Privacy Policy

For the accounts of the sellers who use KOLScale (our customers) and their staff, we are the personal data controller (Pengendali Data Pribadi).

For the creator data a customer collects and works with in KOLScale, the customer decides which creators to collect and contact, so the customer is the controller and we process that data on their behalf as a processor (Prosesor Data Pribadi). We only use it to run the service for that customer.

• Your account: your name, email address and password (stored only as a secure hash), your WhatsApp number if you give one, your role, and when you accepted these policies. We use the WhatsApp number to contact you about your account and, for accounts created from 8 October 2026, 21:00 WIB, in scrambled form to measure our ads (see Cookies below).
• Your business and plan: your business's name, your plan, its dates and limits, and your shop accounts on TikTok Shop and Shopee (shop names and identifiers, and the shop owner's email and phone number where they were provided).
• Creator data you collect: what TikTok Shop and Shopee show about affiliate creators in their seller tools, captured while you browse or when you run a job: names, handles, profile pictures, follower and sales figures, categories, location, and contact details (email, phone or WhatsApp number) that creators share with sellers there. Also your notes, tags and stages for each creator.
• Your campaigns: the invitations and WhatsApp messages you set up, who they went to, and whether each one went through.
• The extension: the name of each browser you connect and a connection token (stored only as a hash). The extension only reads the TikTok Shop and Shopee responses on its fixed list of creator-data requests; it doesn't read your other browsing. When a campaign sends WhatsApp messages, the extension sends them from WhatsApp Web in your browser and reports whether each one went out. It doesn't read or collect your chats.
• Payments: when you buy a plan, the plan, term, amount, order number, status, how you paid (for example QRIS or FPX) and the payment provider's reference. You pay on Duitku's or CHIP's own page: we don't receive your card or bank details.
• Security records: IP addresses and attempt counts used to limit repeated login, sign-up and connection attempts (stored in hashed form), and technical logs needed to keep the service working.
• Partner program: if you join it, your partner code, the visits, sign-ups and payments credited to you and the commissions they earned, your payouts, and the bank account you give us for them (the account number is stored encrypted). If you came through a partner's link or used their code, which partner brought your business.
• The help chat in the app: your questions, our replies, and when you last opened the chat. An automated assistant answers first. To answer about your account, it reads your name and email, your business, plan and its dates, what the plan allows and what you've used, your connected browsers and their extension version, your business's latest jobs and their messages, and your latest payments' status; never the creators you collected or their contact details. A member of our team reads a conversation when it needs a person, and we email you their reply if you haven't seen it.
• Messages to our Facebook Page: what you write to us on Messenger, our replies, and the name Facebook shares with us. An automated assistant answers them, and a member of our team reads a conversation when it needs a person.
• Messages to our WhatsApp number: what you write to us on WhatsApp, our replies, your phone number and the name on your WhatsApp profile. An automated assistant answers them, and a member of our team reads a conversation when it needs a person.
• Emails to us: what you write to [email protected] and our replies, with your email address and name. An automated assistant drafts our replies, and a member of our team reads every one, and edits it if needed, before it's sent.

Apart from the bank account partners give us for their payouts, we don't intentionally process specific personal data (such as health, biometric or financial data), and the service isn't meant for children.

• To provide the service you signed up for (performance of our contract with you): your account, business, plan, creator data, campaigns and extension.
• To keep the service secure and working (our legitimate interests): limiting abuse, preventing fraud, fixing problems and keeping records of admin actions on your account.
• To meet legal obligations, where the law requires us to keep or disclose data.
• With your consent, where no other basis applies. You can withdraw consent at any time; it doesn't affect processing that already happened.

We don't sell personal data. Apart from measuring our own ads (see Cookies below), we don't use it for advertising.

As the controller of the creator data you keep in KOLScale, you are responsible for:

• having a lawful basis to collect creators' data and to contact them;
• contacting creators only about genuine collaboration, and stopping when a creator asks you to;
• answering creators' requests about their data, for example by removing them from your creator list;
• following the terms of TikTok Shop, Shopee and WhatsApp.

We help you do this and, when a creator contacts us, we pass the request on to you or act on it as the law requires.

