Privacy Policy
Dalang (dalang.ai.id) is a service that runs AI agents in a private workspace for you. This page explains what data it handles. It is written for the current early-access service, which is run by one person.
What we collect
- Account data. Your email address, and when you sign in with Google or GitHub, the provider's account identifier for you and your verified email. From Google we request only the
openidandemailscopes. We do not read your Gmail, Drive, contacts or calendar, and we do not request offline access to them. - Sign-in sessions. A sign-in cookie. Only a hash of it is stored on the server, together with the creation time, last-seen time, expiry and your browser's user-agent string, so you can see and revoke your sessions.
- Sign-in codes. One-time codes sent by email are kept only as a hash, for a few minutes.
- Workspace content. What you put in your workspace: project files, agent configuration, session transcripts, schedules, and any API keys or CLI logins you add for AI providers. These live in your own workspace volume on our server, are not shared with other users, and are used only to run your workspace.
- Payments and AI credits. If you buy a plan or top up AI credits: the order (amount, date, status, payment reference) and a record of your credit balance. For AI credits we record, per request, the time, workspace, model name, number of tokens and cost, so we can charge your balance. We do not log or keep the prompts or replies themselves.
- Operational logs. Server logs of sign-in events and errors (for example, which account signed in and by which method). Logs do not contain sign-in codes, tokens or secrets.
How we use it
To sign you in, keep your account secure, start and stop your workspace, and operate and debug the service. We do not sell your data, do not show ads, and do not use your workspace content to train models.
Who else sees it
- Duitku processes QRIS payments. When you pay, it receives the order number, the amount, a short product description, your email address and a shortened account ID.
- Resend, our email provider, receives your email address and the message text to deliver sign-in codes, invitations and payment receipts.
- Zoho Mail hosts the support mailbox (
[email protected]). Anything you email us is stored there. - Cloudflare carries traffic to the service and sees it in transit.
- Google and GitHub, only if you choose to sign in with them.
- AI providers. If your agents use Dalang AI credits, the prompts and project content they send go through Dalang's account to DeepSeek or Z.ai (GLM models), depending on the model you pick, and the replies come back the same way. Those providers handle the data under their own terms and privacy policies, and Dalang does not control what they do with it. If you instead use your own API keys or accounts (for example Anthropic, Google, DeepSeek or Z.ai), your agents send the data to those providers with your own credentials, under your agreement with them.
We disclose data to others only if the law requires it.
Where it is stored and for how long
Data is stored on a server operated by us. Account data is kept while your account exists. Sign-in sessions expire after 30 days or when you sign out. Workspace content is kept until you delete it or your account. To close your account and delete its workspace data, email us (see Contact). We do this by hand, on request. We may keep payment records that we need for accounting or legal reasons.
Your choices
- Remove a sign-in method or sign out of all sessions from the account page.
- Delete projects, sessions and API keys inside your workspace at any time.
- Email us to access, correct or delete your data, or to close your account. Deletion is done by hand after your email.
- You can revoke Dalang's access in your Google account at myaccount.google.com/permissions or in your GitHub settings.
Security
Workspaces run in separate containers, access is over HTTPS, and secrets are never written to logs. No system is perfectly secure; keep valuable credentials out of workspaces you do not need them in.
Children
Dalang is not directed at children under 16, and we do not knowingly collect their data.
Changes
If this policy changes materially, we update the date above and tell signed-in users when practical.