Privacy Policy for AKSI

1. Overview & Applicability

This Privacy Policy describes how Pondok Pesantren Darul Huda Mayak ("we", "us", "our", or the "Institution") collects, uses, stores, and protects personal information obtained from users of the AKSI mobile application (the "App") and the affiliated academic portal accessible at https://aksi.madarulhudamayak.sch.id.

AKSI (Aplikasi Kendali Santri & Informasi) is an internal institutional management platform built specifically for students (santri), teachers/lecturers (asatidz), guardians, and administrators of Pondok Pesantren Darul Huda Mayak, Ponorogo, East Java, Indonesia.

2. Application Identification

For transparency and compliance with Google Play Store Developer Policies, the details of the application are as follows:

3. Information We Collect

We collect only the minimal data strictly necessary to deliver academic and administrative pesantren services. This information includes:

A. User Account & Identity Information

• For Students (Santri): Full name, Student Identification Number (Nomor Induk Siswa / NIS), gender, class/grade, study group (rombongan belajar), dormitory/room assignment, and parent/guardian contact details.
• For Teachers & Staff (Asatidz): Full name, Employee Identification Number (Nomor Induk Pegawai / NIP), email address, phone number, teaching assignments, and assigned role.
• Authentication Credentials: Username, encrypted password hash, and session authentication tokens.

B. Academic & Attendance Data

• Timestamps of attendance check-ins for classes, congregational prayers, extracurricular activities, and boarding school routines.
• Sorogan and wekton classical Islamic book (kitab kuning) study progress.
• Student leave records, permissions (perizinan keluar/pulang pondok), and estimated return times.
• Academic grades, examination results, counseling notes, and student conduct evaluations.

C. Technical & Diagnostic Data

• Device brand, hardware model, operating system version, and unique network identifiers required for secure session validation and crash troubleshooting.
• Server interaction logs (IP address, timestamps of requests, and error diagnostics).

4. Device Permissions (Camera & NFC Disclosures)

In accordance with Google Play Developer Policy regarding sensitive device hardware access, we explicitly disclose below why and how our application requests specific Android permissions:

5. How We Use Collected Data

We process personal and academic information strictly for institutional purposes:

• Attendance & Safety Verification: Verifying presence in educational classes, religious assemblies, and monitoring student leave status for boarding safety.
• Academic Management: Generating report cards (e-raport), evaluating study progress, and scheduling teaching routines.
• Communication: Facilitating academic notices and administrative announcements between the school, teachers, students, and legal guardians.
• System Security & Troubleshooting: Preventing unauthorized access, defending against brute-force attacks, and optimizing app performance.

6. Data Sharing & Third Parties

Personal data is stored on our self-managed or dedicated institutional servers. We only share data under the following circumstances:

• Authorized School Officials: Teachers, homeroom advisors (wali kelas), boarding supervisors (pengurus pondok), and academic administrators who require access to perform educational duties.
• Legal Parents / Guardians: Authorized guardians can view attendance, academic progress, and permissions regarding their respective children.
• Legal Requirements: If mandated by applicable Indonesian law, judicial court orders, or governmental education authorities.

7. Data Security & Storage

We prioritize the confidentiality and safety of student information through modern industry-standard security safeguards:

• Encryption in Transit: All communications between the mobile application and our backend server are protected using Transport Layer Security (TLS/HTTPS).
• Role-Based Access Control (RBAC): Strict authentication policies ensure users can only access information relevant to their assigned role.
• Credential Protection: Passwords are cryptographically salted and hashed; raw plaintext passwords are never stored.
• Regular Backups: Daily automated encrypted database backups are maintained to prevent accidental data loss.

8. Children and Student Privacy

As an educational management app serving madrasah and pesantren students—some of whom are minors under 18 years of age—we take special care to safeguard student privacy in accordance with international standards and Indonesian personal data protection regulations (UU Perlindungan Data Pribadi):

• Student accounts are provisioned exclusively by the educational institution upon enrollment with parental knowledge and consent.
• We do not display third-party advertisements or behavioral tracking within the app.
• Parents and legal guardians may contact the pesantren administration at any time to review the personal data recorded for their child.

9. Data Retention & Account Deletion Policy

In compliance with Google Play's Account Deletion Policy, users have the right to request the deletion of their account and associated personal data.

A. Data Retention Period

Personal and academic records are retained for the duration of a student's or teacher's active affiliation with Pondok Pesantren Darul Huda Mayak. Academic transcripts and graduation certificates are archived in accordance with Indonesian Ministry of Religious Affairs (Kemenag) educational retention regulations.

B. How to Request Account & Data Deletion

If you are an alumni, former student, former employee, or guardian wishing to deactivate your account or request the permanent deletion of your personal information, please follow these steps:

1. Send an email from your registered email address to sekretariat@madarulhudamayak.sch.id with the subject line: [Account Deletion Request] - Full Name - NIS/NIP.
2. Include your full name, registered ID number (NIS/NIP), registered phone number, and a brief description of the request (account deactivation or complete data erasure).
3. Alternatively, visit the Secretariat Office of Pondok Pesantren Darul Huda Mayak during operating hours with valid government identification.

Processing Timeframe: Our administrative team will verify your identity and process the deletion or anonymization request within 14 business days, confirming completion via email.

10. Your Rights

Under applicable data privacy regulations, you are entitled to:

• Right to Access: Request a copy of the personal information we hold regarding your account.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete academic or biographical records.
• Right to Erasure: Request the deletion of your account and personal identifiers, subject to statutory school record-keeping requirements.
• Right to Restrict or Object: Restrict or object to non-essential processing of personal data.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our operational procedures, technical features, or legal obligations. We will notify users of any material changes by updating the "Effective Date" at the top of this document and publishing the updated policy at https://aksi.madarulhudamayak.sch.id/privacy-policy.

12. Contact Information

If you have any questions, inquiries, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our administrative team: