Vander Labs

Privacy policy

What we collect, why, where it lives, and how to get rid of it.

This policy explains how PT Eksekutif Satu Internasional (REN16), the operator of Vander Labs at https://vanderlabs.ren16.com, handles personal data. We have tried to write it so that you can read it in five minutes and know exactly what happens.

The short version

  • We collect what you give us (account details, your library, skills you publish) and a small record of connector activity (which skill was loaded, when, and the AI client name).
  • We never see the content of your conversations with your AI.
  • We use one piece of browser storage, your session token, and no advertising trackers.
  • Data is stored on Supabase in Singapore; the site is served from Hostinger.
  • You can delete your account yourself from Settings, and the data goes with it.

1. Who is responsible

PT Eksekutif Satu Internasional (REN16) is the data controller for Vander Labs. You can reach us through the contact page.

2. What we collect

Account data. Your email address, a password (stored as a hash by our authentication provider), a display name, an optional handle, biography, website and avatar, your interests and theme preference, and your plan. If you sign in with a third-party provider (for example Google) we receive your email and basic profile from that provider.

Library and activity. The skills you save, when you saved them, and connector events. A connector event records the skill that was loaded, the time, the tool that was called, and the name and version of the AI client that asked (for example "Claude Desktop 1.4"). It does not record your prompt, your AI's reply, or anything else from the conversation; the connector protocol does not give us that information and we do not ask for it.

Creator data. Skills you draft or publish, their review status, and the usage and earnings figures derived from members' connector events.

Messages. If you use the contact form or join the waitlist, the name, email and message you enter.

Technical data. Our hosting provider keeps standard server logs (IP address, request path, user agent, timestamp) for security and debugging, retained for a limited period. We do not use these logs to profile you.

3. Why we use it

  • To run the service: show your library to you and to your AI, deliver skills, and keep your account working. This is necessary to perform our contract with you.
  • To pay creators: connector events determine which creators are owed what. This is necessary to perform our contract with creators and is a legitimate interest of the service.
  • To review and moderate skills, respond to reports, and keep the service safe.
  • To answer your messages and to tell you about changes to the service or these terms.
  • To meet legal obligations, such as tax and accounting rules once payments are live.

We do not sell personal data, we do not show advertising, and we do not use your data to train AI models.

4. Browser storage and cookies

The web app stores one item in your browser's localStorage: the session token that keeps you signed in. It is set only when you sign in and removed when you sign out. We do not set advertising or analytics cookies and we do not use third-party trackers.

Skill pages embed related videos from YouTube using the youtube-nocookie.com domain, which is designed to limit tracking until you press play. Once you play a video, YouTube's own privacy policy applies to that interaction.

5. Where data lives and who processes it

Account, library, skill and event data is stored in a Supabase project hosted in Singapore. The website and connector run on Hostinger. These providers process data on our behalf under their terms and security commitments. Because they are outside Indonesia, your data is transferred internationally; we rely on the providers' contractual safeguards for that transfer. Related video thumbnails and players are loaded from YouTube when you view a skill page.

We do not share personal data with anyone else except when required by law, to protect the rights and safety of members, creators or the service, or with your direction.

6. What creators and other members can see

Your public profile (display name, handle, biography, website, avatar) is visible to anyone. Your library, activity and email are private. Creators see aggregate numbers about their skills: loads and distinct members over 30 days, and earnings. They do not see which members used their skills.

7. How long we keep data

Account data is kept while your account exists. Connector events are kept for as long as needed to calculate and audit creator payments, then aggregated or deleted. Contact messages are kept for up to two years. Server logs are kept by the hosting provider for a short period and then rotated. Published skills remain in the library until unlisted or removed; a creator who deletes their account can unlist their skills first, and we remove remaining skills from delivery as part of deletion.

8. Your rights and controls

You can view and change your profile, interests and theme in Settings. You can reset your connector URL at any time. You can delete your account from Settings, which removes your profile, library, connector, events linked to you and draft skills; aggregated payment records that no longer identify you may be retained for accounting. Depending on where you live, you may also have rights to access, correct, export, restrict or object to processing of your data, and to complain to a supervisory authority. To exercise any of these, contact us. We respond within two business days and complete requests within the time the law allows.

9. Security

Connections to the site and the connector use HTTPS. Database access is protected by row-level security so that your data is only readable by you, except where this policy says it is public. Connector URLs are random secrets; treat yours like a password and reset it if it is exposed. No system is perfectly secure, and we will notify you and the relevant authorities as required if a breach affects your data.

10. Children

The service is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will remove it.

11. Changes to this policy

We will post changes here and update the date below. If a change materially affects how we use your data we will notify you by email or a notice on the site before it takes effect.

12. Governing law

This policy and any dispute about it are governed by the laws of the Republic of Indonesia, without prejudice to data protection rights you hold under the laws of the place where you live.

Last updated: October 25, 2026