Privacy Policy

1. Overview & Scope

This Privacy Policy applies to all users who access, register, or interact with this application powered by Aksara CMS (including websites, backend dashboards, REST APIs, and client-facing interfaces). Throughout this document, terms such as "we", "our", and "us" refer to the operating organization and administrators of this application, while "you" refers to the end-user, visitor, or registered member.

1. Information We Collect

Depending on how you interact with our platform, we may collect the following categories of information:

• Account Information: When you register or create an account, we collect your name, username, email address, avatar photo, phone number (optional), and encrypted password credentials.
• User-Generated Content: Articles, comments, pages, media uploads, and feedback submitted directly through the CMS editor and public contribution forms.
• Technical & Device Data: IP address, browser type and version, operating system, preferred language locale, referring URLs, access timestamps, and device identifiers.
• Session & Authentication Logs: Login attempts, security tokens, last active sessions, and administrative action logs maintained for audit compliance and anomaly detection.

1. How We Use Your Information

We process your personal information strictly for legitimate organizational and technical purposes, including:

• Authentication & Authorization: Verifying user identity, managing session states, and enforcing role-based permissions across backend and frontend modules.
• Content Delivery & Management: Rendering dynamic layouts, managing page publications, and displaying user contributions.
• Security & Threat Prevention: Detecting fraudulent activities, brute-force login attempts, CSRF exploitation, and mitigating Distributed Denial of Service (DDoS) vulnerabilities.
• Communication & Notifications: Sending password reset links, security alerts, system maintenance notifications, and relevant transactional emails.
• Service Optimization: Diagnosing server errors, optimizing database queries, and improving user interface usability.

1. Cookies & Tracking Technologies

Aksara CMS uses strictly necessary cookies and localized browser storage to ensure smooth platform functionality:

• Session Cookies: Temporary cryptographically secure session IDs that maintain your logged-in state across navigation.
• CSRF Token Cookies: Anti-Cross-Site Request Forgery tokens designed to validate that form submissions originate legitimately from your browser.
• Preference Cookies: Cookies storing your selected interface language, theme preferences (light/dark mode), and sidebar state.

You can configure your browser to reject cookies or notify you when cookies are set. However, disabling essential cookies will prevent successful login and dashboard navigation.

1. Data Security & Storage Architecture

We adopt robust technical and organizational security safeguards within Aksara CMS to protect your personal data from unauthorized access, modification, or exposure:

• Cryptographic Password Hashing: Passwords are never stored in plain text. They are hashed using modern cryptographic algorithms (such as Argon2id or Bcrypt with dynamic cost factors).
• Parameterized Query Protection: All database queries leverage prepared statements and active query builders to prevent SQL injection vulnerabilities.
• Role-Based Access Control (RBAC): Granular permissions restrict access to administrative tools and sensitive records only to verified and authorized personnel.
• Encrypted Connections: All web communication is transmitted over Transport Layer Security (HTTPS/TLS).

1. Third-Party Integrations & Processing

In certain configurations, Aksara CMS connects with trusted third-party providers to enhance performance and security. These may include:

• CDN & Cloud Services: Cloudflare or similar Content Delivery Networks for asset caching, SSL termination, and DDoS filtering.
• OAuth Authentication: Third-party sign-in providers (e.g., Google OAuth) when you explicitly choose social login.
• Avatar Services: Gravatar for retrieving public user avatars associated with verified email addresses.
• Email Delivery Providers: SMTP and transactional email gateways (e.g., SendGrid, Mailgun, Amazon SES) used solely to dispatch transactional alerts.
• AI Assistance: When AI-assisted content features are utilized by administrators, prompt inputs are processed in compliance with respective provider privacy standards.

1. Your Privacy Rights (GDPR & Global Standards)

Under global data protection laws (such as GDPR and CCPA), you are entitled to several fundamental rights regarding your personal information:

1. Data Retention & Children’s Privacy

We retain personal records only for as long as your account remains active or as required to fulfill the operational purposes described in this policy. When data is no longer necessary, it is securely purged or anonymized.

Our services are not intended for or directed to individuals under the age of 13 (or under 16 where required by local legislation). We do not knowingly collect personal information from children without verified parental consent.

1. Policy Revisions & Contact Inquiries

We reserve the right to amend this Privacy Policy periodically to reflect technological updates, legal requirements, or changes to platform functionality. Material changes will be communicated via on-site banners or direct announcements.

If you have questions, feedback, or wish to exercise your data privacy rights, please reach out to our team using the contact channels below: