Privacy Policy

1Who we are and what this covers

CEO Table is a personal planning and finance tool operated by PT Aktiva Multi Inovasi, a limited liability company incorporated under the laws of the Republic of Indonesia and domiciled in Bogor, West Java, Indonesia (“CEO Table”, “we”, “us”). We are the Personal Data Controller for everything described here, in the sense Law 27/2022 gives that term.

This policy covers the CEO Table website and the application behind it. It does not cover any other site you reach from a link here — those sites have their own policies, and we do not control them.

We are an Indonesian company, so Law 27/2022 on Personal Data Protection is the floor this policy has to meet, and the Terms & Conditions are governed by Indonesian law. We have written this to a broader international standard than that floor on purpose: the rights in section 10 are available to everyone who uses CEO Table, wherever you are, and we do not ask which country you are in before honouring one.

2What we collect

Your account

Your email address, and either a password or the fact that you signed in with Google. Your password is hashed by our authentication provider and is never visible to us in readable form. If you sign in with Google, we receive your email address and basic profile information from Google, not your Google password.

How you work

The settings that make a plan realistic: your display name, timezone, working hours, which days you work and for how long, your realism factor, your energy hours, your morning ritual preference, your scoring weights, and your theme.

Your work itself

Everything you put into the product: task titles and free-text notes, projects, sub-projects, goals, deadlines, effort estimates, the daily plans we generate for you, and your recurring commitments such as weekly meetings and classes.

Information about other people

When you record a stakeholder or note that you have delegated a task to someone, we store that person’s name and the details you attach to it. Those people have not signed up for CEO Table and will not be told that you named them. You are responsible for making sure you are allowed to record that information, and for keeping it to what you actually need. We do not contact them, and we do not build profiles of them.

How you actually spend time

Timing and behavioural data generated as you use the product: when you start, pause and finish work on a task, how long each session ran, what you deferred and how often, what you completed, and an event log of the actions that changed your plan. This is what makes capacity forecasting and the weekly review possible.

Billing

Your subscription status, plan, renewal date, the customer and subscription identifiers issued by Stripe, and any discount code you redeemed. Your card details never reach CEO Table. Payment details are entered on Stripe’s own pages and stay with Stripe.

Your finances

If you use Finance: the accounts you add (their name, bank or provider, type, currency, opening balance and credit limit), the transactions you record or import (amount, date, account, category, who it was with, notes and project), your categories, budgets and repeating transactions, exchange rates you enter yourself, and how your bank’s statement file is laid out so the next import can read it. Receipts you attach, as photos or PDFs, are kept in private storage that only your account can open.

A bank statement you import is read in your browser. Only the rows you choose to import reach us, as transactions; the file itself is not uploaded or kept. CEO Table never connects to your bank, never asks for your bank log-in, and cannot move money.

Brain dumps

The text you write into Brain Dump, and any photos you attach to it, and anything you type into Finance’s “Describe it” box. See section 5 — these are the only places where your raw input leaves our systems.

API keys

If you create keys for the CEO Table API: each key’s name, the access you gave it, and when it was made, last used, set to expire or revoked. We keep a one-way fingerprint of each key, never the key itself, so we could not show it to anyone again. To enforce the API’s rate limit we count each key’s requests per minute and delete those counts after two days. When an app sends a request with an idempotency key, we keep our answer to it for 24 hours, so a retry cannot do the same thing twice.

Technical data

Ordinary server and connection information, including your IP address, is processed by our hosting provider as a normal part of serving a web application and keeping it secure.

3How we use it

We use what we collect to:

• run the product — score your tasks, build your daily plan, forecast your capacity, and produce your weekly review;
• create and secure your account, and sign you in;
• take payment, manage your subscription, and honour discount codes;
• answer you when you contact support;
• find and fix faults, and protect the service against abuse and fraud;
• meet obligations we cannot avoid, such as keeping accounting records.

We do not sell your data. We do not share it with advertisers. We do not use the contents of your tasks to build a profile of you for anyone else’s benefit, and we do not analyse your work across accounts.

The claim on our home page that your work stays private means what it says here: it is not sold, not published, and not visible to other users. It does not mean that no service provider ever processes it — section 6 lists the ones that do, and why.

4Our legal bases

Article 20(2) of Law 27/2022 requires us to name a basis for each kind of processing. Ours are:

• Performance of a contract — running your account, generating your plans, and billing you. Without this we cannot provide the service you paid for.
• Legitimate interests — keeping the service secure, preventing abuse, and fixing faults, balanced against your interest in not being over-monitored.
• Consent — where you choose to use an optional feature, such as attaching a photo to a brain dump or asking Finance to fill in a transaction from a description. You can stop at any time by not using it.
• Legal obligation — tax and accounting records relating to your payments.

