Threshold Privacy Policy

This Privacy Policy is effective as of 11 October 2026.

1. Acknowledgements

This Privacy Policy is subject to the following Acknowledgements that may determine your digital privacy and data protection rights by certain jurisdictions and our Third-Party Service Partners:

Reinhart Previano Koentjoro and Citra Manggala Dirgantara, a publisher of our Applicable Goods and Services, is a registered Private Sector Electronic System Operator (ESO / PSE) by the Ministry of Communication and Digital Affairs, Republic of Indonesia. Threshold is a registered Private Sector Electronic System in the Republic of Indonesia under the registration number: XXXX.

2. Your Rights

2.1. Right to Know

2.1.1. Right to Know Threshold as a Data Processor

You have the right to know that Threshold is a Processor of Personal Data and/or Information (hereby as Data Processor) and may be subject to your privacy and/or data protection laws and regulations.

You have the right to know that Threshold may already receive some Data or Information about you before you access our Applicable Goods and Services and/or communicate with us. This can also include information about you from our Third-Party Service Partners and/or other Users.

You have the right to know that Threshold may collect, process, use, and share data between legal entities across multiple countries. We have aligned our Privacy Policy in respect to:

California Consumer Privacy Act (CCPA) of 2018, for residents of California, United States.
General Data Protection Regulation (GDPR) of 2016, for residents and citizens within the European Union (EU).
General Data Protection Regulation as amended by the United Kingdom (UK GDPR) in Data (Use and Access) Act 2025, for residents and citizens within the United Kingdom (UK).
Privacy Act (Cth) 1988 and Australian Privacy Principles (APP), for residents and citizens of Australia.
Undang-Undang Nomor 27 Tahun 2022 Tentang Perlindungan Data Pribadi (PDP), for residents and citizens of the Republic of Indonesia.

2.1.2. Right to Know and Understand Our Privacy Policy Clearly

You have the right to receive a copy of this Privacy Policy at Privacy Policy URL. It is also a legal requirement for us to show and/or display you this Privacy Policy before requesting your consent for your data and/or information to be processed through our Applicable Goods and Services, and for your communication messages to be processed within us for future correspondence.

It is a legal right for you to receive and understand this Privacy Policy in clear and plain language. However, as this Privacy Policy is also a legal contract, we are required by legal authorities to specifically define:

our standard Definitions of legal words or phrases written in this Privacy Policy,
What We Collect,
How We Use Your Data, and
our list of Third-Party Service Partners,

as our effort to set clear boundaries on how data may be collected, stored, processed, used, and shared based on your rights and privacy risks.

You have the right to know that we have also provided you with our Cookie Policy within this document, as it is a legal requirement for us in certain countries. Cookies are small pieces of Data typically stored in web browsers, and can be misused for tracking your activity across websites and apps for direct marketing and advertising purposes. We only intend to store and use Strictly Necessary Cookies as further defined within our Cookie Policy.

2.1.3. Right to Know on Our Legal Limitations on Privacy Policy Accessibility

It is also a legal right for you to receive and understand this Privacy Policy even if you require alternative language transcription, interpretation, and/or assistive technologies to understand and provide your consent to us. While we have provided a best-effort basis to provide this document for as many people as possible, there are known limitations and liabilities for us that might also affect your legal rights:

Unless noted otherwise, language translations of this Privacy Policy are not authorised or notarised by a sworn translator for legal administration.

2.1.4. Right to Know on Our Legal Limitations on Data Encryption

You have the right to know that our Applicable Goods and Services uses encryption standards and technologies which are subject to United States cryptography export laws, which may be illegal to distribute into your own country based on international agreements and arrangements. Cryptography, also known as encryption, has been applied throughout our Applicable Goods and Services and Third-Party Service Partners as a measure to protect you and us from unauthorised access, modification, and/or distribution of any Data and Information, to ensure that:

You have received the right, digitally-signed copy of our Threshold Mobile Applications with the right privacy protection measures built in as you use it. Unauthorised modification of the application source code may possess security risks to you as a Data Subject, and to us.
You are accessing the right instance of our Threshold Web Services and/or Websites under HTTPS, with the right, non-revoked encryption certificate for authenticity.
Our Partners who participate in hosting our Web Services and Websites are able to verify the integrity of our web servers and data stored online (e.g., website file backups).
Your communications and transactions with us and/or our Partners are encrypted in transit, meaning that security bystanders cannot easily intercept your contents of communication and transaction while it is being delivered over the Internet.

