Privacy Policy

This Privacy Policy explains the commitment of PT Teknologi Aplikasi Sahabat Sejati ("we", "us", "our", or "Tassly") to protecting the privacy and personal data of users of the Tassly.io platform (the "Platform"). We are committed to processing personal data lawfully, transparently, in a limited manner, and securely in accordance with Law Number 27 of 2022 on Personal Data Protection (the "PDP Law") and other applicable laws and regulations in Indonesia, including our obligations as an Electronic System Operator. This Policy forms an integral part of our Terms and Conditions of service.

1. Legal Basis for Data Processing

The processing of User account data and transaction data is based on the performance of a valid service agreement between the User and Tassly, namely for the provision, operation, and maintenance of the Service requested by the User. Without such data processing, we cannot provide an account, process credit purchases, or deliver important notices related to the Service.

Personal data in Source Data may be processed to retrieve sources, analyze accounts, posts, comments, and interactions, prepare interpretations and Outputs, and perform requested monitoring where available. Public availability is not by itself the data subject's consent or a legal basis for all processing.

Where applicable law requires explicit consent for certain processing, we will request such consent separately and transparently. The User may withdraw consent at any time in accordance with the mechanism set out in the chapter on Data Subject Rights.

This Policy update does not authorize processing carried out before the update.

2. Categories of Data Collected

We collect and process the following categories of data:

• Account Identity Data: email address, User ID, display name, and profile photo when available through the account or authentication process.
• Transaction Data: records of credit purchases, transaction numbers, payment amounts, and verification times, without storing sensitive payment data such as card numbers or CVV.
• Business Context and Source Data: a profile or context about the User's own brand, a client, or a competitor, and handles, display names, bios, follower counts, post captions, comments, timestamps, engagement, video, images, and transcripts where a feature uses them.
• Output Data: categories and per-comment interpretations of intent, sentiment, or emotion, and summaries. Per-comment Outputs may still identify a person.
• Technical and Activity Data: account or session identifiers, times, process statuses, usage events, and technical data received by Tassly systems or providers, such as IP addresses, browser types, or device information for authentication, security, and operations.

Source Data or Outputs may incidentally contain sensitive information or information about children. Tassly does not represent that all such data is automatically screened or detected.

3. Data Protection Roles

Tassly acts as the Personal Data Controller for account and transaction data and for security, legal compliance, and rights-handling activities whose purposes and means Tassly determines. For standard Source Data collection, selection, storage, and analysis whose purposes and control are determined by Tassly, Tassly also acts as a Personal Data Controller.

The User determines the User's own business purposes and how to use Outputs. Each party is responsible for its own obligations according to the processing activity and applicable law. Roles may differ by feature, data, and activity.

4. Purposes of Data Processing

We process personal data for the following purposes:

• Providing available public account and post analysis features, including processing comments, interactions, media, categories, interpretations, drafts, reports, and monitoring where offered.
• Processing credit purchase verification and accurately recording transactions.
• Delivering important notices related to the Service, including transaction information, changes to terms, and security notices.
• Preventing fraud, account misuse, and activities that violate the terms of service.
• Operating the Service, authentication, support, and security.
• Complying with applicable legal obligations, including tax obligations, bookkeeping, and dispute handling.

We do not use User personal data for the marketing purposes of third parties, and we do not process data beyond the purposes described in this Policy without a valid legal basis.

5. Processing of Comments and Public Information

Where available, features may process public accounts, posts, comments, and interactions from TikTok, Instagram, and X. Data may include usernames, display names, post captions, comments, engagement, video, images, or transcripts where a feature uses them.

Outputs may include per-comment analysis that can still be associated with a person. CSV exports may include usernames, display names, comment text, labels, draft replies, and reply text. PDF reports present summaries and analysis rather than lists of raw comments, commenter identities, or replies, but may identify accounts or sources.

Outputs may be generated with artificial intelligence (AI) from a snapshot of Source Data available during processing, not from complete real-time information. Deletion or changes at the source do not automatically update an Output. Updates depend on the selected feature, its functions, and its schedule. Outputs may be inaccurate or incomplete. Interpretations of intent, sentiment, or emotion are not established facts, diagnoses, or evidence of wrongdoing. Users should review Outputs before contacting a person, publishing material, or sharing a report.

The Service is not intended to create sensitive profiles of individuals or determine a person's character. Account owners and commenters may contact support@tassly.io with rights requests, questions, or reports without having a Tassly account. For TikTok post scans, a data retrieval provider may be asked to download video or slideshow images and obtain a transcript. TikTok monitoring uses a separate flow that retrieves metadata without downloading media, subtitles, or comments.

