Privacy Notice
Last updated: 13 October 2026
This is a translation of the Indonesian privacy notice. If the two differ, the Indonesian version prevails.
1. Controller
The controller of personal data for PostingAja is WILLIAM (sole proprietor), Pekanbaru, Riau, Indonesia. Privacy contact: [email protected]. This notice follows Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "PDP Law").
For data about other people that you upload (for example photos of a client's project), you are the controller and we process it on your behalf to provide the service.
2. Data we collect
| Category | Examples |
|---|---|
| Account | Email, password (stored as a hash), workspace name, member role. |
| Content | Before/after photos, logos, music, project details (name, location, style, story), captions and the videos produced. |
| Connected social accounts | Page/account IDs and names, access tokens (encrypted), and IDs and links of posts made through PostingAja. |
| Technical | IP address, device/browser type, access times and error logs. |
| Payments | Once paid plans open: processed by a payment provider licensed in Indonesia. We receive the status and a summary of the transaction, not card numbers or bank details. |
| Communication | Support emails and, if you enable it, your Telegram chat ID for notifications. |
3. Purposes and legal bases
- Providing the service (videos, captions, schedules, storing your material): performance of our contract with you.
- Publishing to your social accounts: the consent you give when connecting an account, which you can withdraw at any time.
- Payments, invoices and taxes: contract performance and legal obligations.
- Security and abuse prevention: our legitimate interest in protecting the service and its users.
- Support and service notices: contract performance.
We do not sell personal data, do not use it for advertising, and do not use your content to train AI models.
4. Recipients
- Supabase: database and authentication (servers in Singapore).
- Cloudflare: file storage (R2), network, DNS and email forwarding.
- DigitalOcean: application servers (Singapore).
- AI provider for captions (via EvoLink, Google Gemini models): only the brand and project details needed to draft captions.
- Meta (Instagram, Facebook), TikTok and Google (YouTube): when we publish to accounts you connect; their processing is governed by their own privacy policies.
- Telegram: if you enable notifications.
- A payment provider licensed in Indonesia (e.g. Midtrans or Xendit), once paid plans open.
- Professional advisers and competent authorities where required by law.
5. International transfers
Some of these providers process data outside Indonesia (mainly in Singapore). We choose providers that apply adequate data protection as required by the PDP Law.
6. Retention
- Account data and content: while the account is active, then deleted within 30 days of closure.
- Social account tokens: deleted when the account is disconnected from PostingAja.
- Video copies fetched by platforms when publishing: deleted within 7 days.
- Technical logs: up to 90 days.
- Transaction records: as required by tax law.
7. Your rights
Under the PDP Law you have the right to information about processing, to access and obtain a copy of your data, to correct it, to request deletion, to withdraw consent, to object to decisions based solely on automated processing, to restrict processing, to data portability, and to lodge a complaint. Send requests to [email protected]; we respond within the time limits of the PDP Law. How to delete your data is described on the Data Deletion page.
8. Security
We use HTTPS, encrypt social account tokens (AES-256-GCM), separate data between workspaces at the database level, and restrict internal access. If a personal data breach occurs, we notify you and the authorities as required by the PDP Law.
9. Cookies
This site uses no tracking or analytics cookies. The PostingAja dashboard only uses cookies needed to keep you signed in.
10. Third-party services
- If you connect YouTube, PostingAja uses YouTube API Services, and you are bound by the YouTube Terms of Service and the Google Privacy Policy. You can revoke access in your Google permissions.
- Facebook/Instagram access can be removed in Facebook Settings → Apps and Websites.
11. Children
PostingAja is not intended for people under 18.
12. Changes
We may update this notice. Material changes will be announced by email or on this site.