Privacy notice: enquiries, invitations, accounts and passports

In effect from 16 August 2026 · updated 16 October 2026

This notice covers website enquiries at mula.asia/work-with-mula, invitation requests at mula.asia/sejauh, the account data of brands that use Mula, and what happens when you open a product passport. It also covers our press and outreach contacts. Four further clauses form part of it, on their own page linked at the end.

Who processes your data

PT Nara Inovasi Indonesia, the legal entity behind Mula.

What we collect

On the work-with-mula enquiry form: your brand or business name, email address, product category, and an optional message about your needs. On the mula.asia/sejauh form: your brand name and email address, and, if you give them, your name, what you make, and what you would want to trace. Neither form uses analytics cookies or tracking pixels.

Why we collect it

To respond to your enquiry or contact you about the Mula invitation you requested. We do not send newsletters, sell or share this data, or use it to build advertising profiles.

The basis for processing

Your consent, given when you submit the form. You may withdraw it at any time, and withdrawing it costs you nothing.

How long we keep it

Until you ask us to delete it, or 24 months after the waitlist closes, whichever comes first.

Where it is stored

In our database, hosted by Supabase in Singapore. The site that receives the form runs on Vercel, also in Singapore. The waitlist cannot be read from the public site: the site can only write to it.

If your brand has a Mula account

The sections above describe the enquiry and invitation forms. For a Mula account we process the data below. We store no card data, and there is no payment service provider in this path. We do not use this data to train artificial intelligence models. It is held with our processors Supabase and Vercel in Singapore.

Names, email addresses and telephone numbers of the people who use the account
Purpose:
To run the account, keep it secure, and support you
Basis (Law 27/2022, Art. 20):
Our contract with your brand, and our legitimate interest in keeping the service secure
Kept for:
While the account is active, and up to 12 months after it closes, longer if there is a dispute
Your brand's legal name, address and tax number (NPWP)
Purpose:
Invoices and tax records
Basis (Law 27/2022, Art. 20):
Legal obligation, and our contract with your brand
Kept for:
As Indonesian bookkeeping and tax rules require, typically 10 years
Names and regions of the makers and suppliers your brand records
Purpose:
To run the service, and to show a maker's name on a passport while your brand's attestation for it is active
Basis (Law 27/2022, Art. 20):
Your brand decides this as controller; we process it on your brand's instructions
Kept for:
While the attestation is active; after that the record is deleted or anonymised
Bank transfer proofs you upload, with their date and amount. A proof can contain the sender's account number.
Purpose:
To confirm payment, keep the books, and handle disputes
Basis (Law 27/2022, Art. 20):
Our contract with your brand, and legal obligation
Kept for:
Typically 10 years, with tax and bookkeeping records

Your rights

You may ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us and we will act on it.

Press and outreach contacts

If you are a journalist or editor and we have written to you, we hold your name, outlet, the work email address you or your outlet published, the article that prompted us to write, and our correspondence with you. We use them only to offer you story ideas about Mula and to answer your questions. Our basis is our legitimate interest in telling the press about our work (Law 27/2022, Art. 20(2)(f); for UK/EU recipients, GDPR Art. 6(1)(f)). We write at most twice unless you reply. We keep these details for up to 24 months after our last exchange, and we keep a minimal "do not contact" record indefinitely if you ask us to stop. You can object at any time by replying "no" or writing to team@mula.asia, and we will stop. You can also ask for access, correction or deletion, and complain to your data protection authority. Our email is hosted by Google Workspace, which may process it outside Indonesia.

If you scanned a product passport

Mula (PT Nara Inovasi Indonesia) hosts product passports for the brands that make the products. When you open a passport we record that it was opened and when, and, for scans from Indonesia only, the province, which our hosting provider estimates from your connection and which we keep only as daily totals. Except for piece codes, described below, we do not store your IP address, we do not derive any code from it or from your browser to recognise your device, and we keep nothing on your device to recognise you later. Our hosting providers keep their own technical logs, which can include IP addresses. When you leave the page, your browser sends us one short message about that visit: which chapters were opened, whether the page was read to the end, whether the save, share or ask-the-brand buttons were used, a broad device type (one of five groups), and how fast the page loaded and how much it had to download. The message refers only to that one page view and carries nothing that identifies you or your device. If your browser sends the Global Privacy Control signal, the message is not sent. Brands see these figures only as totals for their own passports. We set no cookie on a passport unless you use the language switch, which keeps your choice in a cookie for one year. So that a passport you have opened can still be read if your connection drops, your browser keeps a copy of that page for up to 24 hours, and the site's files until the next version of the site. If a label carries a piece code (an address starting /i/), each scan of it also records which piece it was, when, mobile or desktop, the province for scans from Indonesia, and a code derived from your IP address with a key that changes every month, used only to spot repeated misuse of a label. The brand that made the piece can see the time, province and device type of each scan of its own pieces, but never the code derived from your IP address. These scan records are kept for 180 days, then reduced to monthly counts per piece; only the time and province of a piece's first scan stay with the piece. Makers' names and regions appear because the brand attested them; questions about them go to the brand, or to us at team@mula.asia. If you register as the owner of a piece and leave an email or WhatsApp number, we use it only for news about repairs and return routes for that piece. It is never shown on the passport, the brand never sees it, and you can remove the registration with the deletion key shown once when you register.

Contact

Write to team@mula.asia