Layarva Privacy Policy

Effective Date: 20 August 2026
Last Updated: 23 August 2026

This Privacy Policy explains how Layarva, operated by CV DNA Konsultan ("Layarva", "we", "us", or "our"), collects, receives, uses, processes, stores, shares, transfers, protects, retains, and deletes Personal Data when you use the Layarva website, dashboard, Studio, digital signage player, Queue Management, Public API, integrations, and other Layarva Services.

We seek to process Personal Data lawfully, transparently, proportionately, only as necessary, and consistently with the purposes for which it is processed.

1. Scope

This Privacy Policy applies to processing through:

• the Layarva website;
• web applications;
• Accounts and Workspaces;
• Studio;
• media management;
• content management;
• signage players;
• device management;
• Screen management;
• Queue Management;
• the Public API;
• customer support;
• Google Sign-In;
• Google APIs;
• third-party integrations;
• billing; and
• other Layarva features.

2. Layarva's Role in Data Processing

Depending on the context, Layarva may act as a Personal Data Controller or a Personal Data Processor.

2.1 As a Controller

Layarva generally acts as a Controller for data used for:

• Account creation;
• authentication;
• Subscriptions;
• billing;
• customer support;
• security;
• device management;
• administration; and
• platform operations.

2.2 As a Processor

Layarva may act as a Processor where a Customer uses the Services to store or process Personal Data for purposes determined by the Customer.

In that context, the Customer is responsible for determining the appropriate lawful basis and purpose of processing.

The Controller-Processor relationship may be further governed by a Data Processing Addendum.

3. Data We Process

3.1 Account Data

We may process:

• name;
• email address;
• user identifier;
• organization name;
• role;
• permissions;
• profile information;
• authentication information;
• account preferences; and
• other administrative information.

3.2 Organization and Workspace Data

We may process information relating to:

• organizations;
• Workspaces;
• team members;
• roles;
• permissions;
• Screens;
• channels;
• playlists;
• templates;
• projects;
• resources; and
• organization configuration.

3.3 Subscription and Billing Data

We may process:

• Subscription type;
• start date;
• expiration date;
• invoices;
• payment status;
• transaction references;
• billing information; and
• payment-administration records.

Certain payment-method details may be processed directly by a payment provider and may not be stored by Layarva.

3.4 Customer Content

We may process Content you upload or create, including:

• images;
• videos;
• audio;
• animations;
• text;
• fonts;
• documents;
• designs;
• templates;
• playlists;
• schedules;
• files;
• API payloads; and
• other materials.

Content may be processed for functions including:

• upload;
• storage;
• editing;
• rendering;
• transcoding;
• caching;
• synchronization;
• distribution;
• backup; and
• playback.

3.5 Screen and Device Data

We may process technical information about Screens and Devices, including:

• device identifiers;
• device UUIDs or similar identifiers;
• pairing information;
• platform;
• operating system;
• application version;
• IP address;
• heartbeat;
• connection status;
• Screen status;
• synchronization status;
• cache status;
• timestamps;
• error information;
• diagnostic information; and
• configuration data.

This information is used to provide and maintain device-management functionality.

3.6 Screen Location and Coordinates

Layarva allows authorized Users to provide information about a Screen's installation or operational location.

This information may include:

• latitude;
• longitude;
• location name;
• location label;
• address;
• associated Screen identifier; and
• other location information entered by the User.

Source of Coordinates

Screen location coordinates are provided and entered by the User.

Layarva does not automatically collect GPS location, background location, or geographic coordinates from a Screen merely because a Device is connected to Layarva.

Accordingly, these coordinates are user-provided Screen location information.

Purpose of Use

Screen location information may be used to:

• record a Screen's installation location;
• identify a Screen's operational location;
• display Screens on a dashboard or map;
• help manage Screens across multiple locations;
• search for or group Screens by location;
• support troubleshooting;
• provide support; and
• provide other operational functions directly related to Screen management.

Accuracy

Because Screen location information is provided by Users, the User or Customer organization is responsible for the accuracy of the coordinates or other location information entered.

