Privacy Policy

Kotakchat is operated by WIN DWI PRIANTORO, trading as Orkestrator, an Indonesian sole proprietorship (NIB 1905260098225), KOMP BBS II JL KECUBUNG IV, Kel. Ciwedus, Kec. Cilegon, Kota Cilegon, Banten 42426, Indonesia ("we", "us"). Email: orkestratoridn@gmail.com.

Our role depends on the data:

• Account and website data. For the accounts of team members who use the Service and for visitors of this website, we decide how the data is used and act as the data controller (pengendali data pribadi).
• Customer conversation data. When a business connects its channels, the messages and profiles of the people who contact that business are processed on the business's behalf and on its instructions. For this data the business is the controller and we act as its processor (prosesor data pribadi). If you contacted a business that uses Kotakchat, that business's privacy notice also applies and you can contact the business directly.

Team member accounts

There is no public sign-up: each team account is created by us or by an administrator account of the business it belongs to. For each account we store:

• name, email address, an optional login username and a password hash (never the password itself);
• role, colour, time zone and display preferences, and a profile photo if you upload one;
• sign-in sessions: a random session token, the browser's user-agent text and when the session was created and last used;
• activity in the Service, such as messages you send, notes, assignments, tags you apply, which conversations you have seen, settings you change, call durations and, if the business enables the AI assistant, AI quality reviews of conversations you handled. Businesses use this to manage their team and to see statistics per staff member.

Data we receive from Meta (Facebook and Instagram)

An administrator of a Facebook Page or Instagram professional account connects it with Facebook Login for Business and chooses which Pages and accounts to share. We request these permissions and use them only as described:

pages_show_list

to list the Pages you manage so you can choose which ones to connect.

business_management

to reach the Pages and Instagram accounts that belong to your business portfolio when you connect them.

pages_read_engagement

to read basic information about a connected Page, such as its name and picture.

pages_manage_metadata

to subscribe a connected Page to message notifications (webhooks), and to unsubscribe it when you disconnect it and no other connected account still uses that Page.

pages_messaging

to receive the messages people send to the Page and to send your team's replies.

instagram_basic

to read a connected Instagram account's ID, username, name and profile picture.

instagram_manage_messages

to receive and answer Instagram Direct messages.

Business Asset User Profile Access

to show who is writing: the first name, last name and profile picture of a person who messages the Page on Facebook, and their name, username and profile picture on Instagram.

From Meta we store: the Page's ID, name and picture address; the Instagram account's ID, username, name, picture address and linked Page; the Page access token (encrypted); and, for each person who messages the Page, their page-scoped ID, name and profile-picture address, plus the messages, attachment links, message IDs and delivery and read status.

We do not store your Facebook password or your personal Facebook access token (it is used only while you connect, to find the Pages you chose), and we do not access your personal profile, your friends, or any Page or account you did not select. Profile pictures and media from Facebook and Instagram are kept as links to Meta's servers, not copied to ours.

Data from other channels

• WhatsApp Business (Cloud API): the customer's WhatsApp profile name and phone number, and the text of their messages. Media that customers send on WhatsApp is not stored.
• Telegram bots: the customer's Telegram user ID, first and last name and username, their messages, and the photos, files, videos, voice messages and stickers they send (up to 20 MB each).
• LINE Official Accounts: the customer's LINE user ID, display name and profile-picture address, and their text messages (stickers are kept as links).
• Email: the sender's name and address, and the messages and attachments received after the mailbox was connected. To connect a mailbox, the business enters its mail server settings and password; the password is stored encrypted.
• Website chat plugin: what a visitor enters in the pre-chat form (such as name, phone number, email and any extra fields the business asks for), the address of the web page where the chat was opened, messages, satisfaction ratings and a random visitor ID stored in the visitor's browser.
• Google Business Profile (only if a business connects it): the email address of the Google account used, its Business Profile account ID, and the names and addresses of the locations the business chooses. The access Google grants (a refresh token) is stored encrypted.

Conversations and what your team adds

For each conversation we store the messages and their details, its status, assignment, tags and internal notes. Customer messages are stored up to 4,000 characters each. Files that team members send are stored on our server (up to 25 MB each).

To save your team time, the Service automatically recognises phone numbers in incoming messages and, if a Page administrator turns it on, birthdays, and adds them to the customer's profile. Team members can also add or change a customer's name, email, phone numbers, alias, address, gender and birthday, block a customer, and write notes about them.

AI features (only when enabled)

AI features are off by default and are turned on per Page by an administrator. When they are on, we store AI reply suggestions, sentiment results, quality reviews of conversations, summaries of conversations your team marks as examples, text extracted from knowledge files you upload, website pages you ask the WhatsApp AI agent to read, and usage records (tokens and cost) per Page.

Technical data

Our server processes your IP address and browser information to deliver pages and to protect sign-in and the chat plugin against abuse. We do not store IP addresses in our database; the counters used to limit repeated attempts are kept only in the server's memory and are cleared when it restarts. Logs of our web server may record IP addresses for a short time for security and troubleshooting.

What we do not collect

We do not collect payment card or bank details: the Service does not take payments. We do not use analytics, advertising or tracking tools, and we do not set advertising cookies.

We use personal data only to:

• provide the inbox: receive, show, store and send messages for the business that connected the channel, and keep its customer profiles, notes and tags;
• let the business's team work together: accounts, roles and permissions, assignment, round robin, notifications and reminders;
• show statistics and reports to that business's own team;
• run optional features the business turns on, such as the AI assistant, outgoing webhooks or the API;
• keep the Service secure: sign-in, sessions, access control, limits on repeated attempts, checking that incoming notifications really come from the platform, and investigating misuse;
• contact administrators about the Service, for example to answer support requests or announce important changes;
• comply with the law and answer lawful requests from authorities.

Under the UU PDP we rely on: performing our agreement with the business and its users; the business's instructions, for customer conversation data; our legitimate interest in keeping the Service secure and working; legal obligations; and consent where the law requires it.

We do not make automated decisions that have legal or similarly significant effects on you. AI quality reviews of staff conversations exist only if the business enables them, and are meant to be read and judged by people.

Data we receive from Meta platforms (Facebook and Instagram) is used only to provide the Kotakchat inbox to the business that connected the Page or account. We do not sell it, we do not use it for advertising or marketing, and we do not share it with anyone except as needed to provide the Service to that business (see "How we share information") or when the law requires it.

• Data from a business's Pages is visible only to the team members that business has given access. It is never combined with other businesses' data or used to build profiles of people across businesses.
• Data received from Meta goes back to Meta only to deliver the messaging features you use, such as sending replies, marking messages as seen and showing that you are typing.
• The optional AI assistant can learn from conversations a business marks as examples by keeping summaries for that business's own suggestions. This knowledge is never shared with other businesses and is not used to train AI models.
• Meta's own use of data is described in Meta's Privacy Policy.

We do not sell personal data. We share it only in these cases:

• The platforms you connect. To send and receive messages we exchange data with Meta (Facebook, Instagram and the WhatsApp Business Platform), Telegram, LINE, Google (Business Profile, if connected) and the email servers the business configures. Each platform processes data under its own terms and privacy policy.
• AI provider, only if enabled. If a business turns on the AI assistant, the anti-spam check for comments or the WhatsApp AI agent, the relevant conversation text, the Page name and the knowledge the business has added are sent to Anthropic, PBC (Claude API) to produce the results. Anthropic acts as our service provider.
• Hosting. The Service runs on servers we rent from a hosting provider, which stores the data for us.
• Voice calls in the chat plugin. Calls connect the visitor's browser directly to the agent's browser and are not recorded. To set up the connection, both browsers contact a Google STUN server, which can see their IP addresses.
• Link previews. When a message contains a web link, our server fetches that page to show a preview, and team members' browsers load the preview image from the website that hosts it.
• Recipients the business chooses. A business can send events to its own systems through signed webhooks, or let its systems read conversations through an API token. Those recipients receive data on the business's instructions and are its responsibility.
• Legal reasons. We may disclose data when required by law, a court order or a lawful request from an authority, or to protect the rights, safety and security of our users, the public or the Service.
• Transfer of the Service. If the Service is transferred to another operator, the data may be transferred with it under this policy, after notice to the businesses that use it.

Team members' browsers load profile pictures and media from Meta and LINE directly from those platforms' servers.

Some of the providers above process data outside Indonesia; Meta, Google and Anthropic, for example, operate in the United States and other countries. Our own servers may be located in or outside Indonesia. When personal data is transferred abroad, we make sure the transfer has a basis permitted by the UU PDP, such as adequate and binding safeguards from the recipient.

