01 Introduction
KopasAI ("we", "us", or "our") is a WhatsApp-first AI CRM platform developed and operated by AMCORE TECH INDONESIA. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our mobile app, web dashboard, or WhatsApp bot service.
By using KopasAI, you agree to the data practices described in this policy. If you do not agree, please discontinue use of our services and contact us to request data deletion.
Company: AMCORE TECH INDONESIA
Privacy Contact: legal@amcoreai.com
Scope: This policy applies to all users of the KopasAI platform across all supported ASEAN countries.
02 Data We Collect
We collect the minimum data necessary to provide our AI CRM services. The categories below describe what we collect, with examples and the purpose for each:
| Category | Examples | Purpose |
|---|---|---|
| Identity Data | Full name, email address, WhatsApp phone number, profile photo | Account creation, authentication, service communication |
| WhatsApp Data | WhatsApp Business Account ID, message content, sender phone numbers, message timestamps, delivery/read status | AI assistant processing, customer management, conversation history |
| Business Information | Store name, product catalog, inventory data, pricing, store location, operating hours | AI CRM functionality, business analytics, automation rules |
| Transaction Data | Sales records, order history, payment amounts, customer purchase history | Financial reporting, business analytics, tax compliance |
| Technical Data | IP address, device type, browser type, app version, session logs, error logs | Platform security, fraud detection, performance optimization |
We do not collect sensitive personal data such as government-issued ID numbers, financial account credentials, health or medical information, or biometric data.
03 WhatsApp Business API
KopasAI uses the Meta WhatsApp Business API (provided by Meta Platforms, Inc.) to enable businesses to send and receive WhatsApp messages. This section explains specifically how WhatsApp-related data is handled.
How We Use the API
- We access WhatsApp messages sent to and from your registered WhatsApp Business number through Meta's official API infrastructure
- Message content is processed by our AI system to provide automated replies, customer insights, and CRM features
- We store conversation logs to maintain customer history and enable AI context continuity across sessions
- WhatsApp phone numbers of your customers are stored as CRM contact identifiers
- We send template messages and interactive messages on your behalf only for legitimate business communication purposes
Meta Platform Compliance
Our use of the WhatsApp Business API strictly complies with:
- Meta Platform Terms and WhatsApp Business Policy
- WhatsApp Commerce Policy for merchant use cases
- WhatsApp's opt-in requirements: we only process messages from customers who have initiated contact with your business or have provided explicit opt-in consent
Data Processor Role: KopasAI acts as a data processor on behalf of your business (the data controller) for WhatsApp message data. Your business is responsible for ensuring your end-customers have provided appropriate consent to receive WhatsApp business communications under applicable law.
Meta's Independent Data Role
Meta Platforms, Inc., as the operator of WhatsApp, has independent access to WhatsApp message metadata as the platform provider. Meta's data practices are governed by their own Privacy Policy. We encourage you to review the WhatsApp Privacy Policy and Meta Privacy Policy.
04 Third-Party Data Sharing
We share your data only with the following trusted third parties and only for the specific purposes stated. We do not share data beyond what is necessary.
Cloud Infrastructure & AI
- Google Cloud Platform / Vertex AI — Primary data storage in the asia-southeast2 (Jakarta, Indonesia) region and AI model inference. Your proprietary business data is never used to train Google's public AI models.
- Meta Platforms, Inc. — As the WhatsApp Business API provider, Meta processes message delivery and associated metadata. This is inherent to the use of WhatsApp and governed by Meta's own terms and policies.
Payment Processing
When subscription payments are made, or when your customers transact via integrated payment features, minimum required data is shared with the relevant licensed payment processor:
- Indonesia: GoPay, OVO, Dana, QRIS, BCA Virtual Account
- Philippines: GCash, Maya, UnionBank
- Vietnam: VNPay, MoMo, ZaloPay
- Thailand: PromptPay, TrueMoney
- Malaysia: Touch'n Go, GrabPay, FPX
- Singapore: PayNow, GrabPay, Stripe
Each payment processor operates under applicable financial regulations and its own privacy policy. We share only transaction amounts, references, and identifying tokens — not full personal profiles.
Analytics
- Google Analytics — Aggregated, anonymized website usage statistics only. No personal business data or WhatsApp content is shared.
Legal Disclosure
We may disclose your data to government authorities or law enforcement when required by valid legal process, court order, or applicable law, or when necessary to protect the rights, property, or safety of KopasAI, our users, or the public.
We do NOT sell, rent, lease, or trade your personal data to any third parties, advertisers, data brokers, or marketing companies — under any circumstances. See Section 05 below for our full commitment.
