Privacy Policy
Last updated 21 October 2026
This policy explains what data we collect when you use Polynusa, what it is used for, who can access it, and what rights you have over it. It is a translation of the Indonesian policy at /privacy, which governs if the two differ.
01Two different roles
Polynusa holds two kinds of data in two different roles, and the difference matters because your rights differ in each.
Your account data is what you give us to use the service: name, email, phone number, company name and subscription history. For this data we are the controller.
Your customer data is what you put into your workspace: leads, conversations, invoices, employee records. For this data you are the controller and we process it on your instructions. We do not sell it, do not use it for our own purposes, and do not use it to train models.
02Data we collect
Identity and contact: name, email address, phone number, company name and address, and tax number (NPWP) if you provide it for invoicing.
Workspace operating data: the leads and contacts you enter, the content of WhatsApp conversations sent and received through the numbers you connect and through the other message channels you connect (clause 05), accounting documents and transactions, and HR data including attendance, leave, overtime and payroll if you use those modules. Payroll data includes your employees' bank account numbers and tax numbers.
Technical data: IP address, browser type and activity records inside the workspace, used for security and troubleshooting.
Visits to the public site polynusa.com are counted with Umami, which we run ourselves on our own server: no cookies, no stored IP addresses and no third party. Only the page opened, the referrer, city, device type and campaign codes in links are recorded.
We do not store credit card numbers. Payments are processed by payment providers that receive those details directly from you.
03What data is used for
Running the service you pay for, billing your subscription, giving support when you ask for it, sending notices about your account, and keeping the system secure.
We do not send marketing to the contacts inside your workspace. They are your customers, not ours.
04Third parties that process data
The service runs on several providers. Those processing your data today are: hosting and database providers that store and serve your workspace; payment providers that process subscriptions; WhatsApp messaging providers for messages sent and received through the numbers you connect; and language model providers if you turn on AI agents.
If AI agents are switched off in your workspace, no conversation content is sent to a language model provider.
A full list of providers and where they process data is available on request.
05Message channels you connect
You can connect business messaging accounts to a workspace: Instagram (a professional account, through Instagram Login), Facebook Messenger (a Facebook Page, through Facebook Login), and, when the channel is available to your workspace, TikTok, Tokopedia or TikTok Shop, and Shopee. A channel is connected only when a person with authority over that account approves it on that platform's own permission screen.
What we keep from connecting it: the account or Page ID, the account name and username, the permissions you granted, and the access token from the platform. Tokens are stored encrypted (AES-256-GCM), are never shown back to a browser, are never written to logs, and are used only by our servers to receive incoming messages and to send the replies you or your team send, or that Polybot sends if you allow it on that channel.
Messages that arrive through the channel (message content, time, and the sender's name and ID as the platform provides them) go into your workspace CRM as a conversation on one contact per customer. This is your customer data (clause 01): we process it on your instructions, do not sell it, and do not use it for advertising or to train models.
We follow each platform's rules on when a reply may be sent. For Instagram and Messenger, ordinary replies are sent only within 24 hours of the customer's last message; outside that window Polynusa refuses to send and says why.
You can disconnect a channel at any time from CRM, Omnichannel. When it is disconnected, the token is deleted from our storage and, where the platform provides a way, its permission is revoked; the conversation history already received stays in the workspace until you delete it. If you remove the Polynusa app from your Facebook or Instagram settings, Meta notifies us and we delete the tokens and the accounts you connected; how this works, and the status of a request, are on the Data Deletion page.
06Data from Google
If you sign in with Google, we receive your name, email address and profile photo to create and secure your account.
If you connect a Google connector, we access your Google data only for the feature you turn on: Gmail (reading messages and creating drafts you ask for), Google Calendar (reading and creating events on your calendar), and Google Drive (reading files you choose, or files Polynusa created). Google tokens are stored encrypted and you can disconnect them at any time from Settings, Connectors.
Polynusa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
That means: your Google data is used only to provide or improve the features you see and use, is not sold, is not used for advertising, is not used to train generalised AI models, and is not read by humans except with your consent, for security, or where the law requires it. When you ask Polybot to do something with that data, the part needed is sent to a language model provider only to answer that request.
07Security
Access to a workspace is limited by sign-in and roles. Each workspace is logically separated from every other. Changes to accounting and payroll records are written to an audit trail that users cannot change.
No system is completely immune. If a data breach occurs that risks harming you, we will tell you what happened and what we are doing about it.
08How long data is kept
Workspace data is kept while your account is active. After a subscription ends, data is kept for 90 days so you can reactivate or export it, and is then deleted at your request.
Financial records that Indonesian law requires to be kept, including invoices and tax documents, are kept for the period the regulations require even after the account is closed.
09Your rights
You have the right to request a copy of your data, to have incorrect data corrected, to request deletion, and to withdraw consent for processing that is based on consent. Write to the address below and we answer within 30 days.
For your customer data inside a workspace, requests from the people whose data you keep are forwarded to you, because you are the controller.
How to request deletion, including for a connected Facebook or Instagram account and for a person who messaged a business through Polynusa, is explained on the Data Deletion page.
10Changes to this policy
If this policy changes in a way that affects your rights, we tell you by email at the address on your account before the change takes effect. The date above always shows the version in force.