Privacy Policy for kakak.ai


Last Updated: October 2, 2026


1. SCOPE

This Privacy Policy applies to the personal information we process on our website (https://kakak.ai), our chatbot service, and our online and offline related offerings. For ease of reading, our website, chatbot service, and related offerings are collectively referred to as the "Service".


2. CHANGES TO OUR PRIVACY POLICY

We may modify this Privacy Policy from time to time at our sole discretion. If there are material changes to this Privacy Policy, we will notify you and ask for your acceptance before you can continue using the Service.


3. COLLECTION OF PERSONAL DATA

Our data collection revolves around your engagement with us, our Services, and the prevailing legal requirements of your jurisdiction. We amass information you provide, data automatically collected when you utilize our Services, and information from alternative sources, like third-party services and organizations, as detailed below.


A. User-Provided Data


Here are the types of personal data we might accumulate directly from you:

  • Account Creation. We may collect data like your name and email when you register an account with us.
  • Transactions. Information associated with your purchases, including payment details, might be collected by us. This may also involve additional data required to confirm your identity before transaction completion.
  • Interactions. We may gather your personal data when you request information, subscribe to our newsletter or marketing materials, seek support, apply for a job, or otherwise engage with us.
  • Surveys and Interactive Features. Participation in our surveys or use of our interactive features (e.g., collaboration tools, messaging and chat features, etc.) may result in collection of your personal data.
  • Business Opportunities. We may amass personal data to assess potential business ventures and strategic partnerships.
  • Job Applications. If you apply for a job posted on our Services, we gather and evaluate your personal data for your suitability.

    • B. Automatically Collected Data


    We may automatically gather the following personal data as you utilize our Services:

  • Usage Data. Data about your usage of our Services, such as IP address, user settings, device details, location, Internet service provider, and how you interact with our Services, may be collected automatically.
  • Technologies. Our Services may employ various Technologies (e.g., cookies, pixel tags, local storage, etc.) to automatically collect information about your engagement.

    • We typically use these Technologies for:

  • Operational Necessities. These are Technologies necessary for accessing and securely using our Services.
  • Performance Evaluation. Technologies used to measure the effectiveness of our Services and understand user behavior.
  • Functional Enhancement. Technologies deployed to improve your experience by remembering your preferences and past activities.
  • Advertising Purposes. First-party or third-party Technologies employed to deliver relevant content and advertisements.
  • Analytics. We, along with our analytics partners (like Google Analytics), may utilize Technologies and tools to analyze data on our Services.
  • Social Media Interactions. Our Services may include social media features. These may collect your IP address, the page you visit on our Services, and set a cookie to function properly.

    • C. Data Collected from Third-Party Sources


    We may gather your information from other sources, including third-party services. For example, we may obtain data about you from third-party applications through which you access our Services, depending on your privacy settings on those applications.


    D. Legal Basis for Processing (Required by UU PDP)


    We process your personal data based on the following legal grounds under Indonesian Data Protection Law (UU PDP No. 27/2022) and applicable international regulations:


  • Consent: For marketing communications, optional features, and international data transfers. You can withdraw consent at any time.
  • Contract Performance: To provide our AI services to you as agreed in our Terms of Service.
  • Legal Obligation: To comply with Indonesian tax laws, consumer protection laws, and other legal requirements.
  • Legitimate Interests: For service improvement, fraud prevention, and security measures, provided these do not override your fundamental rights.

    • For Indonesian users, we will obtain your explicit consent before processing sensitive personal data as defined under UU PDP Art. 4.


    E. Data Localization


    In compliance with UU PDP Art. 62, personal data of Indonesian users is primarily stored on servers located within the Asia-Pacific region (Singapore, with a content delivery network that includes an Indonesian point of presence). Certain data may be processed outside Indonesia by our service providers (including Google, OpenAI, Anthropic, and other AI providers) under Standard Contractual Clauses and with your explicit consent.


    You can withdraw consent for international transfers at any time by contacting dpo@kakak.ai, but this may limit service functionality.


    4. HOW WE USE YOUR PERSONAL INFORMATION


    We may use your personal information for a broad spectrum of business purposes, which include the delivery of our Services, administrative functions, and the marketing of our products and Services, as elucidated further:


    A. Delivery of Our Services


    We utilize your information to honor our contract with you and render our Services. Examples include:
  • Overseeing your information and accounts;
  • Enabling access to certain areas, functionalities, and features of our Services;
  • Responding to requests for customer or technical support;
  • Communicating with you about your account, activities on our Services, and policy modifications;
  • Processing your financial data and other payment methods for products or Services purchased;
  • Automatically analyzing your request to choose the most suitable features, tools, and skills (for example, whether a web search or a file is needed);
  • Choosing the most suitable web search source for your question and filtering search results so that only relevant ones are passed to the AI model;
  • Checking your request and web content for manipulation attempts or harmful instructions before they are passed to the AI model; and
  • Evaluating applications should you apply for a job we announce on our Services.