5AI processing in Brain Dump and Finance

Brain Dump

Brain Dump turns a block of unstructured writing into a list of tasks. It cannot do this locally, so when you run it we send the following to OpenAI:

• the text you wrote, up to around 8,000 characters;
• any photos you attached, up to four, resized in your browser before they are sent;
• your timezone, so deadlines like “Friday” resolve correctly;
• the names of your projects and sub-projects, so the extracted tasks can be filed against the right one.

The request is made by our server, not by your browser. OpenAI receives what you wrote, but not your IP address, your name, or your email address — it has no way to tell one CEO Table user from another.

The photos are not stored by CEO Table. They are shrunk in your browser to at most 1,280 pixels on the long edge, sent with the request, and discarded — only the tasks extracted from them are saved to your account. We keep no copy of the image.

Describing a transaction in Finance

The “Describe it” box in Finance turns a sentence such as “makan siang 75rb pakai GoPay” into a filled-in transaction form. Only when you press Fill in, we send OpenAI:

• the sentence you typed or dictated, up to 1,000 characters;
• today’s date, your timezone and the currency your totals are shown in;
• the names of your open accounts, with their bank or provider, type and currency, and the names of your categories and projects, so the result can be filed against them.

It does not receive your balances, any other transaction, your receipts or your bank statements. What comes back only fills in the form; nothing is saved until you check it and press Save.

For both

Nothing else is sent. Your plans, your stakeholders, your time history, your settings, your balances, transactions and receipts stay in the database, and no other feature in CEO Table uses AI.

If you dictate instead of typing, speech is turned into text by your browser’s own speech recognition before anything reaches us. Some browsers, Chrome among them, do that on their maker’s servers, under the browser’s terms. CEO Table never receives the audio.

OpenAI processes this as our service provider in order to return the extracted tasks and transactions. We do not use what you send to train any model of our own, and we do not share it with anyone else. What OpenAI does with data sent to its API is governed by OpenAI’s own terms rather than by us, and we do not make promises here on their behalf. If you would rather no part of your writing left our systems, do not use Brain Dump or the “Describe it” box — every other part of CEO Table works without them, and you can add tasks and transactions by hand instead.

Both are best guesses, not transcriptions. They can misread you. Check what they produced before you rely on it.

6Who we share it with

We share your data only with the providers that make the product work, and only with what each one needs:

• Supabase and Lovable — hosting, authentication, and the database. They hold your account and everything in it, at rest.
• OpenAI — brain dump text and photos, and the transactions you ask Finance to read from a description, as described in section 5. Nothing else is sent, and nothing is sent unless you use one of those.
• Stripe — your email address and subscription identifiers, for billing. Stripe handles your card details directly; we never see them.
• Google — if you sign in with Google, your identity for that sign-in. Separately, every page loads our typefaces from Google Fonts, which means Google receives your IP address whenever you visit. See section 7.

We will also disclose data if we are legally required to, and we will tell you when we are permitted to say so. If the business is ever sold or reorganised, your data may transfer to the new operator, who would remain bound by this policy until they gave you notice of a different one.

Apps you connect. If you give an API key to another app or service, it can read and change your data within the access you chose for that key, in your name. What it then does with your data is governed by its own terms and privacy policy, not this one. You can see your keys and revoke any of them at any time in Settings, and a revoked key stops working on its next request.

Finance shows totals across currencies using the European Central Bank’s reference exchange rates, which our server fetches from Frankfurter, a public service that republishes them. Those requests carry only currency codes and dates. Nothing about you or your money is sent, and Frankfurter sees our server, not you.

Google Calendar appears in Settings as a planned integration. It is not built and is not connected, so nothing is currently shared with it.

7Cookies and local storage

We use no analytics, no advertising pixels, and no third-party tracking scripts. Nothing on this site follows you to another one.

What we do store in your browser:

• your sign-in session, so you stay logged in;
• your theme preference, so the page does not flash the wrong colours before it loads;
• whether you collapsed the sidebar;
• whether you chose to hide amounts in Finance.

One thing worth naming plainly: our typefaces are loaded from Google Fonts on every page, including this one. That request tells Google your IP address and roughly what browser you are using, whether or not you have a Google account. We do not receive anything back from it, and it is not used to identify you to us.

8How long we keep it

Deleting is deleting. When you delete a task, project, sub-project, stakeholder, recurring commitment, transaction, category, budget or repeating transaction, the row is removed from the database. There is no hidden trash folder and nothing to empty. Deleting a task also removes its work-time records; the entry in your activity log saying that something was deferred at a particular time survives with the link to the task removed, because your capacity history is counted from those entries.

