Privacy policy
Last updated: 23 October 2026
Who we are
Shura is run by Dimas, an individual based in Jakarta, Indonesia (“we”). For anything about your data, write to [email protected].
What we collect
Your account: your name, email address, language, and your password, which we only keep as a secure hash. Your workspace: what you enter in Shura, such as company details, your logo, contacts, products, taxes, invoices and payments. Feedback: the messages and app votes you send us from inside Shura, so we can answer them and decide what to build next. Technical data: a cookie that keeps you signed in, a cookie with your language, and your IP address and browser details in our server logs, for security.
How we use it
To run Shura for you: signing you in, storing your records, creating invoice PDFs and sending the emails you ask for. To send account emails, such as verifying your address, resetting your password and invitations. To keep Shura secure and stop abuse. We don't sell your data and we don't show ads.
Who we share it with
Only the services that help us run Shura: our hosting provider, whose servers are in Singapore, and our email provider, which delivers the emails Shura sends. Your customers receive the invoices you send them. We disclose data to authorities only when the law requires it.
Your customers' data
When you add your customers to Shura, we store and process their details on your behalf, only to provide the service to you. You're responsible for having the right to use their data, for example their consent or a contract with them.
How long we keep it
As long as your account and workspace exist. When you ask us to delete them, we delete your data within 30 days; copies in our backups expire within 14 days after that.
Your rights
You can see, correct and export your data at any time (invoices export as CSV), and ask us to delete it. Under Indonesia's personal data protection law (Law No. 27 of 2022, UU PDP) you also have rights such as access, correction, deletion and objection. Write to [email protected] and we'll answer within 14 days.
Security
Connections to Shura are encrypted (HTTPS), passwords are stored as hashes, and the database itself keeps each workspace's data separate from every other's. We back up the database every night.
Changes
If we change this policy in a way that matters, we'll tell you by email or in Shura before it applies.