urfavcrm.com Privacy Policy

Last updated: 18 October 2026 · First published: 31 May 2026

1. Who We Are

urfavcrm.com is operated by PT Sintaks Solusi Kreatif, a company established in the Republic of Indonesia and domiciled in Bandung, West Java ("we", "our", "us"). This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website, use our platform, mobile app, and website chat widget, or interact with us (collectively, the "Services").

We process personal data in accordance with Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and other applicable laws.

2. Our Role: Controller and Processor

  • Controller. We are the controller of personal data about our own users and visitors, such as account, billing, and usage data.
  • Processor. When a business (a "workspace") uses urfavcrm.com to communicate with its own customers, that business is the controller of its customers' data and we process it on the business's behalf and according to its instructions. If you are a customer of a business that uses urfavcrm.com, please contact that business to exercise your rights. We will assist them as required.

3. Information We Collect

  • Account information: name, email address, password hash, profile photo, language preference, status, and profile details received from Google when you sign in with Google.
  • Workspace and billing information: organization name and logo, team members and their roles, plan and subscription status, and payment status. Card payments are handled by our payment gateway, Midtrans. We store only a payment token reference, never your full card number.
  • Integration data: access and refresh tokens (stored encrypted), account and page IDs, and profile details of the social and messaging accounts you connect, such as Facebook, Instagram, Threads, WhatsApp, Telegram, and TikTok.
  • Communication data: messages, comments, media, and attachments exchanged through connected channels, along with contact details such as names, phone numbers, email addresses, social handles, and any notes, labels, deals, or tickets your team adds.
  • Website chat data: when a website uses our chat widget, the visitor's messages and attachments, any name, email, or phone number the website asks for, the page URL and title, and a visitor identifier stored in the visitor's browser.
  • Knowledge base content: documents, web pages, text, and FAQs that a workspace uploads to train its AI agents.
  • Usage and device data: IP address (also used to suggest a default language), browser and device information, active session records, push notification tokens for our mobile app, and performance metrics about how our pages load.
  • Email broadcast data: whether a broadcast email was opened (via a tracking pixel) and unsubscribe requests.

4. How We Use Information

  • To provide, maintain, secure, and improve the Services, including the unified inbox, publishing, broadcasts, CRM, analytics, and integrations.
  • To authenticate users, manage sessions, and enforce roles, permissions, and plan limits.
  • To publish content and send messages that you or your team schedule or authorize on connected platforms.
  • To run AI features that you enable (see Section 5).
  • To send transactional emails, in-app and push notifications, and service announcements.
  • To process payments, manage subscriptions, and keep financial records.
  • To detect, prevent, and respond to abuse, fraud, and security incidents, and to comply with legal obligations.

We do not sell personal data, and we do not use your workspace's conversations or knowledge base to train our own AI models.

5. AI Processing

When a workspace enables AI agents, reply suggestions, follow-ups, or contact summaries, the relevant message text, conversation context, and knowledge base excerpts are sent to third-party AI providers solely to generate a response. We use the Google Gemini API and OpenRouter (which routes requests to the AI model a workspace selects). Knowledge base content is converted into embeddings using the Google Gemini API so that relevant passages can be found. Workspaces may also supply their own OpenRouter API key, in which case that provider processes the data under the workspace's own agreement.

6. Sharing and Service Providers

We share personal data only as needed to operate the Services:

  • Connected platforms: Meta (Facebook, Instagram, Messenger, Threads, and the WhatsApp Business Platform), WhatsApp linked devices, Telegram, TikTok, and other platforms you choose to connect, to carry out the actions you authorize.
  • Google: Google Sign-In, the Gemini API for AI features, and Firebase Cloud Messaging for mobile push notifications.
  • OpenRouter: AI model routing for AI features.
  • Midtrans: payment processing.
  • Email delivery: our email service provider (Zoho Mail) for transactional email, and the SMTP server a workspace configures for its own email broadcasts.
  • Infrastructure: the cloud server and storage providers that host our application, databases, and media files.
  • Legal and safety: authorities or other parties when required by law, regulation, or legal process, or to protect the rights, property, or safety of our users, the public, or us.
  • Business transfers: a successor entity if we are involved in a merger, acquisition, or sale of assets, subject to this Privacy Policy.

7. International Transfers

Some of our service providers, including Google, Meta, and OpenRouter, may process data outside Indonesia. When personal data is transferred abroad, we take the steps required by applicable law to ensure it remains protected.

8. Data Retention

We keep personal data for as long as your account or workspace is active and as needed to provide the Services. When you delete a workspace, a channel's message history, contacts, or your account, we delete or anonymize the related data within a reasonable period, unless we must keep it longer for legal, tax, accounting, security, or dispute-resolution purposes. Billing records are kept for the period required by Indonesian tax and accounting laws.

9. Deleting Your Data

  • Channels: disconnect a channel from the Channels page, and choose whether to delete its message history.
  • Contacts and conversations: workspace members with the right permissions can delete contacts and their data from the Contacts page.
  • Workspace: the workspace owner can delete the entire workspace from Settings → Danger zone.
  • Account: email us at [email protected] with the subject "Data deletion request" from the email address on your account.
  • Facebook and Instagram: you can remove urfavcrm.com in your Facebook settings under Apps and Websites. We then receive a data deletion request from Meta and delete the data we hold for that connection. You can also email us to request deletion.

10. Your Rights

Subject to applicable law, you have the right to access, correct, update, and delete your personal data, to withdraw consent, to object to or restrict certain processing, to obtain a copy of your data, and to lodge a complaint with the competent authority. To exercise these rights, contact us using the details in Section 14. We may need to verify your identity before acting on a request, and we will respond within the time required by law.

11. Cookies and Local Storage

We use only cookies and browser storage that the Services need to work. We do not use advertising cookies or third-party tracking pixels on urfavcrm.com.

  • Session cookie (urfavcrm.session-token): keeps you signed in for up to 30 days.
  • Preference cookies (urfavcrm_locale, urfavcrm_active_org): remember your language and the last workspace you opened.
  • Website chat widget: stores a visitor session in the browser's local storage (or a cookie) on the website where the widget is installed, so returning visitors see their conversation.
  • Payments: the Midtrans checkout window may set its own cookies when you pay.

12. Data Security

We use industry-standard safeguards, including AES-256-GCM encryption for integration tokens and API secrets, Argon2 hashing for passwords, HTTPS for data in transit, server-side session records that can be revoked, and role-based access controls within each workspace. No method of transmission or storage is completely secure, but we work to protect your data and will notify affected users and authorities of a personal data breach as required by law.

13. Children

The Services are intended for businesses and are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children for our own purposes.

14. Changes and Contact

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, notify workspace owners by email or in the Platform. For questions or requests about your personal data, contact:

← Back to Sign InView Terms and Conditions