on the server and in database rules, not just hidden in the interface.

Data breach notification

If a personal data protection failure occurs (for example a leak or unauthorized access), we notify the affected data subjects and the personal data protection supervisory authority in writing within 3 × 24 hours of becoming aware of it, as required by Article 46 of the PDP Law. The notice states which personal data was exposed, when and how it was exposed, and the steps we are taking to handle it and recover. In certain cases set by regulation, we also notify the public. If the failure involves data we process on your organization's instructions (such as scan results), we notify the organization owner within the same time so it can meet its own obligations.

8. Your rights

Under Indonesia's Law No. 27 of 2022 on Personal Data Protection, you have the right to:

• be informed about how your personal data is processed;
• access and obtain a copy of your data in a machine-readable format you can move to another service;
• correct inaccurate data;
• request deletion of your data or closure of your account, and suspension or restriction of processing;
• withdraw consent and object to certain processing.

Users in the European Union have the same rights under the GDPR (access, portability, erasure, restriction, and objection; Articles 15–21).

Do it yourself in the console, account menu → Account & data (or phylex.foiniks.com/akun):

• Download account data (JSON) for every user, and download organization data (a ZIP with JSON files plus RoE documents and transfer receipts) for owners. Scan reports can also be downloaded as PDF, CSV, Markdown, or JSON depending on your plan.
• Close an organization (owners) and delete your account (every user), with confirmation and the grace period described in section 6. The last owner of an organization that still has members must hand over the owner role first.

Step-by-step instructions are in the Account & data guide. For other rights, or data not linked to an account (such as the "Contact us" form), send a request to the address below. We respond to requests for access, correction, and suspension or restriction of processing within 3 × 24 hours as required by the PDP Law, and to other requests within the time set by applicable regulations.

9. Contact

PT FOINIKS DIGITAL — Phylex
Jl. Kyai Maja No. 31C, Kebayoran Baru, South Jakarta 12120, Indonesia
Email: support@foiniks.com