Privacy Policy

Valid from 1 October 2026.

UMI Link (link.umi.ac.id) is the official link shortening service of Universitas Muslim Indonesia (UMI) which is managed by the UMI Data and Information Technology Center (PDTI). This policy explains what data we record, for what purpose, how long it is kept, and your rights over that data, in accordance with Law Number 27 of 2022 concerning Personal Data Protection (PDP Law).

1. Shortlink visitors

When you open a shortlink, we record visit statistics for the link owner. We does not save your IP address. What is recorded for each click:

• click time;
• Daily visitor markers are a one-way hash (HMAC) of the IP address, user agent, and date, with the server's secret key. This tag changes daily, cannot be reversed to an IP address, and is only used to count unique visitors per day;
• referring domain name (e.g. facebook.com), without the full page address;
• device type (desktop, phone, tablet), browser name, and operating system, inferred from the user agent;
• the browser's primary language (from the Accept-Language header);
• country code, only if provided by network/CDN header; in its absence, the state is left empty and unpredictable;
• whether the visit came from a QR code scan, and whether the visit appeared to come from a bot or messaging app preview.

The link owner only sees a summary of those statistics, not the visitor's identity.

2. Registered user

For academics who log in to the dashboard, we store account data (username, display name, email, phone number if filled in, role, and preferred language), links and pages you create and their settings, as well as the time and IP address of the last login.

Accounts logged in with the UMI central system account are verified against the UMI master database. The master database is read only to check credentials and copy basic profiles; UMI Link never changes data there and does not store central account passwords.

3. Security notes

• Login attempt: typed login identity, IP address, user agent, success/failure, and time. Used to limit attempts and detect password guessing attacks.
• Activity log: actions in the dashboard (e.g. create, change, or delete a link) along with the account, IP address, user agent, and time. Used for audits and incident handling.
• IP block list: IP addresses detected scanning or attacking servers can be temporarily blocked.

4. Cookies and browser storage

• Session cookies and CSRF security cookies are only set on login pages, dashboards and forms that require them (e.g. opening a password-enabled link). Opening a regular shortlink does not set a cookie.
• The "Remember me" cookie is only set if you tick it when logging in, is valid for 14 days, and is revoked when you log out.
• Site accessibility settings (e.g. text size) are stored in your browser's local storage and are not sent to the server.

5. No third party trackers

UMI Link does not use Google Analytics, ad pixels, or other third-party trackers, and does not sell or share data with advertisers. The captcha is generated by itself on the server, without outside service. YouTube guide videos use privacy mode (youtube-nocookie.com) and only load after you press the play button.

6. Storage period

• Click data: 24 months;
• Activity log: 12 months;
• Login trial record: 90 days;
• Application server technical logs: 30 days.

Data is automatically deleted after that time. Account data and links are retained as long as the account is active or until deleted.

7. Location and data security

Data is stored on the UMI Link server managed by PDTI UMI. Access is restricted to authorized managers, passwords are stored in hashed form, and connections are protected by encryption.

8. Processing basis

Processing is carried out based on the implementation of UMI's duties and legitimate interests in providing safe official link services for the academic community, as regulated in Law no. 27 of 2022 concerning Personal Data Protection.

9. Your Rights

You have the right to request access, correction or erasure of your personal data, as well as to object to its processing. Send request to jasa.pdti@umi.ac.id. Because click data does not contain the visitor's identity, it generally cannot be linked back to a specific person.

10. Policy changes

This policy may be updated following changes in services or regulations. The latest version is always available on this page along with its effective date.

Contact

PDTI Universitas Muslim Indonesia — jasa.pdti@umi.ac.id