Skip to main content
Instanizer
Sign Up Free

Legal

Privacy Policy

Last updated

This policy explains what data Instanizer collects, what it is used for, who it is shared with, and how you can control it.

This English text is a translation provided for convenience. If there is any difference between this translation and the Indonesian version, the Indonesian version prevails.

1.Data we collect

  • Account data: username, email, and password. Passwords are stored as bcrypt hashes, so we cannot see your actual password.
  • Data from Google (if you sign in with Google): your name, verified email address, Google account identifier, and profile photo (a link to the image on Google). We do not receive your Google password.
  • Order data: the service selected, target link or username, quantity, and additional inputs depending on the service type (for example comments, keywords, or schedules), along with the price, status, and refill history.
  • Balance and payment data: balance transaction history, top-up amounts, payment channels, reference numbers, and transaction status from Tripay.
  • Retention data: the percentage of units still active on completed orders on day 7, day 14, and day 30, obtained from status reports of the order fulfillment system.
  • Search text: the keywords you type into the service search.

IP address and security logs: IP addresses are used in server memory to limit the number of requests (rate limiting) and to detect abuse. Our web server or reverse proxy may record IP addresses, times, and request paths in access logs, and the application records certain security events (for example admin role changes). These logs are used only for security and troubleshooting.

Visit source: on your first visit, your browser stores where the visit came from (only the host name of the referring site, the landing page without parameters, and utm parameters if present) in local storage for up to 90 days. When you sign up, that information is saved to your account. We use it only to measure which marketing channels bring in users; no additional personal data is collected.

We do not ask for your social media account passwords.

2.How we use data

  • Creating and securing your account, including signing in and out.
  • Processing orders through the order fulfillment system, monitoring their status, and processing refills.
  • Processing top-ups, recording balance transactions, and returning funds in accordance with the Terms & Conditions.
  • Showing relevant service search results.
  • Handling support questions and preventing abuse of the service.
  • Sending transactional emails, such as account verification and password resets.
  • Logging technical errors to improve the service, including error reports from the browser (only the page and error message, without cookies).

3.Basis for processing

In line with Indonesia’s Personal Data Protection Law (UU PDP), we process your personal data on the basis of:

  • Consent: which you give when you sign up or sign in with Google, including your consent to this Privacy Policy and the Terms & Conditions.
  • Performance of a contract: order and payment data are needed so that your orders can be processed.
  • Legitimate interests and legal obligations: securing the service, preventing fraud, and bookkeeping.

4.Third parties that receive data

We do not sell your data. Data is shared only as far as needed to run the service:

  • Order fulfillment partners: receive order data (service, target link or username, quantity, and additional inputs). Your Instanizer account identity, such as username and email, is not sent.
  • Tripay (payment gateway): receives the amount, payment channel, username as the customer name, account email, and phone number if available, in order to create a payment invoice.
  • Google (OAuth): if you choose to sign in with Google, Google gives us your basic profile (name, email, photo) after you approve it on the Google consent screen. Google’s use of data is governed by Google’s own privacy policy.
  • Email delivery service: receives your email address and the content of transactional emails so that messages can be delivered. The service we currently use is Brevo; processing may take place outside Indonesia.
  • OpenAI: receives service search text to convert it into a numerical representation (embedding) so that search understands your intent. The text is not accompanied by account identity. This processing may take place outside Indonesia.

We may also disclose data if required by law or by an official request from a competent authority.

6.Security

  • Passwords are stored as bcrypt hashes and are never sent back to the browser.
  • Login sessions are stored in an httpOnly cookie and sent over an encrypted connection (HTTPS).
  • Signing out ends all of your active sessions on every device.
  • Sign-in and registration attempts are rate limited to make password guessing harder.
  • Registration with email and password requires email verification before the account can place orders or add balance.
  • Reseller API keys are stored as hashes and are shown only once, when they are created.
  • Admin access is protected by two-step verification (2FA), and admin actions that change user data, balances, or settings are recorded in an audit log.

7.Data retention and deletion

Account data is kept as long as your account is active. You can request account deletion through our support team. An account that still has orders in progress can only be deleted after those orders are finished. Order, payment, and balance transaction records may be kept after the account is deleted for bookkeeping and dispute resolution for 5 (five) years. Security audit logs (admin actions and admin sign-in attempts) are kept for 12 (twelve) months and then deleted automatically. Server access logs are limited in size and overwritten on a rotating basis. Database backups are kept on a 14 (fourteen) day rotation, so data that has been deleted may still remain in backups for up to 14 days before it is erased too.

8.Your rights

Under Law No. 27 of 2022 on Personal Data Protection, you have the right to:

  • obtain information about, and a copy of, the personal data we hold about you;
  • correct inaccurate data;
  • request deletion of your personal data;
  • withdraw your consent to data processing, with the consequence that the service can no longer be used.

Submit your request through the channels in the Contact section. We will verify account ownership before processing it and respond within a reasonable time in accordance with applicable regulations. You also have the right to file a complaint with the competent personal data protection authority.

9.Child users

This service is intended for users who are adults under the law. We do not knowingly collect data from children without the consent of a parent or guardian. If you know that a child is using this service without consent, contact us so that the data can be deleted.

10.Changes to this policy

This policy may be updated to reflect changes to the service or regulations. The date of the last revision is shown at the top of the page. Important changes will also be communicated through this site or by email. See also the Terms & Conditions.

11.Contact

See also Terms & Conditions. Questions about this document can be sent through the Help Center.

Privacy Policy - Instanizer