Privacy Policy

1. Data we collect

We collect the following data, as you provide it or as a result of using the Service:

• Account data: name, email address, and password (stored hashed, never in plaintext).
• Business profile: business name, product/service description, target audience, tone of voice, content pillars, and any images/logos and product photos you upload.
• Connected social accounts: Instagram/Facebook access tokens (to publish content on your behalf), account IDs, usernames, and content performance metrics we fetch from Meta.
• Content: captions, images, and content plans the AI creates for your brand.
• Payment data: transactions are processed by Midtrans. We store transaction records (amount, status, time) but do not store your card numbers.
• Technical data: cookies (e.g. language preference and login session), IP address, and basic device/browser information.

2. How we use your data

We use your data to:

• Provide and operate the Service, including creating and publishing content that fits your brand.
• Connect and publish to the Instagram/Facebook accounts you choose.
• Show content performance analytics.
• Process payments, subscriptions, and quota.
• Send transactional emails (verification, password reset, notifications).
• Maintain security, prevent abuse, and comply with legal obligations.

3. AI processing

To create captions and images, some data (e.g. your business profile, content direction, and reference images) is sent to third-party AI providers (such as OpenAI) for processing under their terms. We only send the data needed to generate the content you request.

4. Instagram & Facebook (Meta) data

When you connect an account, we access data through the Meta Graph API only for the features you enable:

• Permission to publish content to your Instagram Business/Creator account and Facebook Page.
• Content metrics/insights to show analytics.
• Basic account information (username, ID, profile picture).

Access tokens are stored securely and used only to operate the Service. You can disconnect at any time from Settings or the brand page, and/or revoke access from your Meta account settings. Use of Meta data is subject to the Meta Platform Terms.

5. Sharing with third parties

We do not sell your personal data. We only share data with service providers that help us run the Service, including:

• Meta Platforms (Instagram/Facebook) — for publishing and analytics.
• AI providers (e.g. OpenAI) — to create captions and images.
• Midtrans — to process payments.
• Email providers (e.g. Resend, Brevo, or Gmail) — to send transactional emails.
• Infrastructure/hosting providers (e.g. Vercel, Supabase, Railway, Upstash) — to run the app and store data.

We may also share data where required by law or to protect rights and safety.

6. Data retention & deletion

We retain data while your account is active or as needed to operate the Service and meet legal obligations. You can delete a brand and its content from within the app. To delete your account and all related data, contact us at hello@kreasikan.app.

7. Your rights

You have the right to access, correct, or request deletion of your personal data, and to withdraw certain consents. To exercise these rights, contact hello@kreasikan.app.

8. Security

We apply reasonable technical and organizational measures to protect your data, including password hashing and secure token storage. However, no system is entirely risk-free.

9. Cookies

We use cookies necessary for the login session and to store preferences (such as your language choice). You can manage cookies through your browser, but some features may not work without them.

10. Children

The Service is intended for users aged 18 and over. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the Service or by email. The "Last updated" date indicates the latest version.

12. Contact

For any questions about your privacy or data, contact us at hello@kreasikan.app.