A seller using KOLScale may hold data about you that TikTok Shop or Shopee showed them. You can ask that seller directly, or write to [email protected] — we'll forward your request to the seller or handle it as UU PDP requires.

• Your business only. Each business's data is kept separate; other customers can't see it. Data is used inside the platform — there is no bulk export for customers.
• Our team, only to run the service, give support or when the law requires. To sort out a problem, we may open the app the way you see it; each time is recorded.
• Service providers who host and run the platform for us, under agreements that require them to protect the data.
• Payment providers: Duitku in Indonesia and CHIP in Malaysia receive your email address, name and the order when you pay, to process the payment.
• Partners: if a partner's link or code brought your business, that partner sees that a business signed up or paid and what they earned from it, never your name or contact details.
• AI service: Google receives your questions in the app's help chat with the details of your account listed above, the messages of a Messenger and WhatsApp conversation with us and the emails you send to our address, with information about KOLScale, to write our assistant's replies and drafts. Meta carries the conversation as the provider of Messenger and WhatsApp.
• Advertising partners: Meta and TikTok receive what their tags on our website collect, and Meta also what our server reports to them, as described under Cookies below.
• Authorities, when the law requires it.

The platform and its database run in Indonesia. If personal data is transferred outside Indonesia, we make sure the destination offers protection at least equal to UU PDP, or put appropriate safeguards in place, as UU PDP requires.

• Account, business and creator data: while your account is active, and deleted within 30 days after it closes, unless the law requires us to keep it longer.
• Creators you remove from your list stop being shown and are deleted with the rest of your business's data.
• Records of admin actions on an account: as long as the account exists.
• Payment records, and partners' commissions and payouts: as long as tax and accounting law requires, also after the account closes.
• Limits on repeated attempts: until their time window ends, cleared within a day.
• Help chat conversations and Messenger and WhatsApp conversations with us: 6 months after the last message.
• Emails with us: 6 months after the last one in the assistant's inbox; the copies in our mailbox as long as we need them to help you and keep our records.

• Encrypted connections between your browser, the extension and our servers.
• Passwords, extension tokens and password-reset links stored only as secure hashes.
• Each business's data kept separate, and every request checked against the signed-in account.
• Limits on repeated login, sign-up and connection attempts.
• Changing your password signs out every other browser using your account.

If a failure of personal data protection happens, we notify affected people and the authority in writing within 3 × 24 hours, as UU PDP requires, with what happened, which data was involved and what we're doing about it.

Under UU PDP you can:

• get information about how your personal data is processed;
• have inaccurate or incomplete data corrected;
• get access to, and a copy of, your personal data;
• have your data deleted or destroyed, or processing ended;
• withdraw consent you gave;
• object to decisions based only on automated processing;
• have processing delayed or restricted;
• receive your data in a common, machine-readable format and have it sent to another controller;
• claim compensation for violations, as the law provides.

Write to [email protected] from the email address on your account. We may need to confirm it's you, and we answer within the time limits UU PDP sets. You can change your name, email address, WhatsApp number and password yourself in Settings.

We use the essential cookies needed to sign you in and keep you signed in, and your browser remembers your light or dark theme.

Our home page, log-in and sign-up pages also load advertising and analytics tags from Meta and TikTok. They set their own cookies and tell those companies about your visit and, when it happens, that you created an account, started paying for a plan or paid for one (which plan and how much), so we can measure our ads. They get your browser's details and IP address, never your password or the creator data you keep with us. Inside the app, we use them only to report a new account, a checkout you start or a purchase. You can block them with your browser's settings or an ad blocker.

When you create an account, start a checkout or pay, our server also reports it to Meta directly, so it counts even when a browser blocks their tags. It sends your email address, name and account ID, and the WhatsApp number of accounts created from 8 October 2026, 21:00 WIB, as scrambled codes (hashes) that they compare with what they already know, your IP address and browser details, their own cookie and ad-click codes, and the order (which plan and how much). When you arrive from one of their ads, we keep its click code in a cookie for up to 90 days for this. The details of a checkout are kept until the payment is reported, at most a week.

When you open a partner's link, we keep that partner's code in a cookie for 90 days, so they get credit if you sign up or buy a plan.

When we change this policy we update the date at the top, and for significant changes we tell you in the app before they apply. See also our Terms of Service.