Privacy Policy
This Privacy Policy explains how Madebyruh ("we", "us", "our") collects, uses, shares, stores and deletes information when you use omniapp (the "Service"), available at https://madebyruh.id. It also explains the choices and rights you have. We process personal data in line with Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi) and the Meta Platform Terms.
1. Who this policy applies to
- Business Users — companies or individuals who create an omniapp workspace and connect their Facebook Page, Instagram professional account or WhatsApp Business Account.
- Agents — staff invited by a Business User to handle conversations.
- End Customers — people who send messages to a Business User through Facebook Messenger, Instagram Direct or WhatsApp.
2. Information we collect
2.1 Account information (Business Users and Agents)
- Name, email address, password (stored hashed), phone number, company name and role.
- Billing information, if you subscribe to a paid plan. Card details are handled by our payment provider and are not stored on our servers.
2.2 Information received from Meta platforms
When a Business User logs in with Facebook and grants permissions, we receive only the data needed to provide the inbox:
| Source | Data we receive | Why we need it |
|---|---|---|
| Facebook Login | Facebook user ID, name, email (if granted), and an access token | To identify the Business User and list the Pages/accounts they manage |
| Facebook Pages | Page ID, Page name, Page profile picture, Page access token; messages sent to and from the Page; sender's Page-scoped ID (PSID), name and profile picture | To display and reply to Messenger conversations in the inbox |
| Instagram professional account ID, username, profile picture; Direct messages sent to and from the account; sender's Instagram-scoped ID, username and profile picture | To display and reply to Instagram Direct conversations in the inbox | |
| WhatsApp Business Platform | WhatsApp Business Account ID, phone number ID, display name; messages sent to and from the business number; customer's WhatsApp phone number and profile name; message delivery/read status | To display and reply to WhatsApp conversations and show delivery status |
| Media in messages | Images, videos, audio, documents and stickers that End Customers or Agents send | To show attachments inside the conversation |
Permissions we may request include: public_profile, email, pages_show_list, pages_manage_metadata, pages_messaging, pages_read_engagement, business_management, instagram_basic, instagram_manage_messages, whatsapp_business_management and whatsapp_business_messaging. We only request the permissions needed for the channels you choose to connect.
2.3 Information created in the Service
- Replies written by Agents, internal notes, labels, conversation assignments and handoff history.
- Contact records the Business User creates or edits (for example, a customer's name or tags).
2.4 Technical information
- IP address, browser type, device information, log data and timestamps of actions in the dashboard.
- Essential cookies used to keep you signed in and remember your language. We do not use advertising cookies.
3. How we use information
- To provide the Service: receive, display, route and send messages; assign and transfer conversations between Agents.
- To create and secure accounts, authenticate users and prevent fraud or abuse.
- To provide customer support and send service-related notices (for example, security alerts or billing).
- To maintain, troubleshoot and improve the reliability and performance of the Service.
- To comply with legal obligations.
We do not sell personal data, use data from Meta platforms for advertising or profiling, share it with data brokers, or use it to train AI models for third parties. We do not use Meta Platform Data for any purpose other than providing the Service to the Business User who connected it.
4. Legal basis
We process personal data based on: performance of our contract with the Business User; the Business User's instructions as data controller; our legitimate interests in securing and improving the Service; your consent where required (for example, when you grant Facebook permissions); and compliance with legal obligations.
5. How we share information
We share data only in these cases:
- Within your workspace — Agents and admins of the same Business User can see that workspace's conversations. Workspaces are isolated from each other.
- Meta Platforms — messages you send are delivered through Meta's APIs (Facebook, Instagram, WhatsApp).
- Service providers — cloud hosting, database, email delivery and payment processors that help us run the Service, under contracts that require them to protect the data and use it only for us.
- Legal reasons — when required by law, court order or a valid request from authorities, or to protect the rights, safety and property of users or the public.
- Business transfer — if we are involved in a merger or acquisition, with notice to you and the same protections applying.
6. Data storage and transfers
Data is stored on servers operated by our hosting provider located in Indonesia. If data is transferred outside Indonesia, we make sure an adequate level of protection is in place as required by the PDP Law.
7. Data retention
- Conversation data and contacts are kept for as long as the Business User's workspace is active, or until the Business User deletes them.
- When a Business User disconnects a channel, we stop receiving new data from it immediately and revoke the stored access token.
- When a workspace is closed, or when we receive a valid deletion request, we delete the related data within 30 days, except where we must keep it longer by law. Backups are overwritten within a further 30 days.
- Server logs are kept for up to 90 days.
8. Security
We use industry-standard measures including HTTPS/TLS encryption in transit, encryption of access tokens at rest, hashed passwords, role-based access control, workspace isolation, and access logging. No system is 100% secure; if a data breach affects your personal data, we will notify you and the relevant authority as required by law (within 3 x 24 hours under the PDP Law).
9. Your rights
Subject to applicable law, you have the right to:
- access and get a copy of your personal data;
- correct inaccurate or incomplete data;
- delete your data or withdraw consent;
- restrict or object to certain processing;
- request your data in a portable format.
To use these rights, email [email protected]. We respond within 3 x 24 hours to acknowledge and complete requests within the time required by law. End Customers' requests about a specific business's conversations will be coordinated with that Business User.
10. How to delete your data
You can remove omniapp's access and request deletion at any time. See our Data Deletion Instructions for step-by-step guidance, including how to remove the app from your Facebook settings.
11. Children
The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date, and notify Business Users by email or in-app notice for material changes.
13. Contact us
Jl. H. Ili 2 No. 45, RT.002/RW.009, Jatirangga, Kec. Jatisampurna, Kota Bekasi, Jawa Barat 17434
Email: [email protected]
Website: https://madebyruh.id