Privacy Policy

1. Introduction

Borobudur.ai ("we", "our", or "us") operates the Borobudur.ai marketing intelligence and conversational commerce platform, including CampaignHQ, SalesHQ, and ContentHQ. This Privacy Policy outlines how we collect, process, store, and protect your information when you use our websites, applications, and messaging APIs.

2. Data We Collect

We collect data under two primary categories:

• Account & Customer Data: Contact details (name, business email, phone number, company name), authentication credentials, and billing information.
• Messaging & Customer Communication: Data processed on behalf of our clients through integrations such as the official Meta WhatsApp Business Cloud API, TikTok Ads API, and Google Ads API. This includes recipient phone numbers, message payloads, delivery receipts, and customer interaction logs.
• Usage & Telemetry: Log data, IP addresses, browser types, feature interaction events, and performance diagnostics.

3. How We Use Data

Your information is processed for the following lawful purposes:

• Providing, maintaining, and improving platform features and API dispatches.
• Powering AI chat agent responses grounded strictly in your verified knowledge base.
• Attributing campaign conversions and ad performance metrics across channels.
• Preventing security abuse, spam, and ensuring compliance with Meta Business Policies.
• Providing 24/7 technical support, system alerts, and product updates.

4. Sub-processors & Third Parties

We partner with trusted infrastructure providers who adhere to rigorous data security standards (SOC 2, ISO 27001, GDPR, and Indonesian PDP Law):

• Google Cloud Platform (GCP): Cloud infrastructure, database hosting, and security.
• Meta Platforms, Inc.: Official WhatsApp Business Cloud API & Ads Management.
• Payment Gateways (e.g. Xendit): Secure payment processing and invoicing.

5. Data Security & Storage

All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. We enforce strict role-based access controls (RBAC), multi-tenant isolation on all database layers, and continuous audit logging.

6. Your Rights & Contact

Under applicable data protection laws (including the Indonesian Personal Data Protection Law UU No. 27/2022 and GDPR), you have the right to access, rectify, export, or request the deletion of your personal data.

For privacy inquiries, data subject requests, or security disclosures, please contact our Data Protection Officer at: