Privacy Policy

Vulpfest is operated by Febri Osht, an individual based in Lampung, Indonesia (“Vulpfest”, “we”, “us”). We are responsible for the personal data described in this policy. For anything related to privacy, contact privacy@vulpfest.com.

• Contact form: your name, email address, company (optional), the topic you choose, your message, and the language of the page you used.
• Correspondence: the emails we exchange if you write to us or we reply to you.
• Usage statistics: anonymous, aggregated visit data such as pages viewed, referring website, country, device type and browser, collected through Vercel Web Analytics without cookies and without identifying you.
• Technical data: our hosting provider processes IP addresses and request data as needed to deliver the website and protect it from abuse. When you use the contact form, Cloudflare Turnstile checks browser signals to tell people apart from bots.

We do not ask for sensitive personal data, and we never buy or sell personal data.

• To read and reply to your message, and to continue the conversation you started.
• To understand how the website is used, so we can improve it.
• To keep the website and its administration secure.
• To meet legal obligations where they apply.

We rely on your consent when you send us a message, and on our legitimate interest in running and securing the website. You can withdraw your consent at any time; this does not affect processing carried out before.

We do not use advertising or tracking cookies. The website stores two small preferences in your browser: your chosen theme (Night or Day), and whether the intro animation has already played in this session. A strictly necessary cookie may be used to remember your language. None of these are used to track you.

We use a small number of trusted service providers that process data on our behalf:

• Vercel — website hosting and visit statistics (United States and global network).
• Supabase — database and file storage (South Korea).
• Resend — email delivery (Japan).
• Google — email mailbox for correspondence.
• Cloudflare — domain, DNS, email routing, and bot protection on the contact form (Turnstile).

They may only use your data to provide their services to us. We do not share personal data with anyone else unless the law requires it.

Some of these providers store or process data outside Indonesia. We choose established providers that apply recognised security and data-protection safeguards, and we transfer only what is needed.

• Contact form messages: up to 24 months after we receive them, then deleted automatically.
• Email correspondence: for as long as needed to handle your request and for our ordinary business records.
• Security records of admin sign-in attempts: 90 days, then deleted automatically.
• Visit statistics: aggregated and anonymous, so they cannot be linked back to you.

Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022) and similar laws elsewhere, you may ask us to:

• give you a copy of your personal data;
• correct data that is inaccurate;
• delete your data;
• stop processing it, or withdraw your consent;
• provide your data in a portable format.

Email privacy@vulpfest.com and we will respond promptly, within the time required by law. You may also lodge a complaint with the data protection authority in your country.

Data is encrypted in transit (HTTPS) and stored with providers that encrypt data at rest. Access to the administration area is restricted and protected with two-factor authentication. No method is perfectly secure, but we take reasonable steps to protect your data.

The website is intended for a general and professional audience and is not directed at children. We do not knowingly collect data from anyone under 18.

We may update this policy as the website evolves. The date at the top shows the latest version, and significant changes will be highlighted on this page.

Questions or requests: privacy@vulpfest.com · Lampung, Indonesia.