Privacy Policy

Under Pasal 1 angka 1 of the PDPA, "personal data" means any data about a person that can identify them, either directly or in combination with other data. We collect the following categories:

We do not collect biometric data, genetic data, criminal records, political opinions, or other "specific personal data" as defined in Pasal 4 ayat (2) of the PDPA.

Under Pasal 20 ayat (2) of the PDPA, processing of personal data must be based on a clear and specific purpose communicated to the data subject. We process your data for the following purposes:

3.1 Where Your Data Is Stored

Your data is stored in a Supabase-managed PostgreSQL database hosted on AWS (ap-northeast-1 region). All connections use TLS encryption in transit and PgBouncer connection pooling.

3.2 Security Measures

In accordance with Pasal 35 of the PDPA, we implement appropriate technical and organisational measures to protect your data:

• Encryption at rest: OAuth access tokens and refresh tokens are encrypted with AES-256-GCM before storage.
• Password hashing: Credentials are hashed with bcrypt (cost factor 10) — we never store plaintext passwords.
• Session security: JWT-based sessions with HttpOnly, Secure, SameSite cookies.
• CSRF protection: OAuth callbacks verify the state parameter to prevent cross-site request forgery.
• HTTP security headers: Content-Security-Policy, X-Frame-Options, HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are enforced on all responses.
• Access control: All protected API routes require authenticated sessions. AI usage is quota-limited per plan.
• Error scoping: Internal errors are logged server-side only; generic messages are returned to clients.

3.3 Retention Periods

Under Pasal 25 ayat (2) of the PDPA, personal data must be deleted once it is no longer necessary for its stated purpose. Our retention policy is:

Under Pasal 25 of the PDPA, we may only share your personal data with third parties when necessary for a stated purpose and with adequate safeguards. We do not sell your personal data. The following third parties receive data as part of our service:

We may also disclose personal data when required by law or a valid court order, in compliance with Pasal 23 of the PDPA.

SocialSurfer uses cookies strictly for functional purposes. We currently do not use advertising cookies or third-party tracking pixels (e.g., Meta Pixel, Google Analytics).

Opt-Out

Since all our cookies are strictly essential, they cannot be disabled without breaking core functionality. You can clear cookies at any time via your browser settings. If we introduce analytics or marketing cookies in the future, we will update this policy and request your explicit consent before setting them, as required by Pasal 20 ayat (1) of the PDPA and GDPR Art. 6(1)(a).

Under Bab IV (Pasal 5–16) of the PDPA, you have the following rights regarding your personal data. We honour these rights without discrimination:

To exercise any of these rights, please see Section 7 — Data Requests below.

7.1 Submitting a Request

To exercise your rights under Section 6, email us at privacy@socialsurfer.site with the subject line DATA REQUEST — [Your Name]. Please include:

1. Your full name and the email address associated with your SocialSurfer account.
2. A description of the right you wish to exercise (e.g., access, deletion, portability).
3. Any supporting details that help us identify the relevant data.

We will verify your identity before processing and respond within 3 × 24 hours as required by Pasal 11 of the PDPA, and fulfil the request within 14 business days.

7.2 Filing a Complaint

If you believe your data rights have been violated, you may file a complaint with us at privacy@socialsurfer.site. If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority established under Pasal 58–60 of the PDPA [REVIEW NEEDED — Once the supervisory body is formally established, add its name and contact here].

Under Pasal 56 of the PDPA, transfer of personal data outside of Indonesia is permitted only when the receiving country has an equivalent level of data protection, or when other adequate safeguards are in place.

SocialSurfer's infrastructure involves data transfers to:

• AWS ap-northeast-1 (Tokyo) — Supabase database hosting
• United States — Stripe payment processing, Vercel application hosting, social media API endpoints (Meta, Google, TikTok)

For transfers to jurisdictions without equivalent PDPA-level protection, we rely on:

• Standard Contractual Clauses (SCCs) or equivalent data processing agreements with each provider.
• Encryption in transit (TLS) and at rest (AES-256-GCM) to ensure data integrity regardless of hosting location.

[REVIEW NEEDED — Once PDPA implementing regulations on cross-border transfer are finalised by the Indonesian government, update this section to reflect the approved mechanism and any adequacy decisions.]

SocialSurfer is not intended for use by individuals under the age of 17. We do not knowingly collect personal data from children. Under Pasal 25 ayat (3) of the PDPA, processing of a child's personal data requires verifiable parental or guardian consent.

If you are a parent or guardian and believe your child has provided personal data to SocialSurfer, please contact us at privacy@socialsurfer.site. We will promptly delete the data and close the account.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. In accordance with Pasal 21 of the PDPA:

• Material changes: We will notify you via the email address associated with your account at least 7 days before the updated policy takes effect.
• Minor changes: (e.g., typo fixes, formatting) will be updated in place with a new "Last Updated" date.
• Continued use: of SocialSurfer after the effective date of a material change constitutes acceptance of the updated policy. If you do not agree, you may delete your account.

We recommend reviewing this policy periodically. The "Last Updated" date at the top of this page reflects the most recent revision.

Under Pasal 1 angka 4 of the PDPA, the Data Controller (Pengendali Data Pribadi) for SocialSurfer is: