Privacy Policy
This policy explains what personal data Salesman processes, on what basis, how long we keep it, and what rights you have, including for data that comes from the WhatsApp, Instagram, Messenger, Gmail, Google Drive and Google Calendar accounts you connect.
It follows Law No. 27 of 2022 on Personal Data Protection and Law No. 1 of 2024 on Electronic Information and Transactions, and is part of the Terms of Service.
Who we are
Salesman is operated by PT Artha Artifisial Digital (Perseroan Perorangan), a company established in and based in Indonesia. For the account data described in this policy we act as the personal data controller under Article 21 of Law No. 27 of 2022 on Personal Data Protection (“PDP Law”).
| Legal entity | PT Artha Artifisial Digital (Perseroan Perorangan) |
|---|---|
| Location | Jakarta, Indonesia |
| Privacy contact | support@officialarchon.com |
Your data and your customers’ data
Salesman is a workspace for businesses. Two kinds of personal data pass through it, and our role differs for each:
- Your account data (you, the person who signs up). We decide why and how it is processed, so we are the controller.
- Your customers’ data: the contacts, messages and notes your business keeps in Salesman. You decide why it is collected and what it is used for. We process it on your behalf, only to provide the service you asked for. You are responsible for having a lawful basis to hold and message your customers.
Data we process
We process only what is needed to run the service. We do not ask for biometric data, health data, children’s data, or your bank or card numbers.
| Category | Examples | Source |
|---|---|---|
| Account identity | Username, email address, WhatsApp number | You, at signup |
| Authentication | Hashed password, session tokens, identity from a third-party sign-in provider | You and the authentication provider |
| Consent record | The version of these documents you accepted, the time, and your 18+ confirmation | You, at signup |
| Workspace content | Contacts, conversations and messages, follow-up tasks, notes, your business knowledge and instructions, saved AI chats and memories | You, your customers and your connected accounts |
| Connected accounts | The WhatsApp Business number, Facebook Page, Instagram professional account, or Google account you connect, and the access tokens that go with it | You, through Meta or Google sign-in |
| Messages from connected channels | Text of WhatsApp, Instagram and Messenger messages, and the sender’s name and identifier. Non-text content is recorded as a placeholder; we do not download media | Meta, when customers message you |
| Google data | Gmail messages and contacts, Google Drive file names, descriptions, types and links (not file contents), and Google Calendar event titles, times, attendees and descriptions | Google, only after you connect and approve access |
| Technical | IP address, device and browser type, error logs, access times | Automatically when you use the service |
Why we process it and on what basis
Every use of personal data relies on a lawful basis under Article 20 of the PDP Law.
| Purpose | Lawful basis |
|---|---|
| Create and run your account and provide Contacts, Inbox, Work, Connector and the AI assistant | Performance of a contract |
| Receive and send messages through the channels you connect | Performance of a contract, and your instructions |
| Send your content to an AI model provider to draft replies and answer your questions | Performance of a contract |
| Keep the service secure, prevent abuse and enforce usage limits | Our legitimate interests |
| Send product updates and marketing | Your consent, which you can withdraw at any time |
| Keep proof of consent and age confirmation | Legal obligation |
We do not sell personal data to anyone.
Consent and withdrawing it
Under Article 22 of the PDP Law, we ask for consent explicitly and separately from other form fields when you sign up. We record the version of the documents you accepted and the time, as proof of consent.
For processing that relies on consent, you can withdraw it at any time in account settings or by contacting us. Withdrawal applies going forward and does not undo processing that already happened. We stop the related processing within 3×24 hours of receiving your request.
Some data stays in use after you withdraw marketing consent, such as account and billing data, because it rests on another lawful basis in the table above.
WhatsApp, Instagram and Messenger (Meta)
When you connect a WhatsApp Business number, a Facebook Page or an Instagram professional account, you authorize Salesman through Meta. We use that access only to:
- receive messages your customers send to the connected account and show them in your Inbox;
- send replies from Salesman, within the messaging window Meta allows; and
- create or update the contact record for the person who messaged you.
We store the access tokens encrypted on our servers. We do not use Meta data for advertising, do not sell it, and do not use it to build profiles unrelated to your workspace. We follow the platform terms and policies of Meta for these products.
You can disconnect any account at any time in Connector. Disconnecting removes the stored access credentials and synced items. Contacts and messages already in your workspace stay until you delete them or ask us to (see Deleting your data). You can also remove Salesman’s access from your Facebook or Instagram settings under connected business integrations.
Google data (Gmail, Drive, Calendar)
If you connect Google, Salesman asks only for the access it needs:
- Gmail: read recent inbox and sent conversations to create contacts and show the thread in your Inbox, and send replies that you review and submit.
- Google Drive: read file names, descriptions, types, modification times and links to use as context. We do not download file contents.
- Google Calendar: read-only access to events, and attendees are added as contacts.
Salesman’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized AI or machine learning models, and we do not sell it or use it for advertising.
You can disconnect Google in Connector or revoke access at myaccount.google.com/permissions. Access tokens are stored encrypted.