2.1.5. Right to Know on the Difference Between Data, Information, and Knowledge

We use the words Data and Information interchangeably depending on the context of the legal documentation requirements that we have to provide. For example, if a certain law requires us to describe our use with your Personal Information, then we will refer to our compliant sections of this Privacy Policy referring to “your Personal Information”, not Personal Data. However, these words fundamentally have different meanings as follows:

Data refers to a combination of raw pieces of information with no intrinsic meaning. For example, a specific five-digit number which could represent a postcode, a government-issued ID number, a PIN for a bank-issued card, a price of goods, or a worthless random number.
Information refers to a combination of one or more Data which can provide its meanings because an appropriate context has been applied. For example, a two-digit number followed by a capital letter can only provide valuable information if a context is applied, such as the current weather temperature in a city as measured in degrees Celsius.
Knowledge refers to the application of one or multiple pieces of Information which is essential to develop further understanding and decisions in respect or against the given Knowledge. For example,

We treat exposure issues between both Data and Information equally and seriously, as Personal Data such as a four-digit number may deterministically lead to Personal Information, such as your lock screen passcode.

We may also execute Our Immediate Motions to Destroy Your Data on the basis of deterministic patterns in any data that may lead to sensitive information. For example, a string of text with a few letters, followed by a single ‘@’ symbol, followed by another set of letters and dot (‘.’) characters after the symbol could represent someone else’s email address.

You have the right to know our standard for defining the Minimum Age of Legal Consent, which varies between countries and their sub-administrative regions, such as states or provinces, whom we refer to as Geographic Jurisdiction(s). We try to respect your local Geographic Jurisdiction where you are legally registered either as a visitor, resident, and/or citizen.

If you are currently a visitor, resident, and/or citizen in more than one Geographic Jurisdictions, we will determine the Minimum Age of Legal Consent to be the highest value of the Minimum Age of Legal Consent in each of your applicable Geographic Jurisdictions. Otherwise, if your Geographic Jurisdiction(s) do not provide a definitive value, we consider the Minimum Age of Legal Consent for you to be 18 (eighteen) years old.

You have the right to know that your own Geographic Jurisdiction(s) may restrict or revoke your rights to provide a legal consent to us if you are a child aged under the Minimum Age of Legal Consent, or currently under a legal guardian. If you wish to continue providing consent as a child or under a legal guardian, this consent must given by your parent or guardian to:

you, as incoming User to access Applicable Goods and Services,
Threshold, and be responsible for future legal correspondence between you and us by applicable privacy and children privacy regulations,

Our Applicable Goods and Services are not intended to attract or be used by children, and contain risks of revealing certain types of personal data and/or information such as Environment Scanning and their Communications with us, even though we have technical measures in place to ensure that certain types of sensitive information are to be immediately removed from our Web Services and its storage after the User’s request have been ephemerally or temporarily processed by our servers.

Our Applicable Goods and Services also contain risks of data sharing with our Partners, which include sharing certain types of data that are not necessary to enable the main functionalities within our Applicable Goods and Services, but may be further reused by them to enable content personalisation and/or direct marketing, which primarily we do not intend to collect and do so with our Applicable Goods and Services.

2.1.7. Right to Know on Our Immediate Motions to Destroy Your Data and Information

We treat the material distribution and promotion of terrorism, illicit drugs, pornography, and/or child sexual abuse (CSAM) as a serious legal offence. To prevent such materials to be delivered under our Applicable Goods and Services, we have applied necessary moderation features in our Websites, including but not limited to, ensuring that incoming user-generated comments on our Websites.

As a Registered Electronic System Operator in the Republic of Indonesia we may receive official complaints from the acting government in respect to certain User-Generated Content (UGC), and content that meet high-priority violations must be deleted in 1x24 hours after legal notice. Under exceptional circumstances we may distribute the copy of the complaint material to Users who have provided their correspondence information to us, and to the public as a legal basis of objection from the affected Data Subject.

We are also legally required to identify and destroy any unsolicited sensitive Data and Information which may include your Data and/or Information, and we are required to notify you about these matters, and you have the right to limit us from erasure. If you do not take any action, these data will be erased in 3x24 hours after our notification to you.

2.1.8. Right to Know on Our Policy and Legal Limitations on Our Mobile Applications

We are providing this Privacy Policy to cover your and other User’s use of our Threshold Mobile Applications, as our Mobile Applications will require processing of Personal Data throughout our Web Services.

However, as these Personal Data are meant to be processed ephemerally or temporarily in our Web Services, and our Web Services do not receive and collect all Data and Information originally stored on Users’ copy of our Mobile Applications, we cannot execute our policy and privacy-protecting acts of deleting Personal Data and/or Information that are locally stored within a copy of our Mobile Applications that are not centrally known to us. We will continue to respect Your Rights and requests if you believe such uploaded Personal Data and Information is stored beyond reasonable storage retention period applicable to this Privacy Policy.

If you are receiving your Right to be Notified in respect of our actions and/or your request, it means that your Personal Data and/or Information has been edited, destroyed, and/or processed in respect to the cause of notification on our hosted Web Services and Websites online, and does not imply that the actions against your Personal Data and/or Information have been successfully implemented in every User’s copy of our Mobile Applications as stored on their mobile devices.

2.2. Right to be Notified

We are legally required to immediately contact you and refer you to this Privacy Policy in the case of:

Your unsolicited Personal Information was collected by us, for example, by the act of another User against you via Threshold Applicable Goods and Services. We are also required to nominate the name and/or identifying details of the User if your Personal Information is forwarded to us as a measure to verify and confirm your referral.
We have taken the decision to destroy your data if we found out that the data is classified to contain sensitive information, and collected without your prior consent.
You have decided to execute Your Rights, which requires us to delete some or all of your Personal Data and/or Information, and we have taken necessary steps to complete your right(s) to do so.
You have decided to execute Your Rights, which requires us to alter some or all of your Personal Data and/or Information, and we have taken necessary steps to complete your right(s) to do so.
You have decided to execute Your Rights, which requires us to collect additional data as part of your Personal Data and/or Information, and we would like to request for your consent to collect such data for legitimate reasons and purposes.
You have decided to execute Your Rights, which requires us to collect additional data as part of your Personal Data and/or Information, and we have taken necessary steps to complete your right(s) to do so.

2.3. Right to Erase your Personal Data and Information (Right to be Forgotten)

You have the right to erase your Personal Data and Information by Contacting Us. However, we may take additional steps necessary to prove that this Right to Erase is requested by you, not your impersonator, to avoid unsolicited acts against you through our Applicable Goods and Services. Standard limitations for our Mobile Applications apply.

2.4. Right to Access to your Personal Data and Information

You have the right to request access to your Data and Information by Contacting Us. However, we may take additional steps necessary to prove that this Right to Access is requested by you, not your impersonator, as providing this Data and/or Information as part of your Right to Access may reveal additional risks of exposure to any third parties. Standard limitations for our Mobile Applications apply.

2.5. Right to Data Portability

You have the right to receive a copy of your Personal Data and Information alongside your Right to Access in a format that is readily available for use and processing by other computer software, apps, or services.

FOR EUROPEAN UNION MEMBER STATE RESIDENTS AND CITIZENS:

We prefer to use open, royalty-free file formats for exporting your Personal Data and Information as endorsed by the European Interoperability Framework (EIF). This includes PDF, JPEG, and PNG file formats to export our Environment Scanning results from our Mobile Applications.

2.6. Right to Restriction of Disclosure and/or Processing of Personal Data and Information

You have the right to restrict the disclosure and/or processing of your Personal Data and Information by Contacting Us. This includes the right to delay or limit the scope of your Personal Data and Information to be processed, and the right to limit third parties who may be eligible to access your Personal Data and Information.

However, we may take additional steps necessary to prove that this Right to Restriction of Processing is requested by you, not your impersonator, to avoid unsolicited acts against you through our Applicable Goods and Services. Standard limitations for our Mobile Applications apply.

We do not sell your Personal Information to third parties. Our Mobile Applications and Web Services do not include features that enable the collection and sharing of Personal Data and/or Information for personalisation, advertising, or direct marketing purposes. You can Contact Us if you believe your Personal Information was collected otherwise to take immediate actions to opt out of sell and sharing. Standard limitations for our Mobile Applications apply.

We may share your Personal Information solely for correspondence purposes for your communications with us, especially in our Attendees and Contacts and Websites. You can Contact Us to take immediate actions to withdraw or opt out of processing, sell, and/sharing sharing, which might also effectively stop our correspondence to necessary third parties, including but not limited to our Third-Party Service Partners. Standard limitations for our Mobile Applications apply.

2.8. Right of No Retaliation Following Opt Out or Exercise of Other Rights

We do not implement any features or policies within our Applicable Goods and Services that may discriminate or violate your Right of No Retaliation Following Opt Out or Exercise of Other Rights in respect to commercial, marketing, or financial benefits to us. However, these may have been automatically implemented by our Third-Party Service Partners. If you believe that such features or policies exist within our Applicable Goods and Services, you can Contact Us to take reasonable actions to limit or remove the measures and/or effect of violation. Standard limitations for our Mobile Applications apply.

It is important that opting out of sharing to certain Third-Party Service Partners could effectively lose access to required functionalities in our Applicable Goods and Services. Learn more about the specific partner we work with for Enabling Functionalities in Mobile Applications, Web Services, and Websites.