05 We Do Not Sell Your Data
KopasAI does not sell, license, rent, or otherwise transfer your personal data or your customers' WhatsApp data to any third party for advertising, commercial profiling, or marketing purposes.
- No sale of data to advertising networks, ad exchanges, or data brokers
- No sharing of your business or customer data with competitors or unaffiliated commercial entities
- No use of your customers' WhatsApp messages for purposes other than providing KopasAI services to your business
- No behavioral profiling of your data for targeted advertising on any external platform
- No monetization of message content or customer contact information
Our business model is subscription-based, not data-driven. We earn revenue from your subscription fees — not from selling your data. Your data belongs to you and exists solely to power your business.
06 Legal Basis for Processing
We process your personal data on the following legal grounds under Indonesia's UU PDP (Undang-Undang Perlindungan Data Pribadi) and applicable international privacy standards:
- Contract Performance: Processing necessary to deliver the KopasAI subscription services you have signed up for.
- Consent: For optional features such as marketing emails or non-essential analytics cookies. You may withdraw consent at any time without affecting prior lawful processing.
- Legal Obligation: For financial record retention and compliance with Indonesian tax law and other applicable regulations.
- Legitimate Interests: For platform security, fraud detection, and service quality improvement, where our interests do not override your fundamental data rights.
07 Data Retention
We retain your data only as long as necessary for the stated purpose or as required by law. When the retention period expires, data is securely and permanently deleted.
| Data Type | Retention Period | Reason |
|---|---|---|
| Transaction & Financial Records | 7 years | Indonesian tax law compliance |
| WhatsApp Conversation Logs | 1 year (default) or until deleted by user | CRM history continuity & AI context |
| Account & Profile Data | Active account duration + 30 days post-deletion | Service provision & recovery window |
| Security & Access Logs | 90 days | Security auditing & fraud investigation |
Upon account deletion request, personal data is permanently erased within 30 days, except where mandatory legal retention applies.
08 Data Location & Security
Your data is stored primarily in Google Cloud Platform's asia-southeast2 (Jakarta, Indonesia) region, in support of Indonesian data sovereignty principles (UU PDP).
- Encryption at Rest: AES-256 encryption for all stored data
- Encryption in Transit: TLS 1.3 for all data transmission between your devices and our servers
- Access Controls: Role-based access control; only authorized personnel with a legitimate need may access user data
- International Transfers: Any cross-border data transfers (e.g., AI model inference) are protected by Standard Contractual Clauses (SCCs) to ensure equivalent data protection standards
09 Your Data Rights
Under Indonesia's UU PDP and internationally recognized privacy standards (GDPR), you have the following rights regarding your personal data:
- Right to Access: Request a copy of all personal data we hold about you.
- Right to Correction: Request correction of inaccurate, incomplete, or outdated data.
- Right to Erasure: Request permanent deletion of your data ("Right to be Forgotten"). We will complete this within 30 days.
- Right to Data Portability: Receive your data in a structured, machine-readable format (e.g., JSON or CSV) to transfer to another platform.
- Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
- Right to Withdraw Consent: Withdraw previously given consent at any time without affecting the lawfulness of prior processing.
- Right to Lodge a Complaint: File a complaint with Indonesia's relevant data protection authority (Kominfo / BSSN) if you believe your rights have been violated.
To exercise any of these rights, submit your request to: legal@amcoreai.com. We will acknowledge and respond within 3 business days.
10 Children's Privacy
KopasAI is a business management and CRM platform designed exclusively for adults who operate or manage commercial businesses.
- Our services are intended solely for users aged 18 years and older.
- We do not knowingly collect, store, or process personal data from children under the age of 13 (or under 18 where required by local law).
- We do not direct any features or marketing toward children.
- If we discover that personal data from a minor has been inadvertently collected, we will delete it immediately without any further use.
- If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at legal@amcoreai.com and we will take prompt corrective action.
11 Cookies & Tracking Technologies
Our website uses cookies and similar technologies to operate and improve our service:
- Essential Cookies: Required for the website and app to function correctly. These cannot be disabled.
- Analytics Cookies: Google Analytics collects aggregate, anonymized usage statistics about how visitors use our site. You may opt out via your browser settings or Google's opt-out tools.
- Preference Cookies: Remember your selected language and region.
You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not impact core platform functionality.
12 Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. When we make significant changes:
- We will update the "Last Updated" date at the top of this page
- Registered users will be notified via email or in-app notification
- For material changes, we will provide at least 14 days' advance notice where practicable
Your continued use of KopasAI after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.
Data Protection Officer (DPO) & Data Deletion Requests
For privacy inquiries, data access requests, correction requests, or data deletion requests, contact our Data Protection team. We respond within 3 business days.
Email: legal@amcoreai.com