Processing by artificial intelligence
Salesman uses language models to draft replies, summarize conversations and answer your questions. When it does, the relevant message, your business knowledge and instructions, and the context needed for that task are sent to a model provider through our AI gateway.
- We limit the context we send to what the feature you used needs.
- We do not use your conversations or your customers’ messages to train our own models.
- If you turn on automatic replies, the AI answers your customers on WhatsApp on your behalf. You can take over a conversation at any time, which pauses the AI for that conversation.
- AI output can be wrong. See AI output in the Terms.
- No decision with legal effect on you is made solely by automated means.
Third parties that process data
We use service providers as personal data processors. Each receives only the data its function needs and is bound by data protection terms.
| Provider | Function | Processing location |
|---|---|---|
| Supabase | Sign-in and database (our project runs in Sydney) | Outside Indonesia |
| Vercel | Application hosting, AI gateway and usage analytics | Outside Indonesia |
| AI model providers | Language models, reached through the Vercel AI gateway | Outside Indonesia |
| Resend | Transactional email | Outside Indonesia |
| Meta | WhatsApp, Instagram and Messenger, at your direction when you connect them | Outside Indonesia |
| Gmail, Drive and Calendar, at your direction when you connect them | Outside Indonesia |
Apart from these providers, we disclose personal data only when required by law or by a lawful request from a competent authority.
Transfers outside Indonesia
Several processors above are outside Indonesia, so your data is transferred out of Indonesian jurisdiction. Under Article 56 of the PDP Law, we do this on the basis of:
- a contract with each processor that requires data protection equivalent to the PDP Law; and
- your explicit consent given at signup, for anything those contracts do not cover.
You may ask us for the basis and purpose of a transfer through the contact below.
How long we keep data
We keep personal data while your account is active and for as long as it is needed for a lawful purpose.
| Data | Period |
|---|---|
| Account data and workspace content | While the account is active |
| Account data after a deletion request | Permanently deleted within 30 days |
| Connection access tokens | Removed when you disconnect the account |
| Transaction and tax records, where they apply | As long as tax and accounting law requires |
| Consent and age-confirmation records | While the account is active, and afterward as proof of compliance |
| Security logs | A short period, as needed for security and disputes |
When the period ends, data is deleted or destroyed under Articles 43 and 44 of the PDP Law.
Deleting your data
You can ask us to delete your account and your data at any time. This page is also the data deletion instructions page for the Salesman apps on Meta and Google.
- Email support@officialarchon.com from the email address on your account, with the subject “Delete my Salesman data”. If you signed in with Facebook, Instagram or Google and are unsure of the address, include the name on the account.
- We verify the request, then delete your account, workspace content and stored connection tokens permanently within 30 days, except records we must keep by law.
- You can speed things up by disconnecting each account in Connector first.
- To remove Salesman’s access on the platform side, remove it from your Facebook or Instagram connected business integrations, or from your Google account permissions.
Messages that your customers sent to you remain on WhatsApp, Instagram, Messenger and Gmail; deleting your Salesman data does not delete them there.
Security
Under Articles 35 and 39 of the PDP Law, we apply technical and organizational safeguards proportionate to the risk, including:
- encryption of data in transit;
- encryption of connection access tokens at rest, with a key kept only on the server;
- isolation of each user’s data at the database level;
- internal access limited to need;
- system secrets kept server-side only; and
- filtering of personal data out of logs and error reports.
No online system can guarantee absolute security. Keep your password private and contact us right away if you suspect unauthorized access to your account.
Your rights
Under Chapter V of the PDP Law, you have the right to:
- be informed about our identity, the legal basis and the purpose of processing;
- access and obtain a copy of your personal data;
- correct inaccurate data;
- end processing, and have your data deleted or destroyed;
- withdraw consent;
- postpone or restrict processing;
- receive your data in a machine-readable format and move it; and
- object to a decision made solely by automated means.
Contact us at the address below for any request. We respond within 3×24 hours of receiving and verifying it, in line with Articles 30, 32, 40 and 41 of the PDP Law. We may ask you to verify your identity first.
If something goes wrong
If a personal data protection failure occurs, we notify you and the competent authority within 3×24 hours of discovering it, as Article 46 of the PDP Law requires. The notice states:
- which personal data was exposed;
- when and how it happened; and
- what we are doing to handle and recover from it.
Age limit
Salesman is for people aged 18 and over. We ask for age confirmation at signup and do not knowingly process children’s personal data, in line with Article 16A of Law No. 1 of 2024 on Electronic Information and Transactions.
If you know a child has created an account, tell us at support@officialarchon.com and we will close the account and delete its data.
Contact and complaints
support@officialarchon.com
PT Artha Artifisial Digital (Perseroan Perorangan), Jakarta, Indonesia
If you are not satisfied with our response, you may complain to the authority responsible for personal data protection and pursue legal remedies under applicable law.
Changes to this policy
We may update this policy as the product or the law changes. Each version has a number and an effective date at the top of the page.
For material changes, we notify you by email or in the app and, where a change affects processing that relies on consent, ask for new consent before it applies to you.