Users with the appropriate permissions may update that information.

No Continuous User Tracking

Layarva does not use user-provided Screen coordinates to perform background or continuous tracking of an individual's movements.

Screen coordinates are intended to identify a Screen's location, not a User's real-time location.

Advertising

Layarva does not sell Screen coordinates to advertising networks or data brokers for location-based advertising.

3.7 Queue Management Data

If Queue Management is used, we may process operational information such as:

• service name;
• queue number;
• ticket time;
• call time;
• counter;
• operator;
• queue status;
• service status; and
• activity logs.

Customers may choose to enter additional Personal Data into Queue Management.

Where they do so, the Customer is responsible for ensuring an appropriate lawful basis for that processing.

3.8 Public API Data

We may process:

• API key identifiers;
• endpoints;
• timestamps;
• IP addresses;
• HTTP status;
• usage;
• quotas;
• errors;
• rate-limit information; and
• security events.

This information may be used for:

• authentication;
• security;
• monitoring;
• troubleshooting;
• rate limiting;
• auditing; and
• reliability.

3.9 Customer Support Data

When you contact us, we may receive:

• name;
• email address;
• message content;
• screenshots;
• diagnostic information;
• files; and
• other information you choose to provide.

3.10 Integration Data

If you enable a third-party integration, we may receive data in accordance with the permissions you grant through that provider.

3.11 Cookies and Similar Technologies

Layarva may use:

• cookies;
• session storage;
• local storage; and
• similar technologies

for authentication, security, preferences, application functionality, and appropriate analytics.

4. Sources of Data

We may obtain data:

1. directly from you;
2. from your organization administrator;
3. through your use of the Services;
4. from Screens or Devices for technical operational data;
5. through the Public API;
6. from service providers;
7. through integrations you enable; or
8. from another source where there is a lawful basis.

Screen location coordinates are not automatically collected by Layarva and are obtained from information entered by Users.

5. Purposes of Processing

We may process data to:

• provide the Services;
• create and manage Accounts;
• authenticate Users;
• authorize access;
• manage Workspaces;
• pair Devices;
• manage Devices;
• manage Screens;
• manage Screen location information;
• provide storage;
• distribute Content;
• synchronize Content;
• support offline caching;
• provide Queue Management;
• provide the Public API;
• administer billing;
• manage Subscriptions;
• provide customer support;
• troubleshoot;
• log system activity;
• monitor system health;
• protect security;
• prevent fraud;
• respond to incidents;
• improve stability and reliability;
• comply with legal obligations; and
• protect the rights of Layarva, Customers, Users, or others.

6. Lawful Bases for Processing

Depending on the context, processing may be based on:

• performance of a contract;
• consent;
• compliance with legal obligations;
• legitimate interests where permitted by law; or
• another lawful basis recognized by applicable law.

Where processing relies on consent, you may withdraw that consent in accordance with applicable law and available mechanisms.

7. Google Sign-In and Google APIs

This section applies if a User chooses Google Sign-In or connects a Google service to Layarva.

7.1 Google Data That May Be Accessed

Depending on the functionality and permissions you approve, Layarva may receive basic Google account information such as:

• name;
• email address;
• profile information; and
• Google user identifier.

If you enable an integration such as Google Drive, Layarva may request access to the data or files necessary to provide the feature you selected.

The type of access depends on the OAuth permissions displayed to you.

7.2 Purpose of Using Google User Data

Google user data is used only to provide or improve Layarva functionality that is relevant and visible to the User.

Examples may include:

• authentication;
• connecting an account;
• selecting files;
• accessing authorized files;
• importing Content; or
• operating an integration feature explicitly enabled by the User.

7.3 Minimum Permissions

Layarva seeks to request OAuth scopes that are appropriate and relevant to the feature being used.

We do not intend to request access to Google user data that is unnecessary for the available functionality.

7.4 Google API Services User Data Policy

Layarva's use and transfer of information received through Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements where applicable.

7.5 Advertising

Layarva does not sell Google user data.

Google user data is not used for:

• personalized advertising;
• interest-based advertising;
• retargeting; or
• sale to data brokers.

