Privacy Policy
In shortWe collect the data needed to run your autoDM account, connect it to Instagram, bill you and support you. When your automations run, we process your subscribers’ Instagram data on your behalf and under your instructions. We store data in Jakarta, use Anthropic for AI replies, never sell personal data, and never use it to train AI models. Contact privacy@autodm.kalachakra.io to exercise your rights.
1. Who this policy covers
This Privacy Policy explains how PT Kalachakra Wisnu Indonesia, trading as autoDM (“autoDM”, “we”, “us”), handles personal data in connection with the autoDM website at autodm.kalachakra.io and the autoDM service (together, the “Service”). It is written to meet Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) and related Indonesian regulations.
It applies to:
- Visitors to our website;
- Customers and their team members who create or use an autoDM account; and
- Subscribers: Instagram users who interact with a Customer’s Instagram account and whose messages are handled by autoDM.
It does not cover Meta’s own processing of your Instagram data (see Instagram’s Privacy Policy) or the practices of Customers, who are responsible for their own privacy notices.
2. Our role: controller or processor
Under the PDP Law we act in two capacities:
- As a controller (pengendali data pribadi) for data about Visitors and Customers, for example your account details, billing records, support emails and website analytics. Sections 3 to 5 describe this processing.
- As a processor (prosesor data pribadi) for Subscriber Data, which we process only on the instructions of the Customer whose Instagram account the Subscriber interacted with. Section 6 describes this processing, and our Data Processing Addendum sets out our obligations to Customers.
If you are a Subscriber with a question about how a business uses your data, please contact that business first. We will help them respond.
3. Data we collect about Visitors and Customers
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (hashed), business name, profile picture, team member names and emails, language preference | You, or Google if you sign in with Google |
| Instagram connection data | Instagram professional account ID and username, linked Facebook Page ID, access tokens, permissions granted | Meta, when you connect your account |
| Customer Content | Automations, templates, FAQs, product catalogues, business details, AI Knowledge | You |
| Billing data | Plan, invoices, payment status, transaction IDs, billing name and address. We do not receive full card numbers or bank credentials. | You and DOKU |
| Usage data | Features used, Automations run, message counts, log-in times, error logs | Generated by the Service |
| Device and technical data | IP address, browser type, operating system, device identifiers, referring page, approximate location derived from IP | Your browser or device |
| Cookies and similar technologies | See our Cookies Statement | Your browser, subject to your consent choices |
| Communications | Emails, support requests, survey responses, feedback | You |
4. How and why we use it
| Purpose | Legal basis under the PDP Law (Art. 20) |
|---|---|
| Creating and administering your account, connecting Instagram, running your Automations, and providing support | Performance of our contract with you |
| Processing payments, issuing invoices and tax records | Performance of our contract; compliance with legal obligations |
| Sending service notices (billing reminders, maintenance, security alerts, changes to terms) | Performance of our contract; legitimate interests |
| Securing the Service, preventing fraud and abuse, enforcing our Terms | Legitimate interests; compliance with legal obligations |
| Understanding how the Service is used and improving it, using aggregated or de-identified data where possible | Legitimate interests |
| Website analytics and advertising cookies | Your consent, given through our cookie banner |
| Sending product news and marketing emails | Your consent; you can unsubscribe at any time |
| Complying with law, responding to lawful requests from authorities, and establishing or defending legal claims | Compliance with legal obligations; legitimate interests |
We do not sell personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We share personal data only as needed to run the Service, with the following categories of recipients. Our current list of providers, with locations, is on the Service Providers page.
- Hosting and infrastructure: IdCloudHost (data centres in Jakarta, Indonesia).
- Meta Platforms: to connect to and exchange data with the Instagram API.
- AI provider: Anthropic, for AI-enabled features only (see Section 7).
- Payments: DOKU (PT Nusa Satu Inti Artha), which processes payments as an independent controller under its own privacy policy.
- Domain, DNS and email: DomaiNesia.
- Sign-in, analytics and advertising services: such as Google and Meta, subject to your cookie choices.
- Professional advisers and authorities: lawyers, auditors, regulators, courts and law enforcement, where required or permitted by law.
- A successor: if we merge with, are acquired by or sell assets to another organisation, with notice to you.
6. Subscriber Data
When a Subscriber comments on a Customer’s post, replies to a story, follows the account or sends a direct message, Meta sends us the event through the Instagram API so the Customer’s Automation can respond. For that purpose we process:
- the Subscriber’s Instagram-scoped user ID, username, display name and profile picture;
- the content of the comment, story reply or direct message and its timestamp;
- the replies sent by the Customer’s Automations and any tags, notes or fields the Customer records about the conversation; and
- for AI-enabled Customers, intent classifications and AI-generated replies.
