Privacy Policy

Who we are

Colosal is operated by PT Pilar Antar Informasi, located at Jaya Harmoni JH4-3 Buduran, Sidoarjo (“Colosal”, “we”, “us”). We are the controller of the personal data described in this policy.

You can reach us at hi@paistudio.co.

What we collect

Account data

You can sign up with an email address and password, or with Google. We store your account email and username. A phone number is optional. Authentication is handled by Supabase.

Data you provide

Inside the web app you can give us:

• Profile text you write: summary, current role, previous experience, skills, portfolio, proof points and positioning notes.
• Proposal templates.
• Scanner configurations.
• Files you upload as attachments.
• Notification settings: your Telegram chat ID, and a WhatsApp number if you are on a paid plan.

We also store your subscription plan and the content we generate for you, such as proposals and screening-question answers.

Data from the Upwork API

If you choose to connect Upwork, you authorize Colosal through Upwork’s OAuth. We then store the access and refresh tokens and use them to read job data and your own talent profile through the Upwork API. For the scanners you set up, we store the jobs we find, including the job title, description and client information as returned by Upwork.

Data read from Upwork pages by the extension

When you click a button in the Chrome extension, it reads the visible text of the Upwork page you are on. What it reads and what happens to it is described in detail in The Chrome extension.

Usage and analytics data

We keep a usage log (your user ID, the type of feature used and a timestamp) to enforce daily limits. We use Google Analytics on our website and web app to understand how the product is used. We design our event parameters to avoid personal data. Google Analytics may use cookies or similar identifiers in your browser.

How we use your data

• Provide the features. Scanning jobs, scoring them against your profile, storing your templates and attachments, and showing your results.
• Generate AI output. Producing proposals, screening-question answers, scores and profile suggestions.
• Send notifications. Delivering job alerts through Telegram or WhatsApp if you turn them on.
• Apply limits and prevent abuse. Enforcing daily usage limits and detecting misuse of the service.
• Support. Answering your questions and fixing problems you report.
• Security. Protecting accounts and keeping the service running safely.
• Improve the product. Understanding usage in aggregate through analytics.

We do not sell personal data. We do not use data from Upwork pages or the Upwork API for advertising, or for any purpose unrelated to the features you asked for.

Who we share data with

We share data with the providers below only as needed to run the service.

• Supabase — authentication, database and file storage. Our Supabase project runs in the Singapore region.
• Hosting provider — Vercel hosts our website and web app.
• AI provider — job text, template text and your profile information are sent to a third-party AI provider through SumoPod, an OpenAI-compatible AI gateway, using the gpt-4o-mini model, to generate proposals, scores and suggestions. SumoPod and the model provider process this data under their own terms and privacy policies. Output can be inaccurate and must be reviewed before use.
• Upwork — we connect to the Upwork API only if you authorize it.
• Google — sign-in with Google, and Google Analytics.
• Telegram and WhatsApp — used to deliver job alerts if you turn notifications on. Alert content passes through these services.
• Payments — payments for paid plans are currently handled manually by us, not through an automated third-party payment processor. If that changes, we will update this policy.

We may also disclose data if the law requires it or to protect our rights, users or the public.

The Chrome extension

The Colosal Chrome extension adds a side panel and a floating launcher button on upwork.com. It works only on upwork.com pages and on the Colosal domain, and it acts only when you click a button. It never writes to Upwork pages.

What it reads, and when

• On a job page. When you click, it reads the visible text of the page and parses it locally in your browser into the job title, description, screening questions, skills, budget and client statistics. It sends those fields to Colosal’s servers to generate the proposal, the answers and a confidence rating.
• On a freelancer search page. When you click, it reads the visible freelancer cards: headline, hourly rate, Job Success score, earnings, skills and overview text. Names and countries are removed before anything is sent. Only cards of top freelancers (Job Success 90%+ and $5K+ earned) are used. They are aggregated into statistics for a benchmark, and a few short headline and opening excerpts are sent to the AI provider as examples. This data is not stored on Colosal’s servers.
• Your own Upwork profile. This is not read from the page. It is read on our servers through your Upwork API connection.

What is stored locally

Results are kept temporarily in your browser’s session storage. They are cleared when you close the browser or sign out. The extension also remembers the position of the floating button in your browser.

How it connects to Colosal

The extension calls Colosal’s API using your existing Colosal session.

Permissions and why we need them

sidePanel

Shows the Colosal interface in the browser side panel.

scripting

Reads the visible text of the Upwork page you are on, only when you click.

storage

Keeps results temporarily and remembers the position of the floating button.

cookies

Used only to notice when you sign in to or out of Colosal. The extension does not read, store or transmit cookie values itself.

Host access: upwork.com and app.colosal.xyz

Lets the extension work on Upwork pages and talk to the Colosal app. It does not run on other sites.

International transfers

Your data is processed in Singapore, where our Supabase project runs, and by the other providers listed above, who may operate in other countries. By using Colosal you understand that your data may be transferred to and processed in countries other than where you live.

Retention

We keep your data while your account exists. After you delete your account, we delete your data within 30 days.

Results the extension keeps in session storage are cleared when you close the browser or sign out. Freelancer search data read by the extension is not stored on our servers.

Your rights and choices

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict certain processing, and to withdraw consent. Data protection laws that may apply include Indonesia’s Personal Data Protection Law and, where relevant, the GDPR.

Email hi@paistudio.co to:

• ask for a copy of your data;
• correct inaccurate data;
• delete your account and data;
• withdraw Upwork authorization (you can also revoke Colosal in your Upwork account settings);
• disconnect Telegram or WhatsApp notifications.

We may need to confirm it is you before acting on a request. You can also uninstall the extension at any time from Chrome. If you are unhappy with how we handle your data, you may complain to your local data protection authority.

Security

We use reasonable technical and organizational measures to protect your data from loss, misuse and unauthorized access. No online service can be guaranteed to be completely secure, so we cannot promise absolute security.

Children

Colosal is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If a change is significant, we will take reasonable steps to let you know. Continuing to use Colosal after a change means you accept the updated policy. This version is effective as of the date shown at the top of this page.

Contact

PT Pilar Antar Informasi
Jaya Harmoni JH4-3 Buduran, Sidoarjo
hi@paistudio.co