2.9. Right to Correct or Rectify Your Personal Data and/or Information

You have the right to correct or rectify your Data and/or Information as collected and processed by us, by Contacting Us. However, we may take additional steps necessary to prove that this Right to Correct or Rectify is requested by you, not your impersonator, to avoid unsolicited acts against you through our Applicable Goods and Services. Standard limitations for our Mobile Applications apply.

2.10. Right to Object Our Decisions on Your Personal Data and/or Information

You have the right to object our automated, Personal Data and/or Information-derived decisions against you, by Contacting Us. However, this right is exempt for certain types of Data and/or Information defined within Our Immediate Motions to Destroy Your Data for legal compliance reasons.

We may take additional steps necessary to prove that this Right to Object is requested by you, not your impersonator, to avoid unsolicited acts against you through our Applicable Goods and Services. Standard limitations for our Mobile Applications apply.

2.11. Right to Litigate and Receive Compensation Against Unlawful Practices of Data Processing

You have the right to litigate and receive compensation against our unlawful practices of data processing, given that:

Your country is not restricted from importing and using encryption measures protected by United States cryptographic export laws, which is necessary for us to deliver our standard privacy protections for your Personal Data and Information.
Your country does not intentionally intercept or block access to our Third-Party Service Partners which are necessary to provide security and privacy protections for you and us to fulfill our obligations in this Privacy Policy. This criteria is excepted if the unlawful practice of data processing is the primary legal basis of intercept or block our Third-Party Service Partners during the dispute.
The reported unlawful practices of data processing were not done as direct consequences to your violation to our Acceptable Use Policy for our Applicable Goods and Services.

Standard limitations for our Mobile Applications apply.

FOR CALIFORNIAN RESIDENTS:

As part of Your California Privacy Rights, rejecting or opting out of share and sharing of Personal Information does not constitute a violation of our Acceptable Use Policy. Learn more on your Right of No Retaliation Following Opt Out or Exercise of Other Rights.

FOR INDONESIAN RESIDENT AND CITIZENS:

As a Registered Electronic System Operator in accordance with Peraturan Menteri Komunikasi dan Informatika Nomor 5 Tahun 2020 Pasal 15, you have the right to raise a formal complaint against us under applicable Indonesian government authorities. The Electronic System Operator Registration ID (Tanda Daftar Penyelenggara Sistem Elektronik), Business Registration Number (Nomor Induk Berusaha), and other legal identifiers of us and/or our Partners may be shared and cited in litigations for the purposes of law enforcement.

Please be advised that the current PSE Lingkup Privat and UU PDP regulations and complaint process only manages the required immediate take down requests, legal penalties for Private Data Processors against the law and to the government, and does not quantify the minimum compensation standard we are obliged to provide in case of an unlawful practice of data processing. This will be determined on a per case-by-case basis, as to be settled in a court of law.

3. Definitions

Data Subject refers to a human, a business, and/or a legal entity whose data and/or information are being collected, stored, and processed within our Mobile Applications, Web Services, and/or Websites (further defined as our Applicable Goods and Services) in respect to How We Use Your Data.
- This includes you in which your data and/or information may be captured, knowingly or unknowingly, by either you as a User, other User who transmit your personal data into Threshold, and/or third parties, including but not limited to, our Third-Party Service Partners who transmit your personal data into Threshold through our Applicable Goods and Services.
- As part of a functionality or policy requirement within our Applicable Goods and Services, we may individually contact you if any User who transmits your personal data or information would like us to classify you as a Data Subject, and/or invite you to become a User who may interact with the requesting User within our Applicable Goods and Services.
User refers to a Data Subject who has knowingly used our products within our Applicable Goods and Services to transmit, store, and process any data, which may include other Data Subject entities, into Threshold.
- By continuing to access such products on your behalf, you may be required to consent that you will become a User who is subject to this Privacy Policy. We will indicate which sections, pages, and/or features within our Applicable Goods and Services that require such agreement, and will refer you to this Privacy Policy on how we and our Partners manage your personal data and information.
Geographical Jurisdiction refers to the legal and administrative authority given on a geographical territory that a human, such as you or another Data Subject, claims to be a current visitor, resident, or citizen of, with applicable legal proofs to justify the human’s presence and association with their applicable laws.
- We also consider the Geographical Jurisdiction for sub-administrative regions within a country. For example, the State of California, inside the country of the United States of America, in which residents are entitled to the California Consumer Privacy Act (CCPA) in which this Privacy Policy is applied to.
- In case of disputed geographical territories, we reserve the right to the human to decide their association or allegiance to select conflicting jurisdictions whenever necessary.
- If we fail to identify the human subject’s Geographical Jurisdiction, such as anonymous digital sources or physically belonging on international water territories, we will continue to treat the human subject against our standard set of Geographical Jurisdictions in which our Privacy Policy is designed for, as determined in the Right to Know Threshold as a Data Processor.
- If we fail to identify the human subject’s Geographical Jurisdiction specific to the disputed territories, we will consider all applicable conflicting Geographical Jurisdictions for the human subject.
Age of Legal Consent refers to the age range applied within the Geographical Jurisdiction of the incoming human Data Subject to be considered capable to sign and accept legal contracts, rights, and obligations as part of their legal citizenship and/or residency.
- Some jurisdictions enforce restrictions or exemptions for adults from being legally considered capable to provide such consent. This may include adult citizens or residents who are currently under a legal guardianship.
- If none of the Data Subject’s jurisdictions enforce such minimum age as part of their citizenship and/or residency, we consider such minimum age to be eighteen years old.
Minimum Age of Legal Consent (hereby as “Minimum Age”) of a certain jurisdiction refers to the minimum value of the Age of Legal Consent applicable for the Data Subject to be considered as a legal adult.
- If the Data Subject holds citizenship and residency status in multiple jurisdictions, we consider this age to be the highest of the minimum ages enforceable in each of their respective jurisdictions.
- If the jurisdiction, through their data protection, privacy, electronic trade, and/or consumer protection laws apply a higher minimum age than the general Age of Legal Consent in which a certain internet platform, electronic service, legal entity, and/or merchant which Threshold qualifies as such could process the Data Subject as a legally-responsible human adult, we will consider this higher age to be the Minimum Age applicable in such jurisdiction.