We use Subscriber Data only to run the Customer’s Automations, to display conversations to the Customer, to provide support, and to secure the Service. We do not use it for our own marketing, do not combine it across Customers, and do not use it to train AI models. We process it in accordance with Meta’s Platform Terms, including Meta’s requirements on data deletion.
Subscriber Data is deleted when the Customer deletes it, when the Customer disconnects the relevant Instagram account, when we receive a deletion request from Meta (for example because the Subscriber removed the app or deleted their Instagram account), or when the Customer’s account is closed, whichever is first.
7. AI features
For Customers on AI-enabled Plans, we send the relevant parts of the Customer’s Knowledge and the recent conversation to Anthropic, PBC so that its language model can generate a reply or classify intent. Anthropic processes this data on our instructions, may do so outside Indonesia, and is contractually prohibited from using it to train models. Customers are told this in the AI Supplementary Terms. Rule-based Automations do not involve any AI provider.
8. International transfers
We store and process personal data primarily in Indonesia. Some of our providers, in particular Meta (Instagram API) and Anthropic (AI features), process data in the United States and other countries. Where we transfer personal data outside Indonesia we do so in accordance with Article 56 of the PDP Law, by ensuring the destination offers an equivalent or higher level of protection, by putting in place contractual safeguards with the recipient, or, where neither applies, with your consent.
9. Retention
| Data | How long we keep it |
|---|---|
| Account data and Customer Content | For as long as your account is open, then deleted within 30 days of closure and purged from backups within 90 days |
| Subscriber Data | Until deleted by the Customer, the Instagram account is disconnected, a Meta deletion request is received, or the Customer’s account is closed (then as above) |
| Conversation and AI logs | 12 months by default, or earlier if the Customer deletes them |
| Billing and tax records | 10 years, as required by Indonesian tax and company law |
| Support communications | 3 years after the request is closed |
| Security and access logs | 12 months |
| Cookie consent records | 12 months from your last choice |
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, hashed passwords, role-based access control, least-privilege access for our staff, logging and monitoring, network segmentation, regular backups, and secure development practices. Our infrastructure is hosted in IdCloudHost data centres that are ISO/IEC 27001 certified, and we have completed Meta Business Verification. No system is completely secure; if we become aware of a breach affecting your personal data we will notify you and, where required, the Personal Data Protection authority within 3 × 24 hours, as required by Article 46 of the PDP Law.
11. Your rights
Under the PDP Law you have the right to:
- be informed about how your personal data is processed;
- access and obtain a copy of your personal data;
- correct or complete inaccurate personal data;
- have your personal data deleted or destroyed, subject to legal retention requirements;
- withdraw consent where processing is based on consent;
- object to processing, including for direct marketing and to decisions based solely on automated processing;
- restrict processing in certain circumstances;
- receive your personal data in a portable format; and
- claim compensation for violations of the PDP Law, and lodge a complaint with the competent authority.
To exercise a right, email privacy@autodm.kalachakra.io. We may ask you to verify your identity. We respond within 3 × 24 hours to acknowledge your request and resolve it as soon as practicable, and in any case within the period required by law. Customers can also export or delete most of their data directly in the Service. If you are a Subscriber, we will forward your request to the relevant Customer and assist them in responding.
12. Children
The Service is for people aged 18 and over. We do not knowingly collect personal data from children. Customers must not use the Service to target or collect data about children. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Cookies
We use cookies and similar technologies on our website. Essential cookies are always on; preference, advertising and analytics cookies are set only with your consent, which you can change at any time through the “Privacy Settings” link in our website footer. See our Cookies Statement for details.
14. Links to other sites
Our website and Service may link to third-party sites, including Instagram and Meta. We are not responsible for their privacy practices.
15. Changes
We may update this policy from time to time. We will post the new version here with a new effective date and, for material changes, notify Customers by email or in the Service at least 14 days before they take effect.
16. Contact
PT Kalachakra Wisnu Indonesia (autoDM)
Attn: Data Protection
Epicentrum Walk Suite Building, 5th Floor, Office Suite South 529A, Rasuna Epicentrum CBD, Jl. HR Rasuna Said, Jakarta Selatan, DKI Jakarta, Indonesia
privacy@autodm.kalachakra.io