7.6 Human Access

Human access to Google user data is restricted.

Such access may occur where:

• the User specifically requests support and provides the necessary permission;
• access is necessary for security or abuse investigation;
• access is required by applicable law; or
• use of aggregated data is permitted under applicable policies and law.

7.7 Sharing

Google user data may be shared only to the extent necessary to provide requested functionality, protect security, comply with legal obligations, or as otherwise permitted under applicable Google policies.

7.8 OAuth Tokens

OAuth tokens or related credentials may be stored while the relevant integration remains connected and requires the credential to operate, or until the credential is revoked, expires, is replaced, is disconnected by the User, or is deleted in accordance with the integration lifecycle and applicable legal obligations.

We seek to protect those credentials against unauthorized access.

7.9 Disconnecting Google

Users may revoke Google access:

• through Layarva functionality where available; or
• through their Google Account settings.

After access is revoked, Layarva will stop using the applicable credentials to obtain new Google user data.

Data previously imported or stored may remain subject to Layarva's retention policy unless the User requests deletion or another legal obligation applies.

8. Sharing and Service Providers

We may use service providers to help operate the Services, including providers of:

• cloud infrastructure;
• hosting;
• databases;
• storage;
• Content Delivery Networks;
• authentication;
• email;
• payment processing;
• analytics;
• logging;
• monitoring;
• mapping;
• customer support;
• security; and
• backups.

Service providers should receive access only to the extent necessary to perform their functions.

We may share data in certain circumstances with:

• administrators of a Customer organization;
• service providers;
• competent authorities where required by law; or
• parties to a lawful corporate transaction subject to appropriate protections.

We do not sell Personal Data to data brokers.

9. Cloud Infrastructure and Processing Locations

Layarva uses a cloud architecture.

Data may be stored or processed:

• in Indonesia;
• outside Indonesia; or
• across multiple locations.

Data may be processed, replicated, cached, backed up, or transmitted across multiple regions to support:

• availability;
• reliability;
• performance;
• scalability;
• security;
• disaster recovery; and
• continuity.

Technical locations may change from time to time.

Unless expressly agreed in a written contract, Layarva does not guarantee storage in a specific country or region.

Changes to technical locations that do not materially change the purpose or nature of processing may not result in individual notice.

If a change materially affects Personal Data processing practices, or if notice is required by applicable law, we will provide appropriate notice.

10. Cross-Border Data Transfers

Where Personal Data is transferred to a party or infrastructure outside Indonesia, Layarva will apply transfer mechanisms required by applicable law.

Such mechanisms may include:

• ensuring an appropriate level of protection;
• implementing adequate contractual or binding safeguards; or
• relying on another transfer basis permitted by applicable law.

11. Data Retention

We seek not to retain Personal Data longer than necessary for the purposes for which it is processed.

11.1 Active Paid Subscriptions

Data required to operate the Account, Workspace, features, Content, and Services may be retained while the paid Subscription remains active, subject to the lifecycle applicable to each data type and feature in use.

A paid Account is not treated as dormant merely because a User has not logged in.

11.2 Expired Paid Subscriptions

If a paid Subscription expires and is not renewed, Layarva may retain Customer Operational Data and Customer Content for up to:

180 days from the Subscription expiration date.

The deletion deadline is based on the expiration date, not the User's most recent login.

Logging in during the retention period does not reset the 180-day period.

If the Subscription is reactivated before the deletion date, the deletion process may be cancelled.

11.3 Free Accounts

A Free Account may be classified as dormant after:

180 days without qualifying activity.

Qualifying activity may include login, Screen use, Device activity, content management, API activity, publishing, or other activity demonstrating actual use of the Services.

For Free Accounts, qualifying activity may update the last-activity date.

11.4 Customer Content

Media, projects, playlists, templates, configuration, and Workspace data generally follow the lifecycle of the relevant Account and Subscription.

11.5 Screen Location Information

Latitude, longitude, location names, and other location data entered by a User generally follow the lifecycle of the relevant Screen, Workspace, and Account.