4. Applicable Goods and Services

This Privacy Policy applies to the following Applicable Goods and Services:

Attendees and Contacts: Those who visit or provide their information to Threshold or Threshold representatives to receive communications from Threshold and/or our partners.
Mobile Application Users: Those who visit and access the features and/or functionalities within our Mobile Applications and Web Services
- Mobile Applications refers to one of the following mobile application packages:
  - The “Threshold” mobile application package for Android devices, distributed with the Package ID of id.reinhart1010.threshold.
  - The “Threshold” mobile application package for iPhone and iPad devices, distributed with the Bundle Identifier of id.reinhart1010.threshold.
- Web Services refers to our image processing service hosted behind the parent domain names getthreshold.online or threshold.reinhart1010.id.
Website Visitors: Those who visit our Websites, including those who may opt to provide an email address or other contact information to receive communications from Threshold and/or our partners.
- Websites refers to one of the following websites, URLs, and/or web domain names:
  - Our application project landing page at: https://getthreshold.online
  - Our provisional application project landing page at: https://threshold.reinhart1010.id

Our Websites and Mobile Applications are not intended for, nor designed to attract, people under the Minimum Age of Legal Consent applicable in their respective jurisdictions.

However, due to the nature of our Mobile Applications image processing functionality, we may unknowingly process User-Generated Content with Personally Identifiable Information belonging to children and adults under legal guardianship, and will continue to process any incoming User-Generated Content as such regardless of Age of Legal Consent status of the User.

Please be advised when you plan to access our Mobile Applications store listings on App Store and/or Google Play, or through their pre-release testing channels TestFlight and/or Google Play App Testing, the use of their services to discover and download the Mobile Applications packages are out of scope of this Privacy Policy, except if you provide any reviews, issue reports, and app diagnostics as means to communicate feedback to us to improve our Mobile Applications and related products. Refer to the Third-Party Service Partners section for more details.

5. What We Collect

5.1. Communication Message and Preferences

If a User decided to provide communication with us, we may collect the following data and information:

Content of the communication message,
Name of the User,
Contact information, such as email address or phone number, that was provided by the User to receive further correspondence in communicated messages,
User’s preferred method, medium, and/or language of correspondence, and/or
Timestamp when the user issues a message to us, which may be automatically collected by our Partners.

If the User decided to provide communication to us via a website or an online platform, the User’s Device and Internet Origin Identifiers might also be collected by our Partners as part of their anti-spam measures.

5.2. Device and Internet Origin Identifiers

As part of our web security attestation process, we and our Partners including Cloudflare, hCaptcha, and Oracle Cloud for web analytics and security attestation purposes, including but not limited to:

Originating IP address,
Incoming HTTP request’s User Agent (e.g., web browsers, mobile client apps; through the means of HTTP User-Agent header and Client Hints API),
Cookies that are bound to the user agent as part of Cloudflare and hCaptcha security attestation responses to authenticate with our cloud servers,
User-Agent’s preferred list of content encoding (Accept and Accept-Encoding HTTP headers), and/or
User-Agent’s preferred list of display languages (Accept-Language HTTP header).

5.3. Environment Scanning

As part of our Mobile Applications core functionality we will request and collect the following data from the User:

Questionnaire answers reflecting the current physical conditions of the User’s rooms as part of the Mobile Applications’ room assessment functionalities.
Any images taken representing the User’s rooms to be analysed for accessibility issues as part of the Mobile Applications’ room assessment functionalities.