6. Disclosure to External Processors

Tassly uses service providers for cloud computing, authentication, storage, payment, Source Data retrieval, and artificial intelligence model APIs. Model API requests may contain comment text and source usernames or handles needed to generate Outputs. Data received and processed may vary by provider and service.

Service providers may process data through transfers, access, or storage inside or outside Indonesia. Tassly's primary storage location does not by itself determine where all processing by providers takes place. Cross-border processing must meet applicable legal requirements.

Tassly does not sell, rent, or trade User personal data to third parties for marketing or any other purpose.

7. Use of Cookies and Local Storage

Cookies and local storage may be used for account sessions, preferences, service functions, and referrals. A referral cookie may remain for up to 30 days and may be deleted earlier, including when used during signup.

Users may delete or restrict cookies and local storage through their browser. Restricting storage needed for a session or service function may affect that function.

8. Data Retention and Export Schedule

We apply the following data retention schedule:

• For completed scans, access to raw data and CSV exports closes 14 days after completion, and access to summaries closes 90 days after completion. Deadlines set when a request is created may be provisional. Incomplete scans and older histories follow their applicable status and lifecycle.
• Content plans and reports have a 90-day access period from completion. Monitoring sessions have a 90-day period from creation. Certain activity records use retention classes of 30 days for operations, 90 days for analytics, or 365 days for audit, depending on record type. Account or business profiles are maintained as needed to manage the account, profile, and Service, not under automatic 14- or 90-day deadlines.
• The User is responsible for maintaining the security of downloaded CSV and PDF files for internal purposes, and is prohibited from distributing them unlawfully.

Cleanup after the access period is periodic. An access period does not guarantee physical deletion of every copy on a particular day. Particular data may be retained only if and for as long as needed for legal obligations, lawful transactions, active work, security, or disputes. Files downloaded or copied by a User are outside Tassly's control.

9. History Deletion and Account Closure

The in-account delete history command only removes or hides history from the account view. Users may send one email to support@tassly.io to request account closure and exercise data rights, including deletion. If the email includes a deletion request, Tassly will treat it as a data rights request without requiring a separate submission. Tassly may request proportionate identity verification. Account closure or a rights request does not immediately delete data or copies. Particular data may be retained only if and for as long as needed for legal obligations, lawful transactions, active work, security, or disputes.

10. Referral and Affiliate Program Transparency

When an active referral relationship is established, the partner dashboard may display a customer's display name, masked email, customer reference, relationship source and date, attributed purchase count, and date of the last attributed purchase. This information is used to manage the relationship and attribute referrals, not to provide general access to scans or comments.

11. Data Subject Rights and Procedures

Data subjects may request information about processing and access to or a copy of data, correction, cessation or restriction of processing, and deletion. They may also withdraw consent where consent is the applicable basis, object to decisions based solely on automated processing including profiling that produce legal or similarly significant effects, and request portability where legal conditions are met. These rights are available to Users and people whose data appears in comments or Source Data. A Tassly account is not required.

Send a request to support@tassly.io and describe the data or processing involved. Account closure and data rights requests may be sent in one email. Tassly may request identity or authority evidence proportionate to the risk. Tassly will respond within the period required by law.

If a request cannot be fulfilled in part or in full, we will provide clear reasons in accordance with applicable legal provisions. Users also have the right to submit complaints to the competent personal data protection supervisory authority if a request is not resolved.

12. Data Security and Incident Notification

Tassly uses reasonable technical and organizational measures to protect personal data.

In the event of a personal data protection failure, we are committed to notifying the affected data subjects and the competent authority no later than 3 x 24 hours in accordance with the provisions of the PDP Law. Such notification contains information regarding the affected data, the cause of the incident, and the mitigation measures we have taken. Notice will not be delayed solely because an internal investigation remains unfinished.

We affirm that Tassly does not use user comment content data to train, refine, or develop artificial intelligence models owned internally by Tassly.

13. Child Privacy Protection and Contact Details

The Service is not intended for children. Source Data may incidentally contain information about children. If Tassly receives a reasonable report that Source Data or an Output contains information about a child or information that should be restricted, Tassly will review it and take appropriate action under applicable law.

The official contact for all questions, requests, or complaints related to privacy and personal data protection is support@tassly.io with the email subject [Privacy]. We will follow up on every request in accordance with the procedures and timeframes set out in this Policy.

This document is prepared in both Indonesian and English versions. In the event of any discrepancy, ambiguity, or conflict of interpretation between the Indonesian version and the English version, the Indonesian version shall prevail and govern in all respects.

Material changes to this Policy will be notified through the registered email address or an official notice on the Platform no later than 14 calendar days before the effective date of the change.