If a Screen or Workspace is deleted, associated location information may also be deleted in accordance with the retention policy.

11.6 Device Data

Pairing information, Device configuration, and Screen operational data may be deleted when no longer required or after the Account lifecycle ends, unless a longer period is necessary for security or legal obligations.

11.7 Billing and Legal Records

Invoices, payment evidence, accounting records, tax records, and certain other documents may be retained for longer periods where required by law or reasonably necessary for a lawful legal purpose.

11.8 Technical Log Retention

Layarva applies standard retention periods based on technical log categories that can be identified by the system:

A log category is determined by the technical function and source of the record when it is created. If administrator or User activity is recorded in one of those log categories, the record follows the retention period of the technical category in which it is stored.

If administrator or User activity is recorded in one of the categories above, the record follows the retention period of the technical category in which it is stored.

After the applicable retention period expires, logs may be automatically deleted as part of normal system lifecycle, housekeeping, and storage management.

Layarva does not guarantee the availability of historical logs after the applicable retention period has expired.

Investigation and Evidence Export

If Layarva receives or becomes aware of a security incident, investigation, audit, dispute, claim, or valid legal request while relevant logs are still available, authorized personnel may search for and export records reasonably necessary for that purpose into a separate file.

The exported file may be retained for a maximum of 365 days from the date the export is created, and may be deleted earlier when it is no longer required for the related purpose.

If applicable law or a valid and binding order specifically requires a longer retention period, the exported file may be retained to the extent and for the period required by that obligation.

Creating or retaining an export file does not suspend, extend, or otherwise change the retention lifecycle of the source logs. Source logs continue to follow their normal retention periods.

If a log or other data has already been deleted, anonymized, overwritten, or otherwise become unavailable through the normal system lifecycle before a request is received, Layarva is not required to recover, reconstruct, recreate, or provide that record, to the extent permitted by applicable law.

Layarva can only provide records that remain available when a request is processed or records that were previously exported and retained separately.

Layarva is not required to preserve logs specifically for a possible future investigation, dispute, claim, or legal proceeding before receiving a valid and sufficiently specific request, notice, or binding order concerning the relevant data.

The unavailability of data that has aged out of the system in accordance with the applicable retention lifecycle does not by itself constitute a Service failure, unlawful data loss, or breach by Layarva.

Nothing above limits obligations that mandatorily apply under applicable law or under a valid and binding order received by Layarva.

11.9 Backups

Data may temporarily remain in backups after deletion from the production environment.

Such data will age out in accordance with the applicable backup lifecycle.

Backups are not intended to function as operational storage for a deleted Account and are not intended to function as an archive of historical logs that have aged out of the applicable production retention period.

Retention in backups does not guarantee that a particular log or item of data can be recovered or provided again after it is no longer available in production systems.

If recovery is required because of a technical disruption, Layarva will use reasonable recovery efforts based on backups or other recovery mechanisms that remain available, but successful recovery is not guaranteed in every circumstance.

12. Account and Data Deletion

After the applicable retention period ends, Layarva may delete or anonymize data such as:

• operational Account data;
• Workspaces;
• profile data;
• media;
• projects;
• playlists;
• templates;
• Device configuration;
• pairing information;
• Screen coordinates;
• API configuration;
• Queue configuration; and
• other operational data.

Before deletion due to expiration or dormancy, Layarva will use reasonable efforts to provide notice by email or another available mechanism.

After deletion is completed, data may become unrecoverable.

Where required by applicable law, Layarva will provide notice regarding deletion or destruction of Personal Data.

13. User-Initiated Deletion Requests

Users may request deletion of Personal Data or closure of an Account through an available mechanism or by contacting Layarva.

We may verify identity before processing a request.

Certain data may continue to be retained where retention is specifically required by applicable law, including accounting records, tax records, or other records subject to an independent retention obligation.

In addition, an evidence file or export created before the deletion request may remain stored in accordance with the applicable Evidence Export retention period, which is a maximum of 365 days from the date the export is created, unless it is deleted earlier or a longer period is specifically required by applicable law or a valid and binding order.

