Your event data is yours.
Jakarta, Indonesia (Google Cloud, region asia-southeast2) data residency, isolation between organizations, sign-in by magic link or Google (no passwords stored), and a CSV export of your tenant list at any time. Below: the specifics, the services we use, and how to report a problem.
- Data residency
Application data (Postgres, auth, file storage) lives in Jakarta, Indonesia (Google Cloud, region asia-southeast2). Email delivery, error reports and page-view analytics are handled by the services listed below, some of which operate in the United States or the EU.
- Multi-tenant isolation
Postgres Row-Level Security is on from day one. Every tenant-scoped table carries an org_id, and every read goes through a policy that filters by the authenticated session's org. Two orgs cannot see each other's data, full stop.
- Authentication
Sign-in is by magic link or by Google. We never store passwords, so a password leak is not a risk that applies. Sessions are refreshed on every request.
- Export
Your tenant list (stage, booths, amounts, contacts) exports to CSV from the operations view at any time. For a full copy of your organization's data, or to close your account and have the data deleted, email privacy@gelar.co.
- Your money never routes through Gelar
Tenants transfer straight into your own bank or QRIS account and upload the bukti. Gelar records the payment and reconciles it against a booth. It is never in the path of your funds, holds no float, and stores no card details or banking logins.
- The event's public page
The organizer decides what appears on their event's public page and can take it down at any time. Gelar may pull a page that breaks the terms; report one to privacy@gelar.co.
Who can read and write what.
Roles in Gelar: owner, producer, sales, finance (Phase 1+). RLS policies enforce the table below at the database layer. The app code is the second line of defense, not the first.
| Surface | Read / write rule |
|---|---|
| events / zones / booths | Readable to any member of the owning org; writable to roles owner + producer. |
| leads / booth_assignments | Readable to any member of the owning event's org; writable to owner, producer, sales. |
| invoices / payments | Readable to org members. Payment status is written server-side when a member with the finance or owner role verifies a bukti, never by the client, and never by the tenant. |
| activity (audit log) | Append-only via server actions. Readable to org members; no client-side writes. |
| users / user_profiles | A user can read their own profile; org members can read each other's name/initials/email; everything else requires admin role. |
Who else touches your data.
These are the third-party services Gelar uses to run. We will email org owners 30 days before adding a new sub-processor.
Google Cloud
Jakarta, Indonesia (asia-southeast2)Hosting, database, file storage
Cloudflare
Global edgeDNS, CDN, security proxy
Resend
United States / EUTransactional email (magic-link sign-in)
Sentry
United StatesError tracking + diagnostics
Plausible
European UnionPrivacy-first, cookieless web analytics
- Active event data: kept while the org is active. To close your account and have the data deleted, email privacy@gelar.co.
- Audit log: retained indefinitely through M8 (Q4 2026). After M8 ships the retention policy, default becomes 24 months; org owners can override.
- Payment records: transaction and settlement records kept as long as the parent invoice exists, and as required for financial record-keeping. Deleted with the invoice where the law allows.
- Magic-link tokens: single-use, 1-hour expiry. Discarded after consumption.
Tell us if something looks wrong.
If you've found a vulnerability or a data-exposure concern, email security@gelar.co. We acknowledge within 24 hours and respond with a triage assessment within 5 business days. Please don't post details publicly until we confirm a fix has shipped.