Additionally, when the User submits their images to be scanned by our online-hosted Web Services, the User’s Device and Internet Origin Identifiers might also be collected by our Partners as part of their anti-spam measures.

The use of our Web Services and Websites may also be subject to Cloudflare’s Cookie Policy, which can be found at https://www.cloudflare.com/cookie-policy; as well as hCaptcha’s Privacy Policy, which can be found at https://www.hcaptcha.com/privacy.

6.1. Types and Purposes of Cookies

We use cookies to improve the user experience of our Websites and to apply necessary security measures to prevent unauthorised use including but not limited to: scraping, publication of illicit content, and denial of service. Visit our Acceptable Use Policy for details.

We partner with Cloudflare to provide analytics and anti-spam measures on visits on our Websites, and do not intend to use the related cookies and/or derived information for purposes of direct marketing and targeted advertising.

The following Strictly Necessary Cookies are set, in respect to Cloudflare’s Cookie Policy. For the current list of expiration policies for the following cookies, visit https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/.

Cookie	Issued and Managed by	Purpose
__cf_bm	Cloudflare	Anti-bot detection
__cfseq	Cloudflare	Anti-bot detection
cf_clearance	Cloudflare	Anti-bot detection
__cfruid	Cloudflare	Anti-bot detection

The following cookies are also set by us in relation to CAPTCHA responses with our Web Services and Websites:

Cookie	Issued by	Managed by	Purpose	Expiration Time
captcha_provider	Threshold	Threshold	Determine the CAPTCHA service provider used to verify that a User is a legitimate human for image analysis in Environment Scanning	30 minutes since first issue
captcha_response	Cloudflare or hCaptcha	Threshold	Determine the CAPTCHA service provider’s response token in case a User is a legitimate human for image analysis in Environment Scanning	30 minutes since first issue

6.2. Linkage to Threshold Mobile Applications

As a User, your use of our Web Services and Websites’ cookies are not linked to your User activity within our Threshold Mobile Applications, except when it is being accessed by the Threshold Mobile Applications’s feature, for example, during the online image processing functionality.

If you receive any cookies from our Websites on a web browser session, Your decision to reset or delete the cookies in your web browser does not affect your eligibility to access your Personal Data as currently managed in your copy of the Threshold Mobile Applications.

7. How We Use Your Data

7.1. Our Legal Basis for Data Collection and Processing

Our Legal Basis for collecting and processing your data:

To provide the core functionalities of our Mobile Applications, Websites, and Web Services in respect to their business purposes,
To handle communications and correspondences from our Attendees and Contacts,
To make necessary reporting and correspondence of legal complaints against Data and/or Information, and
To maintain the appropriate security measures for any Data Subject which may require or allow storing Users’ preferred security and privacy-sensitive mechanisms.

7.2. Legal Compliance for User-Generated Content

It is a legal requirement for us by certain jurisdictions to indicate any User-Generated Content (UGC) hosted on a central internet platform or electronic system, which are intended for sharing to other users in-platform or over the internet, with a valid Uniform Resource Locator (URL). Anyone, including our Data Subjects and Users may have the legal right to refer the Uniform Resource Locator (URL) of the infringing material to authorities in certain jurisdictions. Any content that is uploaded through our Web Services and Websites are subject to Our Motions to Destroy Your Data and Information for preventive and legal enforcement reasons.

In relation to Environment Scanning in our Mobile Applications, Threshold does not intend to distribute any uploaded image content to us, other Users, and/or other members of the public within our Applicable Goods and Services. Any image and derived data processed within the Web Services are to be ephemerally processed and immediately deleted after processing.

7.3. Enabling Functionalities in Mobile Applications

Our Mobile Applications feature the following Required Core Functionalities which require certain interaction with our Web Services and other web services provided by Third-Party Service Partners, hence subject to this Privacy Policy:

Analysing the Environment Scanning photo input from the User’s mobile device to our Web Service for image-based analysis (hereby as Environment Analysis). We have provided necessary steps to avoid transmitting the questionnaire answers from the user’s device, as well as the photo image’s EXIF (Exchangeable Image File Format) metadata which may contain sensitive information including but not limited to:
1. the User’s mobile device type or model,
2. the User’s current geographical location,
3. the recorded time on the User’s camera device when the photo was taken, and
4. the User’s real name or pseudonym as the recorded author or artist of the image.
Participating in Cloudflare Analytics to provide security-relevant insights on the use of our Web Services based on the number of incoming server requests, to find early signs of web security attacks, request spamming, and content scraping.
Participating in anti-bot and rate-limiting verification measures for the Environment Analysis mechanism, which will require storing cookies and Device and Internet Origin Identifiers to our Third-Party Service Partners, specifically Cloudflare, hCaptcha, and Oracle Cloud.

