Privacy Policy

Who we are

theLabs is an independent applied-AI lab, currently run by one person based in Indonesia. We build Dalang, a hosted AI API now in private preview; Kayon, a local AI workstation for Windows; and Cempala, a local server that lets AI coding agents on your machine hand work to each other.

For anything in this policy, including any request about your data, write to [email protected].

What this policy covers

This policy covers four things: this website (thelabs.id), the Dalang API, the Kayon desktop app, and the Cempala local server. They collect very different amounts of data, so each is described separately below.

The short version: the website collects what you type into a form, Dalang processes what you send it, Kayon collects nothing unless you switch telemetry on, and Cempala sends us nothing at all.

The website

Our contact form asks for your name, your email address, your message, and optionally which product you are writing about (Kayon, Cempala, Dalang access, or something else). The Dalang access-request form and the Simpingan notify form each ask only for your email address.

When you submit any of these forms, our server also records the IP address the request came from. It is used to rate-limit submissions to five per minute, so the form cannot be flooded, and it is included with the submission we receive.

We use Umami to count visits and see which pages get read. It records the page you opened, where you arrived from, and your browser, operating system, device type, and country. It sets no cookies, it collects nothing that identifies you, and it never follows you across other sites. We chose it over Google Analytics for exactly that reason. There are no advertising pixels here, and nothing we collect is sold.

That means this site sets no analytics cookies, which is why you are not being asked to accept any. If you use the language switcher, one functional cookie (NEXT_LOCALE) remembers that choice for a year. Your light or dark theme preference is kept in your browser's local storage and is never sent to us.

Dalang

Dalang is in private preview and is not open to the public. If we give you access, we hold the contact details you gave us and the API key issued to you.

Requests you send to the API, and the responses it returns, are processed to produce your answer. Where access is covered by a separate agreement, that agreement sets out any retention terms and data processing terms; this policy does not promise them on its behalf.

Kayon

Kayon runs entirely on your own computer. There is no account. We do not receive your prompts, your conversations, or the models you use. Chat history is stored in a database on your own disk, and its lifetime is entirely up to you.

Telemetry is off until you turn it on. If you do turn it on, Kayon shows you the exact payload it would send and waits for you to approve it before anything leaves your machine. You can switch it off again at any time.

Some of what Kayon does involves the network, but those requests go to third parties rather than to us: it discovers and downloads models from Hugging Face, and its web search, which is off by default and enabled per session, queries a search engine (DuckDuckGo unless you change it). Every outbound request passes through a single point in the app and is recorded in a network log you can read. Traffic to the model server running on your own machine never leaves it.

Cempala

Cempala runs entirely on your own computer. There is no account, no hosted service, and no open network port, and it makes no outbound calls of its own, so nothing about your use of it ever reaches us.

Everything it stores, its message mailbox, task queue, audit log, and configuration, lives under ~/.cempala on your own disk. Deleting that folder removes all of its state.

Cempala works by handing tasks to AI coding agents you have already installed, such as Claude Code, Codex CLI, Antigravity and OpenCode. What those tools send to their own providers is governed by those providers' terms, not this policy.

How we use your information

We use what you send us to reply to you, and to run and improve the services. We use IP addresses to rate-limit the forms and to protect against abuse. We keep records where the law requires us to.

We do not sell your personal data. We do not share it for advertising, and we do not profile you.

Our legal basis

We are based in Indonesia and handle personal data under Law No. 27 of 2022 on Personal Data Protection. We rely on your consent when you choose to submit a form, on performing an agreement when we provide a service you signed up for, and on our legitimate interest in keeping the service secure and working.

Who else touches your data

We keep the number of parties small. These are the only ones:

• Hosting. This website is served from data centres in Singapore, which means your data reaches servers outside Indonesia.
• Umami. Visits to this site are counted by Umami Cloud, on infrastructure outside Indonesia. It is the only third party involved in your simply reading the site, and what reaches it carries no cookie and nothing that identifies you.
• Form delivery. Form submissions are sent on to the mailbox or CRM we use to read and answer them.
• GitHub. Kayon's and Cempala's source and installers live on GitHub, so downloading either is a request from your computer to GitHub rather than to us.
• Hugging Face. Kayon downloads models from Hugging Face. That request comes from your computer, not from us, and we never see it.

How long we keep it

We keep what you send through a form for as long as we need it to answer you and to keep a record of the exchange, then we delete it. We have no reason to hold it indefinitely, and you can ask us to delete it sooner.

Your rights

Under Indonesian data protection law you can ask us to show you the personal data we hold about you, correct it if it is wrong, delete it, stop or limit how we use it, give you a copy, or withdraw a consent you previously gave.

Write to [email protected] and we will act on it. There is no charge. If we cannot do what you asked, we will tell you why. You may also complain to the relevant Indonesian authority.

Security

The site is served over HTTPS. Form destinations and keys are held on the server and are never exposed to your browser. Most importantly, we collect as little as we can, which is the most reliable protection there is. No system is perfectly secure, and we will not pretend otherwise.

Children

Our services are not directed at children, and we do not knowingly collect data from anyone under 18. If you think a child has sent us personal data, write to us and we will delete it.

Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change is significant, we will say so rather than rely on you noticing.

Contact

Questions, requests, or complaints about privacy go to [email protected].