In Finance, deleting a transaction deletes the receipt attached to it, and replacing a receipt deletes the old file. An account that has transactions can be archived but not deleted, so its history stays until you delete those transactions or the account goes.

Marking a task as dropped, or archiving a project, is a different thing. It takes the item out of your plan but keeps it, so your history stays honest. Anything you archive stays until you delete it or until the account goes.

Everything else we keep for as long as your account exists. If you ask us to delete the account, we remove your workspace and its contents from our production systems, and from our backups as those backups age out on their normal cycle.

Records of payments are kept for as long as accounting and tax rules require, even after the rest of your account is deleted. These are financial records, not your work.

9How we protect it

Every table that holds your data is protected at the database level by rules that restrict each row to the account that owns it, so one user’s query cannot return another user’s rows even if the application asked it to. Traffic is encrypted in transit. Passwords are hashed by our authentication provider. Administrative functions are checked against an explicit administrator role on every call rather than relying on an unguessable address.

No system is perfectly secure, and we will not claim otherwise. Use a password you do not use anywhere else, and tell us at ceotabledev@gmail.com if you think someone has reached your account.

If your personal data is ever exposed in a way that puts you at risk, Article 46 of Law 27/2022 gives us 3 x 24 hours to tell you in writing and to notify the supervising authority, and we will use them: what happened, which of your data it touched, and what we are doing about it. We would rather send you something incomplete inside that deadline than something tidy after it.

10Your rights and how to use them

Articles 5 to 15 of Law 27/2022 give you the rights below, and we extend them to everyone who uses CEO Table rather than only to users in Indonesia. Whatever country you are in, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your account and its contents;
• export your data in a portable, machine-readable form;
• restrict or object to a particular kind of processing;
• withdraw consent for an optional feature, without affecting anything done before you withdrew it.

These are handled by email, not in the app. Settings shows an export button marked as coming soon, and there is no delete-account button yet — neither is built. Until they are, write to ceotabledev@gmail.com from the address on your account and we will do it by hand. We answer as quickly as we can and within the period Law 27/2022 allows, and we will tell you if a request will take longer than that.

Nothing here makes an automated decision with a legal or similarly significant effect on you. The priority score reorders your own to-do list and does nothing else. You can see the reasoning behind every score, and you can override any of it.

Deleting your account does not by itself cancel a subscription, and cancelling a subscription does not by itself delete your account. If you want both, say so and we will do both. You can cancel at any time yourself through the billing portal in Settings.

If you think we have handled your data badly, tell us first — we would rather fix it. If that does not settle it, you can complain to the data protection authority established under Law 27/2022, or, for as long as that body is not yet taking complaints, to the Indonesian ministry responsible for communications and digital affairs. That law also lets you sue us and claim compensation, and nothing here asks you to give that up. If the country you live in has its own data protection authority — anywhere in the EU, the UK, Australia, and many others — you can complain to that one instead. You do not have to bring a complaint to the other side of the world to be heard.

11Where your data is processed

Every processor named in section 6 sits outside Indonesia, so your data leaves the country as a matter of course rather than as an exception. Article 56 of Law 27/2022 permits that only where the receiving country offers protection at least equal to Indonesia’s, or where binding safeguards are in place, or where you have consented.

We rely on the second of those: each processor is engaged under a data processing agreement that binds it to protect your data and to use it only to provide the service we bought. Your data may therefore be processed outside Indonesia and outside the country you live in, including in countries whose data protection laws differ from both. If you would rather no part of your writing left our systems, section 5 names the one feature to avoid.

12Children

CEO Table is a paid tool for working adults and is not directed at children. Indonesian law treats anyone under 18 as a child, and Law 27/2022 requires a parent or guardian to consent before a child’s personal data is processed. We have no mechanism for that consent and do not intend to build one, so do not create an account if you are under 18, or under the age at which you can consent to online services where you live, whichever is higher. If we learn that we hold a child’s data, we will delete it.

13Changes to this policy

We will update this policy as the product changes — in particular when export and deletion ship, and if the Google Calendar integration is ever built. When we do, we will change the date at the top of this page. If a change materially affects your rights or what we do with your data, we will tell you by email before it takes effect rather than relying on you to notice.

14How to reach us

Privacy questions, data requests, and complaints all go to the same place: ceotabledev@gmail.com.

The controller is PT Aktiva Multi Inovasi, domiciled in Bogor, West Java, Indonesia. Email reaches us fastest; if you would rather write to us on paper, ask and we will give you the street address.

The other half of the agreement between us is in the Terms & Conditions.