Privacy Policy

For the accounts of the sellers who use JagoKOL (our customers) and their staff, we are the personal data controller (Pengendali Data Pribadi).

For the creator data a customer collects and works with in JagoKOL, the customer decides which creators to collect and contact, so the customer is the controller and we process that data on their behalf as a processor (Prosesor Data Pribadi). We only use it to run the service for that customer.

• Your account: your name, email address and password (stored only as a secure hash), your WhatsApp number if you give one, your role, and when you accepted these policies. We use the WhatsApp number to contact you about your account.
• Your business and plan: your business's name, your plan, its dates and limits, and your shop accounts on TikTok Shop and Shopee (shop names and identifiers, and the shop owner's email and phone number where they were provided).
• Creator data you collect: what TikTok Shop and Shopee show about affiliate creators in their seller tools, captured while you browse or when you run a job: names, handles, profile pictures, follower and sales figures, categories, location, and contact details (email, phone or WhatsApp number) that creators share with sellers there. Also your notes, tags and stages for each creator.
• Your campaigns: the invitations and WhatsApp messages you set up, who they went to, and whether each one went through.
• The extension: the name of each browser you connect and a connection token (stored only as a hash). The extension only reads the TikTok Shop and Shopee responses on its fixed list of creator-data requests; it doesn't read your other browsing. When a campaign sends WhatsApp messages, the extension sends them from WhatsApp Web in your browser and reports whether each one went out. It doesn't read or collect your chats.
• Payments: when you buy a plan, the plan, term, amount, order number, status, how you paid (for example QRIS or FPX) and the payment provider's reference. You pay on Duitku's or CHIP's own page: we don't receive your card or bank details.
• Security records: IP addresses and attempt counts used to limit repeated login, sign-up and connection attempts (stored in hashed form), and technical logs needed to keep the service working.
• Partner program: if you join it, your partner code, the visits, sign-ups and payments credited to you and the commissions they earned, your payouts, and the bank account you give us for them (the account number is stored encrypted). If you came through a partner's link or used their code, which partner brought your business.
• The help chat in the app: your questions, our replies, and when you last opened the chat. A member of our team reads a conversation when it needs a person, and we email you their reply if you haven't seen it.

Apart from the bank account partners give us for their payouts, we don't intentionally process specific personal data (such as health, biometric or financial data), and the service isn't meant for children.

• To provide the service you signed up for (performance of our contract with you): your account, business, plan, creator data, campaigns and extension.
• To keep the service secure and working (our legitimate interests): limiting abuse, preventing fraud, fixing problems and keeping records of admin actions on your account.
• To meet legal obligations, where the law requires us to keep or disclose data.
• With your consent, where no other basis applies. You can withdraw consent at any time; it doesn't affect processing that already happened.

We don't sell personal data, and we don't use it for advertising.

As the controller of the creator data you keep in JagoKOL, you are responsible for:

• having a lawful basis to collect creators' data and to contact them;
• contacting creators only about genuine collaboration, and stopping when a creator asks you to;
• answering creators' requests about their data, for example by removing them from your creator list;
• following the terms of TikTok Shop, Shopee and WhatsApp.

We help you do this and, when a creator contacts us, we pass the request on to you or act on it as the law requires.

A seller using JagoKOL may hold data about you that TikTok Shop or Shopee showed them. You can ask that seller directly, or write to [privacy contact email] — we'll forward your request to the seller or handle it as UU PDP requires.

• Your business only. Each business's data is kept separate; other customers can't see it. Data is used inside the platform — there is no bulk export for customers.
• Our team, only to run the service, give support or when the law requires. To sort out a problem, we may open the app the way you see it; each time is recorded.
• Service providers who host and run the platform for us, under agreements that require them to protect the data.
• Payment providers: Duitku in Indonesia and CHIP in Malaysia receive your email address, name and the order when you pay, to process the payment.
• Partners: if a partner's link or code brought your business, that partner sees that a business signed up or paid and what they earned from it, never your name or contact details.
• Authorities, when the law requires it.

The platform and its database run in [country]. If personal data is transferred outside Indonesia, we make sure the destination offers protection at least equal to UU PDP, or put appropriate safeguards in place, as UU PDP requires.

• Account, business and creator data: while your account is active, and deleted within 30 days after it closes, unless the law requires us to keep it longer.
• Creators you remove from your list stop being shown and are deleted with the rest of your business's data.
• Records of admin actions on an account: as long as the account exists.
• Payment records, and partners' commissions and payouts: as long as tax and accounting law requires, also after the account closes.
• Limits on repeated attempts: until their time window ends, cleared within a day.
• Help chat conversations with us: 6 months after the last message.

• Encrypted connections between your browser, the extension and our servers.
• Passwords, extension tokens and password-reset links stored only as secure hashes.
• Each business's data kept separate, and every request checked against the signed-in account.
• Limits on repeated login, sign-up and connection attempts.
• Changing your password signs out every other browser using your account.

If a failure of personal data protection happens, we notify affected people and the authority in writing within 3 × 24 hours, as UU PDP requires, with what happened, which data was involved and what we're doing about it.

Under UU PDP you can:

• get information about how your personal data is processed;
• have inaccurate or incomplete data corrected;
• get access to, and a copy of, your personal data;
• have your data deleted or destroyed, or processing ended;
• withdraw consent you gave;
• object to decisions based only on automated processing;
• have processing delayed or restricted;
• receive your data in a common, machine-readable format and have it sent to another controller;
• claim compensation for violations, as the law provides.

Write to [privacy contact email] from the email address on your account. We may need to confirm it's you, and we answer within the time limits UU PDP sets. You can change your name, email address, WhatsApp number and password yourself in Settings.

We use only the essential cookies needed to sign you in and keep you signed in, and your browser remembers your light or dark theme. We don't use advertising or tracking cookies.

When you open a partner's link, we keep that partner's code in a cookie for 90 days, so they get credit if you sign up or buy a plan.

When we change this policy we update the date at the top, and for significant changes we tell you in the app before they apply. See also our Terms of Service.