    • The automated processing described above helps operate the Services and does not produce decisions that have legal effects, or similarly significant effects, on you.


    B. Administrative Purposes


    Your information is used for various administrative purposes, such as:
  • Pursuing legitimate interests like direct marketing, research and development (including marketing research), network and information security, and fraud prevention;
  • Identifying security incidents, safeguarding against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those liable for such activities;
  • Gauging interest and engagement in our Services;
  • Short-term, transient use, such as contextual customization of ads;
  • Enhancing, upgrading, or improving our Services;
  • Developing new products and Services;
  • Ensuring internal quality control and safety;
  • Verifying and authenticating individual identities;
  • Debugging to identify and correct errors in our Services;
  • Auditing relating to interactions, transactions, and other compliance activities;
  • Enforcing our agreements and policies; and
  • Fulfilling our legal obligations.

    • C. Marketing and Advertising our Products and Services


    We may use personal information to customize and provide you with content and advertisements, as allowed by applicable law. Marketing strategies may include email campaigns, custom audiences advertising, and "interest-based" or "personalized advertising," including cross-device tracking. If you have queries about our marketing practices or wish to opt out of using your personal information for marketing purposes, you may contact us anytime as detailed below.


    D. Other Purposes


    We also use your information for other purposes as requested by you or as permitted by applicable law.
  • Consent: We may use personal information for other purposes that are clearly communicated to you when you provide personal information or with your consent.
  • De-identified and Aggregated Information: We may use personal information and other data about you to create de-identified and/or aggregated information, such as de-identified demographic information, de-identified location information, details about the device from which you access our Services, or other analyses we create.
  • Sharing Content with Friends or Colleagues: Our Services may offer various tools and functionalities. For instance, we may allow you to provide information about your friends or colleagues through our referral services. These referral services may enable you to share certain content with a friend or colleague, like an email inviting your friend to use our Services.

    • 5. HOW WE SHARE YOUR PERSONAL INFORMATION


    We share your data with the following categories of service providers. Apart from the large AI model providers that we name, we describe other providers by category for the security and confidentiality of our business. Questions about the recipients of your data can be sent to dpo@kakak.ai.


    A. AI Processing Providers


  • Google (Gemini and other Google AI services) - United States, EU
  • OpenAI (GPT models) - United States
  • Anthropic (Claude) - United States
  • Other AI model providers - United States, EU, Singapore, China (text, reasoning, and document analysis models, including through AI infrastructure intermediaries)
  • Speech and music synthesis providers - United States, EU
  • Image and video generation providers - United States
  • Web search and web page reading providers - receive search keywords and the addresses of pages to read (not your full conversation)
  • Request analysis and safety provider - United States (receives your latest message, a brief excerpt of the previous reply, and the titles and snippets of search results, to choose suitable features and detect manipulation attempts; it returns scores, not text, and your data is not used to train its model)
  • Authenticity-checking and AI-text-detection providers - receive the text of documents you ask to have checked

    • Data shared: Your prompts, uploaded documents, and chat conversations (web search providers receive only search keywords and page addresses)

    Safeguards: API calls configured for zero data retention where available; Standard Contractual Clauses (EU); explicit user consent (Indonesia)


    B. Infrastructure Providers


  • Hosting, database, file storage, content delivery, and processing-queue providers - Singapore, United States, and global network
  • Email and push notification providers - for transactional email and service notifications

    • Data shared: All user data and files (email address and device identifiers only for email and notifications)

    Safeguards: Encryption at rest and in transit; servers in or near Indonesia where possible


    C. Payment Processing


  • Licensed payment providers - Indonesia (credit cards, e-wallets, bank transfers)
  • Partner telecommunications operators - Indonesia (carrier billing)

    • Data shared: Payment information, phone numbers

    Safeguards: PCI-DSS compliant; data stays within Indonesia


    D. Analytics & Monitoring


  • Google Analytics - United States
  • Error tracking and performance monitoring provider - United States

    • Data shared: Usage patterns, error logs (may contain IP addresses)

    Safeguards: IP anonymization enabled; aggregated data only

    Opt-out: Contact dpo@kakak.ai to opt out of analytics


    E. International Data Transfers


    For Indonesian users, when we transfer data outside Indonesia (to AI providers, analytics services), we:


  • Obtain your explicit consent during account creation
  • Use Standard Contractual Clauses approved by competent authorities
  • Ensure providers have adequate data protection measures
  • Limit transfers to what is strictly necessary for service delivery

    • You can withdraw consent for international transfers at any time by contacting dpo@kakak.ai, but this may limit service functionality.


    F. Other Sharing Circumstances


  • Business Transfers: If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction.
  • Legal Requirements: We may disclose your personal information if required to do so by law or in response to a valid request from a governmental authority.
  • Protection of Rights: We may disclose your personal information to protect and defend our rights and property, including enforcing our agreements and policies.
  • With Your Consent: We may share your personal information with third parties if we have obtained your consent to do so.

