Privacy Policy

1. About This Policy

This Privacy Policy explains how OlahKonten (the "Service", available at olahkonten.com) collects, uses, stores, and protects your personal data. It applies to the OlahKonten website and web application, and to every social media account you connect to OlahKonten. By using OlahKonten you agree to the practices described here.

2. Data We Collect

• Account: name, email, password (hashed).
• Content you create: idea text, voice notes, link previews, AI-generated text + images, drafts, schedule.
• Payment: transaction history, subscription status. Cards/e-wallets are processed by Midtrans — we don't store card data.
• Connected social accounts: access tokens and basic profile data for the platforms you connect — see section 3.
• Technical: IP, user-agent, error logs for debugging via Sentry.

3. Connected Social Accounts

OlahKonten publishes content on your behalf only to the social accounts you explicitly connect. Connecting an account is always initiated by you, from Settings > Integrations, and always goes through the platform's own consent screen. We currently support TikTok, Instagram, Threads, X, LinkedIn, and YouTube.

• What we receive: an OAuth access token and refresh token (both stored encrypted), plus your public profile on that platform — username, display name, avatar, and account-level counts such as followers.
• TikTok specifically: when you connect a TikTok account, OlahKonten requests the scopes user.info.basic (username and avatar shown in Settings), user.info.stats (follower, like, and video counts shown on your own analytics dashboard), video.upload and video.publish (to upload and post the videos you created and scheduled in OlahKonten), and video.list (to read back the status and stats of videos posted through OlahKonten).
• YouTube (Google) specifically: when you connect a YouTube channel, OlahKonten requests the scopes youtube.upload (to upload the videos you created and scheduled in OlahKonten to your own channel as Shorts, with the visibility you choose per post) and youtube.readonly (to read your channel name and avatar, and the view, like, and comment counts of videos uploaded through OlahKonten). OlahKonten's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from your Google Account permissions page.
• Instagram and Threads (Meta) specifically: when you connect an Instagram professional account, OlahKonten requests instagram_business_basic (your account ID, username, and profile picture, shown in Settings), instagram_business_content_publish (to publish the photos, videos, Reels, and carousels you created and scheduled in OlahKonten), and instagram_business_manage_insights (reach, views, likes, comments, saves, and shares of posts published through OlahKonten, shown on your own analytics dashboard). Threads works the same way with threads_basic and threads_content_publish.
• What we do with it: publish the posts you scheduled, at the time you chose, and show you your own account statistics inside OlahKonten. Nothing else.
• What we never do: we do not post anything you did not create and schedule yourself, we do not read your private messages, we do not sell or rent platform data, we do not share it with advertisers, and we do not use it to train AI models.
• Disconnecting: you can disconnect any platform at any time in Settings > Integrations. Disconnecting deletes the stored tokens and the cached profile data for that account from our systems. You can also revoke access from the platform's own settings — for TikTok, in the TikTok app under Settings and privacy > Security and permissions > Manage app permissions.
• Deleting your Meta data: to remove everything OlahKonten holds from Instagram or Threads, (1) disconnect the account in Settings > Integrations — this immediately deletes its tokens and cached profile and insights data; (2) optionally remove OlahKonten from Instagram under Settings > Apps and websites (or Threads under Settings > Account > Website permissions); and (3) to delete your whole OlahKonten account and all content, email the Data Protection Contact below — we complete deletion within 30 days and confirm by email.
• Platform rules: data received from a platform is handled in line with that platform's developer terms and policies, including the TikTok Developer Terms of Service and the Meta, Google, X, and LinkedIn platform terms.

4. Purpose of Processing

• Operating the Service (content generation, scheduling, publishing, billing).
• Communication: receipt emails, payment reminders, support.
• Security & abuse prevention.
• Improving the Service (aggregate, anonymized analytics).

5. Third Parties (Sub-processors)

OlahKonten uses third-party services to operate the Service. Each provider has its own privacy policy:

• AI Providers — OpenAI, Anthropic, Google Gemini, Groq, xAI, ElevenLabs, Mistral. Content you generate is sent to these providers to produce the output. Data from your connected social accounts is never sent to these providers.
• Social platforms — TikTok, Meta (Instagram, Threads), Google (YouTube), X, and LinkedIn receive the posts you schedule, at publish time, through their official APIs.
• Midtrans — payment processing.
• Cloudflare — CDN, DDoS protection.
• Sentry — error monitoring.
• S3-compatible storage — image and video hosting.

6. Cross-Border Data Transfer

Your data may be processed outside Indonesia (AI provider, social platform, and storage servers). We ensure data is protected to a standard equivalent to the PDP Law through contracts with our sub-processors.

7. How We Protect Your Data

We treat OAuth tokens, account credentials, and the content you create as sensitive data, and protect them with the following technical and organizational measures:

• Encryption in transit: all traffic between your browser, OlahKonten, and the platforms we connect to is encrypted with HTTPS/TLS. Unencrypted connections are not accepted.
• Encryption at rest: OAuth access tokens and refresh tokens for every connected platform (including YouTube and TikTok) are encrypted with AES-256 before they are written to the database, using an application key that is stored separately from the database.
• Password hashing: passwords are stored only as salted one-way bcrypt hashes — no one, including our team, can read your password.
• Tokens never leave the server: OAuth tokens are used only by our servers to call the platform APIs on your behalf. They are never sent to your browser, never written to logs, and never shared with AI providers or any other third party.
• Access control: every request is authenticated and your data is scoped to your account, so other users cannot access it. Administrative access to production systems is restricted to a small number of authorized personnel, behind role-based permissions.
• Account security: session cookies are HttpOnly and Secure, and you can enable two-factor authentication (2FA) in Settings for additional protection.
• Data minimization: we request only the platform scopes needed for the features you use, and delete tokens and cached profile data as soon as you disconnect an account.
• Infrastructure: the Service runs behind Cloudflare (DDoS protection and firewall), with production credentials kept out of source code, and errors monitored so security issues are detected quickly.
• Breach notification: if a data breach affecting your personal data occurs, we will notify affected users and the relevant authority in writing within 3 × 24 hours, as required by the PDP Law.

8. Retention

• Account data: as long as the account is active + 30 days after deletion.
• Generated content: as long as the account is active (unless you delete it manually).
• Social account tokens and cached profile data: until you disconnect that account or delete your OlahKonten account, whichever comes first — deletion is immediate.
• Transaction history: 5 years (Indonesian tax compliance).
• Error logs: 30 days.

9. Your Rights (PDP Law)

• Right to access — request an export of all your data.
• Right to correction — fix inaccurate data.
• Right to erasure — request your account + data be deleted.
• Right to withdraw consent at any time, including by disconnecting a social account.
• Right to complain to the Ministry of Communication and Informatics if you believe your privacy rights have been violated.

10. Cookies

OlahKonten uses cookies for login sessions and display preferences (dark mode, sidebar state, language). There are no third-party tracking cookies in the app.

11. Minors

The Service is not intended for users under 18. If you're a parent/guardian and find that your child has signed up, contact us to have it removed.

12. Changes

Material changes will be communicated via email + an in-app banner at least 14 days before they take effect.

Data Protection Contact

Email for privacy questions or to exercise your PDP Law rights.