A deletion request does not require Layarva to recover or recreate data that was already unavailable through the normal system lifecycle when the request was received.

14. Data Subject Rights

Subject to applicable law, you may have the right to:

• receive information about processing;
• access Personal Data;
• obtain a copy of Personal Data;
• correct Personal Data;
• update Personal Data;
• withdraw consent;
• request restriction or termination of processing;
• request deletion or destruction;
• object to certain processing;
• receive data portability where applicable;
• object to certain fully automated decisions where applicable; and
• exercise other rights provided by applicable law.

We may request additional information to verify the identity or authority of the person making the request.

15. Data Security

We use technical and organizational measures appropriate to the type and risk of the data processed.

Measures may include:

• authentication;
• authorization;
• role-based access;
• encryption for appropriate data in transit or storage contexts;
• credential protection;
• security logging;
• monitoring;
• backups;
• network protection;
• access restrictions; and
• incident response.

No electronic system can be guaranteed to be completely free of risk.

16. Data Breaches and Security Incidents

If a Personal Data protection failure occurs, Layarva will take appropriate actions that may include:

• investigation;
• containment;
• mitigation;
• recovery;
• documentation; and
• notification where required by applicable law.

Notifications will be provided within the time period and to the parties required by applicable law.

17. Customer Data Processed on Behalf of an Organization

If a Customer uses Layarva to process Personal Data relating to employees, customers, visitors, patients, members, or other individuals, the Customer is responsible for ensuring that:

• an appropriate lawful basis exists;
• required notices have been provided;
• consent has been obtained where necessary;
• access is appropriately restricted; and
• the data is used in compliance with applicable law.

In that context, Layarva may act as a Processor in accordance with the Customer's instructions.

18. Cookies

Layarva may use cookies necessary for:

• login;
• session management;
• authentication;
• security;
• preferences; and
• core application functionality.

If non-essential cookies or technologies are used and applicable law requires consent, they will be managed through an appropriate consent mechanism.

19. Analytics

We may process technical usage information to understand:

• performance;
• errors;
• reliability;
• feature usage; and
• system health.

Analytics data is not used to sell Personal Data to data brokers.

20. Marketing Communications

We may send communications about products or services where an appropriate legal basis exists.

Users may opt out of marketing communications through the available unsubscribe mechanism.

Important communications relating to security, Accounts, billing, expiration, deletion, or Service administration are not treated as ordinary marketing communications.

21. Children's Privacy

Layarva is primarily a platform for businesses and organizations and is not a consumer service specifically directed to children.

If an organization uses Layarva in a context involving children, the organization is responsible for ensuring that processing complies with applicable requirements relating to children's data.

22. Automated Decision-Making

Layarva does not intend to use Personal Data for solely automated decisions that produce legal effects or similarly significant effects on individuals unless the relevant feature is specifically introduced with an appropriate lawful basis and safeguards.

If this practice changes, relevant information will be provided as required by law.

23. Change of Ownership or Restructuring

If Layarva undergoes a merger, acquisition, restructuring, sale, or change of legal entity, data may be transferred as part of a lawful transaction.

Processing and notification will be handled in accordance with applicable legal obligations.

24. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• products;
• integrations;
• infrastructure;
• technology;
• security;
• operations; or
• law.

If a change materially affects how we process Personal Data, we will provide notice as appropriate.

The "Last Updated" date identifies the current version.

25. Language Versions

This Privacy Policy may be made available in Indonesian and English.

Both versions are intended to communicate the same substance. If there is an inconsistency or difference in interpretation between the Indonesian and English versions, the Indonesian version will be used as the reference to the extent permitted by applicable law.

26. Privacy Contact

For questions, requests, or complaints regarding Personal Data:

Layarva
Operated by: CV DNA Konsultan
Address: Jl. Arabika 8 Blok AA 1 No. 9, RT.001/RW.005, Pondok Kopi, Duren Sawit, Jakarta Timur, DKI Jakarta 13460, Indonesia
Email: halo@layarva.com

Suggested email subject:

Privacy Request – Layarva