Privacy Policy

Contents

1. 1. Introduction
2. 2. Definitions
3. 3. Data We Collect
4. 4. Legal Basis & Purposes of Processing
5. 5. Use of Data
6. 6. Storage & Retention
7. 7. Data Security
8. 8. Sharing Data with Third Parties
9. 9. Data Transfers
10. 10. Your Rights
11. 11. Children's Data
12. 12. Cookies & Tracking Technologies
13. 13. Links to Third-Party Sites
14. 14. Data from WhatsApp, Messenger & Instagram (Meta)
15. 15. Changes to This Policy
16. 16. Contact

This Privacy Policy explains how Resmi.ID collects, uses, stores, shares, and protects your personal data when you use the Resmi.ID platform, including the resmi.id website, public business profiles, the business management dashboard at my.resmi.id, the WhatsApp Business API service at whatsapp.resmi.id, and the Messenger/Instagram Inbox.

This document forms an integral part of the Resmi.ID Terms of Service. By using the Services, you agree to the data practices described below. The Indonesian version is the governing text; this English version is provided for convenience.

• 1Personal Data: any data about an identified or identifiable individual.
• 2Processing: any operation performed on personal data, e.g. collection, storage, use, or deletion.
• 3Data Controller: Resmi.ID, as the party that determines the purposes and means of processing.
• 4Third Party: service providers that support Resmi.ID's operations (e.g. cloud storage, payment gateways).

We may collect the following data:

• 1User identity such as name, email address, and phone number.
• 2Business and legal data such as business name, business registration number (NIB), business licences, and related documents.
• 3Account information and activity on the Resmi.ID platform.
• 4Content uploaded by users, such as business logos, cover photos, and profile descriptions.
• 5Technical data such as IP address, device type, browser, and system logs.
• 6Visitor interaction data on public business profiles (e.g. number of clicks on contact buttons), collected in aggregate without personally identifying visitors.
• 7Communication data from email, contact forms, or customer support.
• 8Transaction data and payment history for users of paid Subscription Plans.

We process your data on one of the following bases:

• 1Performance of a contract. To provide the Services you signed up for, including verification and management of business profiles.
• 2Your consent. For activities that explicitly require permission, e.g. optional marketing communications.
• 3Legitimate interest. For system security, fraud prevention, and service improvement.
• 4Legal obligation. To comply with official requests from competent authorities.

The data we collect is used to:

• 1Verify the identity of users and businesses.
• 2Provide and operate the Resmi.ID services, including displaying public business profiles.
• 3Improve security and prevent misuse of business identities.
• 4Develop features and improve service quality based on usage patterns.
• 5Process payments and billing for Subscription Plans.
• 6Send service-related communications, policy updates, and other important information.

Data is kept for as long as your Account is active and is needed for the purposes described in this Policy.

After an Account Is Closed

• 1Once you request account closure, the Account is deactivated immediately and your data enters a 30-day grace period.
• 2During the grace period your data is not yet deleted, so you can cancel the closure and restore the Account with all its data.
• 3After 30 days, your personal data is permanently deleted or anonymised and cannot be recovered.
• 4Some data may be kept beyond that period where required by law (for example transaction and tax records) or where needed to resolve disputes, enforce agreements, or prevent fraud. Such data is kept only as long as necessary for that purpose, with restricted access.
• 5Sign-in activity records (time, IP address, device type) are kept as a security audit trail and may remain after the Account is closed, in a form no longer linked to your identity once they are no longer needed.
• 6Business data whose ownership you transferred to another user before closure remains the responsibility of the new owner and is not deleted.

Resmi.ID applies reasonable technical and organisational measures to protect data against unauthorised access, leakage, or misuse, including encryption in transit (HTTPS/SSL), role-based access restrictions, and hashed credential storage. No system is completely immune to security risks, and you are also responsible for keeping your Account credentials confidential.

User data is never sold to third parties. Data may be shared on a limited basis with:

• 1Technical infrastructure providers that support the Services, e.g. cloud file storage and email delivery.
• 2Payment gateway providers to process Subscription Plan transactions.
• 3Parties required by law, regulation, or official requests from competent authorities.
• 4Other parties explicitly approved by the user, e.g. when a user chooses to show contact details on a public business profile.

Some of the technical infrastructure used by Resmi.ID may be located outside Indonesia. In that case, Resmi.ID ensures that these providers apply equivalent data protection standards in line with applicable data protection regulations.

Under applicable personal data protection regulations, you have the right to:

• 1Access and update your personal data through your Account dashboard.
• 2Request correction of inaccurate or incomplete data.
• 3Request deletion of your Account and related data, subject to the retention terms in section 6. You can close your account yourself from the account settings page. An account that is still recorded as the owner of a business must transfer ownership first.
• 4Withdraw consent for processing that is based on consent.
• 5Raise objections or questions about data protection through our official contact channel.

Resmi.ID is intended for users aged 18 and over or legally registered businesses. We do not knowingly collect personal data from minors. If you become aware that a child's data has been collected without valid consent, please contact us so we can act on it promptly.

Resmi.ID uses cookies and similar technologies to keep you signed in, remember preferences, analyse usage (e.g. through Google Analytics), and protect the system from suspicious activity. You can manage or disable cookies in your browser settings, but some features may not work properly without them.

Business profiles and Resmi.ID pages may contain links to third-party sites or platforms (e.g. WhatsApp, Instagram, Facebook, business websites). Resmi.ID is not responsible for the privacy policies or data practices of those third-party sites.

Resmi.ID provides the WhatsApp Business Platform (Cloud API) and an Inbox for Facebook Messenger and Instagram Direct. All of these channels run on the platform of Meta Platforms, Inc. and are enabled only after a business owner connects their own WhatsApp number, Facebook Page, or Instagram professional account. This section supplements the general terms in sections 3–10.

WhatsApp Business

• 1Business data: business name, business phone number, WhatsApp Business account ID, email address, and message templates created by the business.
• 2Data of the business's customers (end users): phone number, WhatsApp profile name, message content, and attachments (images, documents, audio, video) in conversations managed by that business.
• 3Technical metadata: message IDs, timestamps, delivery/read status, and server logs for security and troubleshooting.
• 4This data is used to send and receive messages on behalf of the business, show conversations in its dashboard, bill usage, and provide technical support. Messages are delivered through Meta as the WhatsApp platform provider.

Facebook Messenger & Instagram

• 1Accounts are connected through Facebook Login for Business, and only for the Pages/accounts the business owner selects.
• 2Data we receive: the ID, name, and profile picture of the connected Facebook Page and the ID, username, and profile picture of the connected Instagram account; the Page access token (stored encrypted); and customers' messages to the Page (Messenger) or Instagram account (Direct), including attachments and the sender's name and profile picture, together with the business's replies.
• 3This data is used solely to show conversations in that business's Inbox and to send the replies written by that business, within Meta's 24-hour messaging window.

Telegram

• 1Businesses can connect their own Telegram bot (created via @BotFather) to the Inbox. Telegram is not part of Meta; data is processed through Telegram's Bot API.
• 2Data we receive: the bot's ID, name, and username; the bot token (stored encrypted); and customers' messages in private chats with the bot, including attachments and the sender's name and username, together with the business's replies. Group messages are not processed.
• 3Disconnecting the bot in Dashboard → Settings → Message Channels removes the bot's webhook and deletes its token immediately. The no-sale, no-advertising, retention, and history-deletion terms below also apply to Telegram.

Email

• 1Businesses can connect their own email inbox (Gmail, Yahoo, iCloud, or domain email) using an App Password or the mailbox password. The password and server settings are stored encrypted.
• 2We only read the Inbox folder, without changing, moving, or marking emails as read, and only emails that arrive after the account is connected. Newsletters and automated emails are not imported. We store the sender's address and name, subject, body, and attachments, together with the business's replies, which are sent through the business's own mail server.
• 3Disconnecting email in Dashboard → Settings → Message Channels stops email retrieval immediately; the App Password can also be revoked at any time in the email provider's account settings. The no-sale, no-advertising, retention, and history-deletion terms below also apply to email.

Terms for all Meta channels

• 1Data from these channels is not sold, not used for advertising, and not shared with anyone other than Meta (as platform provider) and the infrastructure providers that store it for us (e.g. cloud storage for media). Only users who have been given access to that business can see it.
• 2The business owner is responsible for obtaining any permission required from their customers before messaging them, in line with the WhatsApp Business, Messenger, and Instagram policies.
• 3Conversation history is kept while the business account is active, as that business's records, unless deletion is requested earlier as described below.

Disconnecting & deleting your data

• 1Messenger/Instagram: open Dashboard → Settings → Message Channels, click the settings icon on Facebook Messenger or Instagram, then choose Disconnect. The Page access token is deleted immediately and Resmi.ID stops receiving new messages from that account.
• 2You can also revoke the app's access at any time from Facebook: Settings & Privacy → Settings → Business Integrations, or from Meta Business Suite for WhatsApp Business accounts.
• 3To release a WhatsApp number from Resmi.ID or permanently delete conversation history (WhatsApp, Messenger, or Instagram), email [email protected] with your Resmi.ID business address and the number/Page/account concerned. Requests are completed within 30 days.

This Privacy Policy may be updated from time to time as our services or applicable regulations change. Changes will be announced on the Resmi.ID platform and take effect from the stated date.

For questions, objections, or requests about your personal data, contact us at [email protected].