1.About this policy
This policy explains how PT Sigma Asia Nusantara ("we"), which operates the oneout.id service under the Digital Asia Nusantara brand, collects, uses, stores, shares, and deletes personal data. It applies to the oneout.id website, the web and mobile apps, the WhatsApp integration, and all other oneout.id services (the "Service").
oneout.id is still in development. Before launch, the only data we receive comes from early access sign-ups and email correspondence. The rest of this policy describes how we will handle data once the Service is in use, including during beta.
This policy is written with reference to Indonesian Law No. 27 of 2022 on Personal Data Protection (the "PDP Law"). This English version is provided for convenience. If it differs from the Indonesian version, the Indonesian version prevails.
2.Our role in handling data
- As a data controller for our customers' account data (business owners and their team members), early access sign-up data, and technical usage data of the Service.
- As a data processor for data of buyers or followers who interact with our customers' business accounts, such as DMs, comments, and WhatsApp messages. For this data, our customer is the data controller, and we process it only on their instructions under a data processing agreement.
3.Data we collect
Data you give us directly
- Early access sign-up: name, shop or brand name, WhatsApp number, social media or shop links, and the platforms you sell on.
- Account data: name, email, WhatsApp number, business name, and details of team members you invite.
- Working materials: photos, videos, voice notes, text instructions, product catalogs, and brand style preferences ("Brand DNA") that you send or set up.
- Billing data once paid plans are available. Card or bank account details are processed by the payment provider, not stored by us.
- Your communications with our support team.
Data from platforms you connect
When you connect an Instagram, Facebook, Threads, WhatsApp Business, TikTok, YouTube, LinkedIn, X, or marketplace store account, we receive data according to the permissions you approve on that platform. Examples include business profile and account IDs, access tokens, posts and their statistics, comments, direct messages, and order summaries used to measure which content drives sales.
Data of our customers' buyers or followers
Usernames, display names, WhatsApp numbers, and the content of messages or comments from people who contact our customers' business accounts. We process this data as a data processor on behalf of the customer.
Data collected automatically
Technical logs such as IP address, device and browser type, access times, and error records, to keep the Service secure and reliable. Our website only uses cookies needed for the site and accounts to work, including one that remembers your language choice, and no third-party advertising cookies.
Voices and faces
Brand voice features or videos featuring someone's face are only processed with the written consent of the owner of that voice or face. We store this consent and it can be withdrawn at any time.
4.How we use data
- To run the Service: creating and scheduling content, publishing it with your approval, and replying to DMs and comments.
- To create reports, including linking clicks and vouchers to marketplace sales to measure sales per post.
- To contact you about your account, billing, Service changes, and beta invitations.
- To keep the Service secure, prevent abuse, and fix problems.
- To meet legal and tax obligations and lawful requests from authorities.
We do not sell personal data, do not use it for third-party advertising, and do not use customer data to train AI models.
5.Legal basis for processing
We process personal data on the basis of your consent, performance of our service agreement with you, compliance with legal obligations, and legitimate interests such as keeping the Service secure, as provided for in the PDP Law. Where processing is based on consent, you can withdraw it at any time.
6.AI processing
- Content, replies, and reports are created with AI models running on Alibaba Cloud Model Studio. The model provider does not store your data permanently and does not use it to train models.
- Before data is sent to a model, personal details such as phone numbers and addresses are masked if they are not needed for the task.
- AI output can be wrong. That is why, by default, every piece of content is sent to you as a draft to approve, and you decide how independently the AI may work.
8.Transfers outside Indonesia
Data is stored in Alibaba Cloud data centers in Jakarta. For AI processing, some data is sent to Alibaba Cloud Model Studio in Singapore in minimized and masked form, and the results are returned to Jakarta. Platforms you connect may also process data outside Indonesia. We ensure these transfers have an equal or higher level of protection, as required by the PDP Law.
9.How long data is kept
- Account data is kept while the account is active and deleted no later than 30 days after the account is closed.
- DM and comment conversations are kept for 12 months by default. Customers can change this retention period.
- YouTube data is refreshed or deleted within 30 days. LinkedIn member data is kept for no more than 24 to 48 hours.
- Buyer data from marketplaces is kept for no more than 90 days.
- Early access sign-up data is kept until you join, ask for it to be deleted, or for no more than 12 months after public launch.
- Transaction and tax records are kept for as long as required by law.
10.Data security
We encrypt data at rest and in transit, separate each customer's data, limit internal access, support two-step authentication, and record important activity in audit logs. If a personal data protection failure occurs, we will notify you and the relevant authority within 3 x 24 hours, as required by the PDP Law.
11.Your rights
Under the PDP Law, you have the right to:
- Be informed about how your personal data is processed.
- Access and obtain a copy of your personal data.
- Correct or update inaccurate data.
- End processing and have your data deleted or destroyed.
- Withdraw consent you have given.
- Object to decisions made solely by automated processing that significantly affect you.
- Delay or restrict processing.
- Receive your data in a commonly used format and transfer it to another controller.
Send requests to halo@oneout.id. We respond to requests for access, correction, withdrawal of consent, and restriction of processing within 3 x 24 hours of receiving them. For data deletion, follow the steps on the Data Deletion page. If you are a buyer who contacted one of our customers' shops, you can also make your request to that shop.
12.Children
The Service is intended for businesses and not for children under 18. We do not knowingly collect personal data from children. If you become aware that a child's data has been sent to us, contact us so we can delete it.
13.Third-party platform terms
oneout.id uses YouTube API Services. By connecting a YouTube account, you also agree to the YouTube Terms of Service and the Google Privacy Policy. You can revoke oneout.id's access to your Google account at any time on the Google account permissions page.
Access to Meta, TikTok, LinkedIn, X, and marketplace accounts can also be revoked from the connected apps settings on each platform. oneout.id is not affiliated with, sponsored by, or endorsed by those platforms.
14.Changes to this policy
We may update this policy, for example when new features are released. The effective date at the top of this page will be updated, and we will notify you of significant changes by email or within the Service before they take effect.
15.Contact
PT Sigma Asia Nusantara
Epiwalk Office Suite Lt. 5 Unit A501, Jl. HR Rasuna Said, Karet Kuningan, Setiabudi, Jakarta Selatan 12940
Email: halo@oneout.id