    • 6. YOUR RIGHTS AND CHOICES


    You have certain rights and choices regarding your personal information. These rights may include:


  • Access: You can request access to the personal information we hold about you.
  • Correction: You can request that we correct or update your personal information if it is inaccurate or incomplete.
  • Deletion: You can request that we delete your personal information.
  • Restriction: You can request that we restrict the processing of your personal information under certain circumstances.
  • Objection: You can object to the processing of your personal information for direct marketing purposes.
  • Withdrawal of Consent: If we are processing your personal information based on your consent, you can withdraw your consent at any time.
  • Data Portability: You can request a copy of your personal information in a structured, commonly used, and machine-readable format.

    • To exercise your rights or make a request regarding your personal information, please contact us using the information provided in the "Contact Us" section below. We will respond to your request in accordance with applicable laws.


    7. DATA RETENTION


    We retain your personal data for specific periods based on data type:


    A. Account Data (name, email, profile)


  • Active accounts: Duration of account + 30 days after deletion request
  • Deleted accounts: Email hash retained for 12 months to prevent re-registration abuse; all other data deleted within 30 days

    • B. Chat Conversations & Messages


  • Retained while your account is active
  • Permanently deleted within 30 days of account deletion
  • You can delete individual chats at any time via account settings

    • C. Uploaded Documents & Files


  • Stored while your account is active or until you delete them
  • Vector embeddings (RAG data): Deleted when you delete the associated file
  • Deleted files: Permanently removed from storage within 7 days
  • Generated videos stored with our video hosting provider: Automatic deletion after 30 days (except prompt result samples)

    • D. Payment & Transaction Records


  • Retained for 7 years to comply with Indonesian tax law (UU KUP)
  • Only transaction IDs, amounts, dates - no full credit card numbers

    • E. Usage Logs & Analytics


  • Aggregated analytics: Retained indefinitely (de-identified)
  • IP address logs: 90 days
  • Error logs: 90 days

    • F. Marketing Data


  • Retained until you unsubscribe or request deletion
  • Unsubscribe lists: Retained indefinitely to honor opt-out requests

    • G. Legal Hold


  • If data is subject to legal investigation or dispute, retention may be extended until matter resolution

    • Your Right to Request Deletion: You can request immediate deletion of your data by contacting halo@kakak.ai. We will complete deletion within 30 days except where extended retention is required by law.


    8. SECURITY


    We take steps to ensure the security of personal information in accordance with the requirements of applicable laws. However, no system is 100% secure, and we cannot ensure or warrant the security of any information provided to us. We do not accept liability for unauthorized disclosure to the fullest extent permitted by applicable law.


    Additionally, we store the personal information collected for as long as it is necessary to fulfill the purpose(s) for which it was collected, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.


    9. SECURITY INCIDENT NOTIFICATION


    In the event of a data breach affecting your personal information, we will:


  • Notify affected users within 3 x 24 hours (72 hours) of becoming aware of the breach, as required by UU PDP Art. 54
  • Notification will include: Description of the breach and data types affected, likely consequences, measures we have taken or will take, and contact information for further inquiries (dpo@kakak.ai)
  • Notify Indonesian authorities (Kominfo) and EU authorities (where applicable) within required timeframes
  • For high-risk breaches (e.g., financial data, sensitive personal data), we will provide additional support such as credit monitoring services where appropriate

    • 10. CHILDREN'S PRIVACY


    Age Requirements and Parental Consent


    Minimum Age: You must be at least 16 years old to create an account.


    Under Age 16: We do not knowingly collect data from children under 16. If we discover we have collected such data, we will delete it within 48 hours.


    Parents' Rights: Parents/guardians of minors can request access to, modification of, or deletion of their child's data by contacting halo@kakak.ai with proof of guardianship.


    11. THIRD-PARTY LINKS AND SERVICES


    Our Service may contain links to third-party websites and services that are not owned or controlled by kakak.ai. This Privacy Policy does not apply to those third-party websites and services. We encourage you to review the privacy policies of those third parties before providing any personal information.


    12. DATA PROTECTION OFFICER


    For questions regarding data protection and your rights under UU PDP, please contact our Data Protection Officer:


  • Email: dpo@kakak.ai

    • 13. COMPLAINT RIGHTS


    Indonesian Users: You have the right to file complaints with:


  • Ministry of Communication and Informatics (Kominfo)
  • Website: https://www.kominfo.go.id

    • EU Users: You have the right to lodge a complaint with your local Data Protection Authority.


    14. CONTACT US


    If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at: halo@kakak.ai


    Service Provider Information

    Legal Entity: PT Kakak Cerdas Digital
    Email Contact: halo@kakak.ai
    Data Protection Officer: dpo@kakak.ai