Privacy Policy

Effective 25 October 2026. English translation of the Indonesian policy, which prevails if the two differ.

About this policy

Klik Flow ("we", "us") operates Klik Flow at https://klikflow.id: a web app and a mobile app for handling customer chats, contacts, sales and marketing, together with the AI Connection (MCP server) and its integration API.

This policy explains what data we collect, why, who we share it with, how long we keep it, and your rights, under Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP).

Our role

For user account data, the data of businesses that use the service, and billing, we are the data controller.

For customer data a business manages in Klik Flow (contacts, chat content, orders, leads), that business is the data controller and we are the processor that handles it on the business's instructions. A business's customers who want to exercise their rights should contact that business first; we help the business respond.

Data we collect

Account data: name, email, phone number, role in the business, and the password, stored as a hash that cannot be read.
Business data: business name and profile, package, payment history and transfer receipts, and settings.
Data processed for a business: customer contacts, chat content and media from the channels the business connects (WhatsApp, Instagram, Facebook, TikTok, Telegram, email and website live chat), notes, pipeline, tickets, orders and Prospect Finder results.
Technical data: IP address, device and browser type, access and activity logs, and necessary cookies.
Data from connected services: for example Google sign-in, the business's social media accounts, and Meta or TikTok pixels and ad data, within the permissions granted.

How we use data

We do not sell personal data and do not use businesses' customer data to advertise Klik Flow itself.

Providing the service: receiving and sending messages, storing contacts, running automations, broadcasts, landing pages, the store and reports as the business sets them up.
AI features: AI Agent, summaries, captions and other AI features send the text they need to the AI model provider used by Klik Flow to produce a response. Usage is recorded as AI credits and can be turned off per business.
Security: preventing abuse, spam and unauthorised access, and logging important activity.
Billing and customer support.
Improving and developing the service using technical data and usage statistics.
Meeting legal obligations.

AI Connection (MCP) and third-party AI apps

A user can connect an AI app of their choice (for example Claude, ChatGPT or Cursor) or a server-side agent to one business through the AI Connection. The app can only read and do what was allowed when connecting, within the role of the person who connected it, and phone numbers follow that role's masking rules. Actions that customers can see become drafts that staff approve, by default.

Data the AI app reads is processed by that app's provider under its own terms and privacy policy, often outside Indonesia. Choose an AI account that does not train models on your data.

Meta's terms for WhatsApp do not allow its platform data to be used to train AI models. The owner can keep certain WhatsApp chat content out of what AI apps read, in Settings › AI Connection (Pengaturan › Koneksi AI in the app).

Every call from an AI app is logged without message content, kept for 90 days, and visible to the owner. A connection can be ended at any time in Settings › AI Connection.

We share data only as far as needed for the purposes above.

Infrastructure providers that run the service: servers, storage and networking.
Channel providers the business connects, such as Meta (WhatsApp, Instagram, Facebook), TikTok, Telegram and email providers, to send and receive messages.
AI model providers, for AI features.
Payment providers, to process bills.
AI apps a user connects through the AI Connection, within their permissions.
Authorities, where the law requires it.

Transfers outside Indonesia

Some of the providers above process data outside Indonesia. We choose providers with adequate data protection and make such transfers in line with UU PDP.

How long we keep data

After an account is closed, data is deleted or anonymised within a reasonable time, except data we must keep.

Account and business data are kept while the account is active.
A business's customer data is kept until the business deletes it or its account is closed.
AI Connection activity logs are kept for 90 days.
Data the law requires us to keep, such as payment records, is kept for the required period.

Security

Connections to the service are encrypted (HTTPS). Passwords and tokens are stored as hashes. Each business's data is separated at the database level. Staff access is limited by roles and permissions, phone numbers can be masked, and important activity is logged.

Found a security vulnerability? Report it through the contact in https://klikflow.id/.well-known/security.txt.

Your rights

Send requests by the Contact page at https://klikflow.id/p/kontak. We respond within the periods set by UU PDP.

To be informed about the processing of your data.
To access your data and get a copy of it.
To correct data that is wrong or incomplete.
To have data deleted or destroyed.
To withdraw consent you gave.
To object to decisions based solely on automated processing, including profiling.
To have processing suspended or restricted.
To get your data in a portable format.

Cookies

The Klik Flow site and app use the cookies needed for sign-in, security and settings to work.

Pages a business builds in Klik Flow (landing pages, Bio Link, Smart Link and the store) may use pixels or ad cookies that the business installs, and that business is responsible for them.

Children

Klik Flow is meant for businesses and is not directed at children. We do not knowingly collect children's data.

Changes to this policy

This policy may be updated. The effective date is shown at the top. For important changes we give notice on the site or by email before they take effect.

Contact us

Operator: Klik Flow.

Contact page: https://klikflow.id/p/kontak