The following Optional Functionalities are also available for our Mobile Applications:

Enabling the Weather Alerts Notification feature which requires regular interactions our Third-Party Service Partners Open-Meteo to notify possible weather-related risks to the User’s home environment in accordance with their Environment Analysis results.
Participating in Pre-Release App Version Review which may include sending application crash data to our Third-Party Service Partners, specifically Apple (App Store, TestFlight) and Google (Google Play, Google Play App Testing), which may be reviewed by us through their platforms. Your Apple Account, Google Account, and/or contact details might also be forwarded to us through their platforms.

7.4. Enabling Functionalities in Web Services

Our Web Services feature the following Required Core Functionalities which require certain interaction with Third-Party Service Partners, hence subject to this Privacy Policy:

Analysing the Environment Scanning photo input from the User’s mobile device to our Mobile Applications for image-based analysis (hereby as Environment Analysis). We use Oracle Cloud to host our own image analysis framework with necessary protections to automatically delete the uploaded images after the analysis results are delivered back to the User’s copy of Mobile Applications.
Participating in Cloudflare Analytics to provide security-relevant insights on the use of our Web Services based on the number of incoming server requests, to find early signs of web security attacks, request spamming, and content scraping.
Participating in anti-bot and rate-limiting verification measures for the Environment Analysis mechanism, which will require storing cookies and Device and Internet Origin Identifiers to our Third-Party Service Partners, specifically Cloudflare and hCaptcha.

7.5. Enabling Functionalities in Websites

Our Websites feature the following Required Core Functionalities which require certain interaction with Third-Party Service Partners, hence subject to this Privacy Policy:

Participating in Cloudflare Analytics to provide security-relevant insights on the use of our Websites based on the number of incoming server requests, to find early signs of web security attacks, request spamming, and content scraping.
Participating in anti-bot and rate-limiting verification measures for the Environment Analysis mechanism, which will require storing cookies and Device and Internet Origin Identifiers to our Third-Party Service Partners, specifically Cloudflare and hCaptcha.

8. Third-Party Service Partners

Apple, Inc., United States

We use online services provided by Apple, Inc. (trading as Apple, Apple Developer, App Store, App Store Connect, and TestFlight) to manage our Mobile Applications distribution for iPhones, and to provide diagnostic services for pre-release app version testing distributed through App Store Connect and TestFlight. Your use of such products are also subject to Apple Privacy Policy at https://www.apple.com/legal/privacy.

If you are running a pre-release version of our Mobile Applications, you may optionally send a feedback and/or forward an issue report to us via TestFlight. Your Device and Internet Origin Identifiers in relation to your use of our Mobile Applications may be forwarded through Apple’s services for diagnostics and debugging purposes by Threshold as a registered Apple Developer member.

If you opt to share application error or crash data to Apple to be reviewed by us, as the registered developer of our Mobile Applications, your Communication Message and Preferences as well as Device and Internet Origin Identifiers will also be shared to Apple based on their applicable terms and conditions. We may also be notified by Apple about your collected data for review, diagnostics, and correspondence purposes.

If you opt to submit reviews and/or ratings to the App Store on our Mobile Applications listings, your Communication Message and Preferences as well as Device and Internet Origin Identifiers will also be shared to Apple based on their applicable terms and conditions. We may also be notified by Apple about your collected data for review and correspondence purposes.

Citra Manggala Dirgantara, Indonesia

Citra Manggala Dirgantara is a legal entity name and Registered Electronic System Operator for online services provided by Reinhart Previano Koentjoro.

We use online services provided by Citra Manggala Dirgantara. (trading as reinhart1010.id, and Products and Electronic Systems of Reinhart Previano Koentjoro) to manage your communication preferences to us and manage our web domain infrastructure.

For more information on how Reinhart Previano Koentjoro and Citra Manggala Dirgantara handles your privacy, visit https://legal.reinhart1010.id/privacy/general/en.

If you opt to submit reviews and/or ratings to reinhart1010.id on our Mobile Applications listings, your Communication Message and Preferences will also be shared to Citra Manggala Dirgantara based on their applicable terms and conditions. We may also be notified by Citra Manggala Dirgantara about your collected data for review and correspondence purposes.

Cloudflare, Inc., United States

We use online services provided by Cloudflare, Inc. (trading as Cloudflare, Cloudflare R2, and Cloudflare Turnstile) to store parts of our Websites’ static content and manage our Web Services and Websites’ secure access and to prevent unauthorised use and abuse of such services.

