Privacy Policy

DIGASS Social is a service for planning, writing, scheduling, publishing and measuring social media posts. It is operated by DIGASS, Jl. Jamin Ginting No. 60, Medan, Sumatera Utara, Indonesia (“we”, “us”).

For the personal data described here we are the data controller (pengendali data pribadi) under Indonesia's Personal Data Protection Law, Law No. 27 of 2022 (“UU PDP”). For content that a business customer puts into its workspace about other people, the customer decides what to put in and we process it on the customer's instructions.

Contact for anything in this policy: admin@digass.my.id.

Account data. Name, e-mail address, a hash of your password (never the password itself), time zone, role in your workspace and the workspace name.

Billing. Your plan, the orders you place (plan, amount, currency, order number, payment method type and date). Card numbers, e-wallet and bank details are entered on Midtrans or PayPal and never reach us.

Content you create. Drafts, captions, hashtags, scheduled times, brand characters and notes, and the photos and videos you upload to the media library.

Connected platform accounts. When an admin connects an account we receive and store, encrypted, the access token (and refresh token where the platform issues one) and the account's public identity: account or channel ID, name or username and profile picture. After you publish we store the post ID, link and status the platform returns, and the counts of views, likes, comments and shares that the platform reports for those posts. Details per platform are in sections 5 and 6.

AI requests. When you use AI assist, the text or image you give it is sent to Google Gemini to produce a suggestion. We do not store the request or the suggestion, unless you insert the suggestion into a draft.

Security and technical data. IP address, browser and device type, sign-in times, failed sign-ins, active sessions, and a security log of events such as lockouts, role changes and account connections. Server logs record request times and errors.

We do not collect your passwords for Facebook, Instagram, TikTok or Google; you sign in on the platform's own page.

• To provide the service: show previews, publish and schedule the posts you ask us to, store your media and show your results.
• To keep accounts secure: sign-in, session control, rate limits, lockouts and the security log.
• To send service e-mails: account lockouts, failed or reconnect-needed posts, invitations and changes to these documents.
• To generate AI suggestions when, and only when, you ask for one.
• To fix errors and keep the service running, using logs and technical data.
• To meet legal obligations and answer lawful requests from authorities.

Under UU PDP we process personal data on these bases:

• Performing our agreement with you (the Terms of Service) for account, content, publishing and media data.
• Your consent when you connect a platform account and approve the permissions on the platform's screen, and when you use AI assist. You can withdraw consent at any time by disconnecting the account or not using the feature.
• Legal obligations when the law requires us to keep or disclose data.
• Legitimate interests in keeping the service secure and working, balanced against your rights.

DIGASS Social uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy.

We ask for two permissions:

• Upload videos (youtube.upload): to upload the videos you choose to publish, with the title, description, tags, visibility and “made for kids” setting you enter.
• View your YouTube account (youtube.readonly): to read your channel's ID, name and picture so you can pick it as a connection, to check whether an upload has finished processing, and to read the view, like and comment counts of videos published through DIGASS Social.

We do not read your watch history, subscriptions, comments or private videos that were not uploaded through DIGASS Social, and we do not use Google or YouTube data for advertising, to train AI models, or for any purpose other than the features above.

DIGASS Social's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove DIGASS Social's access at any time in DIGASS Social (Platforms, Disconnect) or in your Google Account at myaccount.google.com/connections (also reachable through security.google.com/settings/security/permissions). Disconnecting deletes the stored tokens at once; see Data deletion for the rest.

Facebook and Instagram. Through Facebook Login we receive a list of the Facebook Pages you manage and the Instagram professional accounts linked to them, and the permissions you approve to publish to those Pages and accounts and to read the insights of posts. We use them only to publish what you schedule and to show results. Meta's own handling is described in the Meta Privacy Policy.

TikTok. Through TikTok Login Kit we receive your TikTok open ID, display name and avatar, and permission to post videos to your account and read their basic statistics. Before each post we show your posting options as TikTok requires (who can watch, comments, Duet, Stitch, and labels for AI-generated or branded content). See the TikTok Privacy Policy.

We do not sell platform data, share it with advertisers or use it to build profiles of the people who follow you.

We do not sell personal data. We share it only with:

• The platforms you publish to (Meta, TikTok, Google/YouTube), receiving the content and files of posts you send to them.
• Service providers who run parts of the service for us under contract and only on our instructions: application hosting (Vercel), the PostgreSQL database host, file storage (Cloudflare R2 or Amazon Web Services), rate limiting (Upstash), our e-mail provider, and Google (Gemini API) for AI assist. The current list is available on request at admin@digass.my.id.
• Payment processors: Midtrans (payments in rupiah) and PayPal (payments in US dollars) receive your name, e-mail address, the order number and the amount, so they can process the payment.
• Authorities, when Indonesian law or a valid legal order requires it.
• A successor, if the service is merged or sold, under the same protections; we will tell you before that happens.

Inside a workspace, members see the workspace's content according to their role (Admin, Editor, Viewer).

Some providers above store or process data outside Indonesia (for example in Singapore, the United States or the European Union). Where data leaves Indonesia we rely on providers whose contracts and security meet the protection required by UU PDP, and we keep the transfer to what the service needs.

• Account, workspace content and media: while your account exists. Deleting your account removes them, including the files in storage.
• Platform tokens: until you disconnect the account, the platform revokes access, or you delete your account.
• Published-post records and their statistics: while the post exists in your workspace.
• Security log and server logs: up to 12 months, unless we need them longer to investigate an incident.
• Payment records (order number, plan, amount, date): for the period Indonesian tax law requires for financial records, also after the account is deleted.
• Backups made by our database provider expire on their normal cycle, normally within 30 days; deleted data disappears from them then.

Platform tokens are encrypted with AES-256-GCM, passwords are stored as bcrypt hashes, all traffic uses HTTPS, each workspace is isolated, and files sit in a private bucket. The Security page lists the measures in detail.

No system is perfectly secure. If a breach affects your personal data we will notify you and the authority as UU PDP requires, at the latest within 3 x 24 hours of discovering it, with what happened and what we are doing.

Under UU PDP you can:

• get information about how your data is processed and a copy of it (Settings lets you download it as a JSON file);
• correct inaccurate data (most fields can be changed in Settings);
• have your data deleted (Data deletion);
• withdraw consent, for example by disconnecting a platform account;
• object to or ask us to restrict processing, and object to decisions made only by automated processing (we make none that affect you legally);
• complain to the personal data protection authority in Indonesia.

Send requests to admin@digass.my.id from the e-mail address of your account. We may ask you to confirm your identity and will answer within the time limits set by UU PDP.

DIGASS Social is meant for businesses and adults. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect data from children; if you believe a child has given us data, write to us and we will delete it.

We use only the cookies the service needs: a signed session cookie that keeps you signed in, and short-lived cookies that protect sign-in and the account-connection steps. We do not use advertising or cross-site tracking cookies.

When we change this policy we update the effective date above. For significant changes we tell account holders by e-mail or in the app before the change takes effect.

DIGASS, Jl. Jamin Ginting No. 60, Medan, Sumatera Utara, Indonesia. E-mail: admin@digass.my.id.