STELLARIUM RESOURCES, at BLOCK C - 15-18 BAYU PUTERI APARTMENT, JALAN TROPICANA, determines the purposes and means of the account and service-administration processing described here. Customers determine the purposes of personal data they place in prompts, files, and other API content; for that content, Origami acts under the customer's instructions as described in the applicable data-processing addendum.

Privacy contact: stellariumrsrc@gmail.com.

We process data to create and secure accounts; authenticate users and keys; route model requests; enforce permissions, budgets, and abuse controls; measure usage and cost; provide support; investigate failures and fraud; maintain financial and security records; respond to rights requests; and comply with law.

Depending on context and applicable law, the basis is performance of the service contract, compliance with legal duties, legitimate interests in operating and securing the service, protection of vital interests, or consent for genuinely optional processing. Withdrawing optional consent does not end processing necessary for a contract, security, financial retention, or another lawful basis.

We disclose data to infrastructure, database, email, identity, payment, observability, support, and AI inference providers only for the applicable service purpose. Customer-initiated WhatsApp support conversations are processed by Meta/WhatsApp outside the Origami application. The selected AI route receives customer content needed to answer the request. Provider failover or traffic mirroring may send content to an additional approved provider only when enabled by policy.

See the current subprocessor list. We do not sell personal data.

The production application and primary database are configured in Singapore, while vendors and their subprocessors may process data in other countries. Before enabling a vendor or route, Origami evaluates destination law, contractual safeguards, security, retention, onward transfers, and data-subject remedies.

For Indonesian data, we use an equivalent level of protection, adequate and binding safeguards, or consent in the order required by applicable law. For Malaysian data, we assess equivalent protection and any required consent or statutory transfer condition. Transfers remain subject to the internal transfer assessment and legal review.

Operational metadata is kept only for configured service and security periods. Financial source records are retained for up to ten years where Indonesian tax rules apply and at least seven years where Malaysian rules apply. Tamper-evident audit records are retained for ten years unless a longer legal hold applies. Supabase backup retention depends on the purchased plan and is separately controlled.

AI-provider retention varies by route and modality. The subprocessor register and retention schedule identify the current commitments and unresolved vendor evidence. Data scheduled for deletion can remain in protected backups until backup rotation completes.

Subject to applicable exceptions, you may request information, access, correction, an export, deletion or anonymization, withdrawal of optional consent, and restriction of processing. Malaysian users may also object to processing likely to cause damage or distress and prevent direct marketing. Indonesian requests for access, correction, consent withdrawal, and restriction are triaged against the applicable 3 × 24-hour duties.

Use the Privacy Center after signing in. Immediate JSON export is available there. We may verify identity and may preserve financial, security, dispute, or legal-hold records while deleting or anonymizing data not required for those purposes.

Origami uses server-side authorization, encrypted provider credentials, hashed virtual keys, MFA for administrators, restricted provider egress, database transaction controls, row-level security, rate limits, security headers, and tamper-evident audit events. No system is completely secure.

We assess suspected personal-data breaches and provide legally required notices. The response runbook uses the stricter applicable clock: Indonesia requires qualifying written notice within 3 × 24 hours, while Malaysian guidance requires qualifying Commissioner notice within 72 hours and affected-person notice without unnecessary delay and no later than seven days after the initial Commissioner notice.

We publish the version and effective date of material changes. New account registrations record the exact Terms and Privacy versions presented. Renewed acceptance or notice will be used when required.

This service is not directed to children. Contact stellariumrsrc@gmail.com with privacy questions or complaints.