Your interactions to our Web Services and Websites are subject to:

Cloudflare’s Privacy Policy at https://www.cloudflare.com/privacypolicy/, with Turnstile Addendum at https://www.cloudflare.com/turnstile-privacy-policy
Cloudflare’s Cookie Policy at https://www.cloudflare.com/cookie-policy

If you opt to submit web service abuse reports to Cloudflare in regards to our Web Services and/or Websites, your Communication Message and Preferences will also be shared to Cloudflare based on their applicable terms and conditions. We may also be notified by Cloudflare about your collected data for review and correspondence purposes.

Google, LLC., United States

We use online services provided by Google, LLC. (trading as Google, Google Play, Google Play App Testing, Google Play Console, Google Play Services, Google Safe Browsing, Google Search) to manage our Mobile Applications distribution for Android, and to provide diagnostic services for pre-release app version testing distributed through Google Play Console and Google Play App Testing. Your use of such products are also subject to Google’s Privacy Policy at https://policies.google.com/privacy.

If you are running a pre-release version of our Mobile Applications, you may optionally send a feedback and/or forward an issue report to us via Google Play Services or Google Play App Testing. Your Device and Internet Origin Identifiers in relation to your use of our Mobile Applications may be forwarded through Apple’s services for diagnostics and debugging purposes by Threshold as a registered Google Play Console account.

If you opt to share application error or crash data to Google Play Services to be reviewed by us, as the registered developer of our Mobile Applications, your Communication Message and Preferences as well as Device and Internet Origin Identifiers will also be shared to Google based on their applicable terms and conditions. We may also be notified by Google about your collected data for review, diagnostics, and correspondence purposes.

If you opt to submit reviews and/or ratings to Google Play Store on our Mobile Applications listings, your Communication Message and Preferences as well as Device and Internet Origin Identifiers will also be shared to Google based on their applicable terms and conditions. We may also be notified by Google about your collected data for review and correspondence purposes.

If you opt to submit web service abuse reports to Google in regards to our Web Services and/or Websites, for example, via Google Safe Browsing or Google Search, your Communication Message and Preferences will also be shared to Google based on their applicable terms and conditions. We may also be notified by Google about your collected data for review and correspondence purposes.

Internet Security Research Group, United States

We use online services provided by the Internet Security Research Group (trading as ISRG, Let’s Encrypt) to manage and verify our TLS/HTTPS certificates on our Web Services and Websites.

Your device, web browser, and/or operating system may automatically contact ISRG’s web servers to verify that the Let’s Encrypt certificates installed on our systems are valid for use within your web browser and your copy of our Mobile Applications. For more information on how ISRG handles your data, visit https://letsencrypt.org/privacy.

If you opt to submit web service abuse reports to Let’s Encrypt in regards to our Web Services and/or Websites, your Communication Message and Preferences will also be shared to hCaptcha based on their applicable terms and conditions. We may also be notified by Let’s Encrypt about your collected data for review and correspondence purposes.

Intuition Machines, Inc., United States

We use online services provided by the Intuition Machines, Inc. (trading as hCaptcha) to manage our Web Services and Websites’ secure access and to prevent unauthorised use and abuse of such services.

Your interactions to our Web Services and Websites are subject to the hCaptcha Privacy Policy at https://www.hcaptcha.com/privacy, which includes their cookie policies (under the Third Party Analytics and Tracking Technologies section).

If you opt to submit web service abuse reports to hCaptcha in regards to our Web Services and/or Websites, your Communication Message and Preferences will also be shared to hCaptcha based on their applicable terms and conditions. We may also be notified by hCaptcha about your collected data for review and correspondence purposes.

OpenMeteo GmbH., Switzerland

We use online services provided by OpenMeteo GmbH. (trading as Open-Meteo and Open-Meteo.com) to retrieve weather information on our Mobile Applications.

Your interactions to our Web Services and Websites are subject to Open-Meteo Terms and Privacy at https://open-meteo.com/en/terms.

Oracle Corporation, United States

We use online services provided by the Oracle Corporation (trading as Oracle and Oracle Cloud) to host our Web Services and Websites. Your interactions to our Web Services and Websites are subject to Oracle Services Privacy Policy at https://www.oracle.com/legal/privacy/services-privacy-policy, in addition to Oracle General Privacy Policy at https://www.oracle.com/legal/privacy/privacy-policy.

If you opt to submit web service abuse reports to Oracle in regards to our Web Services and/or Websites, your Communication Message and Preferences will also be shared to Oracle based on their applicable terms and conditions. We may also be notified by Oracle about your collected data for review and correspondence purposes.

9. Contact Us

We would like to welcome any feedback, suggestions, and complaints from you on your use of Applicable Goods and Services and this Privacy Policy by emailing us at [email protected].