• Conversations, customer profiles, notes and files are kept while the business uses the Service, so its history stays available. They are not deleted automatically. Disconnecting a channel stops new messages but keeps the history so the channel can be reconnected. Messages and notes removed in the app are hidden but stay in the history until the channel's data is deleted. An administrator of the channel can delete it permanently in the app at any time, which erases this data immediately.
• Team accounts are kept until the business or the person asks us to delete them. Deactivating an account signs it out everywhere and blocks access; the record is kept so past messages and activity stay attributed.
• Credentials (access tokens, bot tokens, mailbox passwords) are kept, encrypted, until the channel's data is deleted.
• Sessions end when you sign out and expire 30 days after you sign in.
• Short-lived records: details of an unfinished connection are deleted after 24 hours and webhook delivery logs after 7 days, and only the latest 500 notifications per user and 500 settings changes per Page are kept.

When a business asks us to close its account, or we receive a valid deletion request, we delete the data as described on our Data deletion page within 30 days.

• All connections to Kotakchat use HTTPS. Connections to the messaging platforms and to the AI provider use HTTPS, and email servers are reached over TLS.
• Access tokens, bot tokens, channel secrets and mailbox passwords are encrypted with AES-256-GCM and are never shown in full again after they are saved.
• Team passwords are stored only as salted scrypt hashes. Repeated failed sign-ins are limited. Changing your password signs out your other sessions, and a reset by an administrator signs out all of them.
• Session cookies cannot be read by scripts and are sent only over HTTPS, and requests that change data must come from our own site.
• A Page's data can be reached only by team members who have access to that Page, according to their role and permissions. A team account's name and email are shown only to the administrator who created it and to members of the Pages it belongs or belonged to.
• Notifications from Meta, WhatsApp and LINE are accepted only with a valid platform signature, and server requests to web addresses supplied by users cannot reach internal networks.
• Uploaded files are stored with restricted file permissions and served only to signed-in members of the Page they belong to, except the avatar and button images a business chooses for its public website chat plugin.

No system is completely secure. Apart from the credentials above, stored data is not encrypted at rest, so we protect it by restricting access to our servers. If a personal data breach happens, we will inform the affected businesses and, where required, the people concerned and the authorities, within the time limits of the UU PDP.

Under the UU PDP you have the right to:

• be informed about how your personal data is processed;
• access your data and get a copy of it;
• correct or update inaccurate data;
• have processing stopped and your data deleted or destroyed;
• withdraw consent you have given;
• object to decisions based only on automated processing;
• have processing delayed or restricted;
• get your data in a commonly used format and have it sent to another controller;
• complain and claim compensation if your rights are violated.

Team members can change their name, photo, password and preferences, and see and end their sessions, under Account in the app. For anything else, email orkestratoridn@gmail.com. We may need to confirm your identity, and we respond within the time limits of the UU PDP.

If you contacted a business that uses Kotakchat, please send your request to that business first, because it controls your data. You can also write to us: we will pass your request on and help the business respond.

You can also complain to Indonesia's personal data protection authority.

An administrator of a connected Page, Instagram account or other channel can delete it, with its conversations, customer data and files, at any time in the app under Setting → Connection → Delete permanently. To delete your team account, or a channel you cannot delete in the app, follow the steps on our Data deletion page or email orkestratoridn@gmail.com from your account's email address. We complete those requests within 30 days after verifying them.

We use only what the Service needs to work. There are no analytics or advertising cookies.

pc_session

keeps you signed in. It cannot be read by scripts, is sent only over HTTPS and expires after 30 days or when you sign out.

lang

remembers the language you chose (English or Indonesian) for one year.

Local storage

the app keeps display preferences in your browser, such as inbox filters, the top-bar theme and statistics settings. The chat plugin on a business's website keeps a random visitor ID so a returning visitor continues the same conversation. Clearing the site data in your browser removes them.

The Service is meant for businesses and their staff, and team accounts may only be used by people aged 18 or over. We do not knowingly collect children's data for our own purposes. People of any age can message a business that uses Kotakchat; that business is responsible for handling those conversations lawfully, including any need for parental consent. If you think a child's data should be removed, contact us and we will work with the business to delete it.

We may update this policy when the Service or the law changes. We will publish the new version here with a new effective date and, for significant changes, inform administrators in the app or by email before the changes apply.

Questions and requests about privacy: WIN DWI PRIANTORO (Orkestrator), KOMP BBS II JL KECUBUNG IV, Kel. Ciwedus, Kec. Cilegon, Kota Cilegon, Banten 42426, Indonesia. Email: orkestratoridn@gmail.com.

This policy is available in English and Indonesian. If the two differ, the Indonesian version prevails.