Privacy Policy

1. Scope and our role

This Privacy Policy explains how TELEKOS.ID collects, uses, stores, shares, and protects personal data when you use our website, account dashboard, virtual-number service, developer API, payment features, and webhooks.

This Policy is designed to explain our practices under applicable Indonesian law, including Law No. 27 of 2022 on Personal Data Protection. TELEKOS.ID acts as the controller for data used to operate your account and service. Third-party providers may separately control data they process under their own policies.

2. Data we collect

• Account data, such as username, email address, authentication-provider identifiers, and password credentials stored in hashed form.
• Order data, including transaction IDs, application and country selections, temporary phone numbers, prices, stock selections, status, timestamps, and received OTP messages.
• Payment data, including deposit IDs, amount, fee, payment method, provider reference, expiry time, and payment status. We do not ask you to provide online-banking passwords or card PINs.
• Developer data, such as API-key hashes, key previews, webhook URLs, signing-secret configuration, request identifiers, delivery results, and usage timestamps.
• Technical and security data, such as IP address, browser or device information, session identifiers, request logs, error records, and anti-abuse signals.
• Information you submit when contacting support or reporting a problem.

3. How we use data

• Create and secure accounts, authenticate sessions, and provide Google or password sign-in.
• Display stock and prices, purchase numbers, receive OTP messages, process cancellations, and maintain transaction history.
• Create deposits, reconcile payment status, update balances, and investigate payment discrepancies.
• Operate the API and webhook queue, prevent duplicate purchases, enforce rate limits, and deliver order events.
• Detect fraud, abuse, security incidents, service errors, and violations of our Terms.
• Comply with legal obligations, resolve disputes, enforce agreements, and improve service reliability.

4. Legal bases

Depending on the activity, we process data because it is necessary to perform our agreement with you, comply with law, protect legitimate security and operational interests, establish or defend legal claims, protect vital interests, or because you have given consent. Where processing depends on consent, you may withdraw it, but prior lawful processing remains valid.

5. When data is shared

We do not sell personal data. We disclose only what is reasonably necessary to:

• virtual-number and telecommunications suppliers that fulfill an order and return SMS messages;
• payment processors that create QRIS invoices and confirm payment status;
• authentication, database, hosting, security, and infrastructure providers that operate the service on our behalf;
• Google when you choose Google sign-in, according to Google’s own privacy terms;
• professional advisers, authorities, or other parties when required by law or reasonably necessary to protect rights, users, and the service;
• a successor in a merger, financing, reorganization, or transfer, subject to appropriate confidentiality and legal requirements.

6. International processing

Some suppliers and cloud providers may process data outside Indonesia. Any cross-border processing remains subject to applicable legal requirements and to the terms and safeguards offered by the relevant provider.

7. Retention

We retain personal data only for as long as reasonably needed to provide the service, maintain transaction and balance records, prevent abuse, meet legal or accounting duties, and resolve disputes. Retention periods differ by record type. For example, revoked API keys are removed from active credentials, while transaction records may be kept longer for audit and account-history purposes. Data is deleted, anonymized, or isolated when it is no longer required.

8. Security

We use access controls, hashed credentials and API keys, encrypted transport, rate limits, request validation, audit records, and operational monitoring designed to protect data. No internet service can guarantee absolute security. Keep your account and API credentials confidential and promptly report suspected compromise through the official support channel.

9. Your choices and rights

Subject to applicable law and identity verification, you may request to:

• access information about your personal data and receive a copy;
• correct or complete inaccurate data;
• delete data or end processing where the legal requirements are met;
• withdraw consent, object, restrict processing, or request data portability where applicable;
• obtain information about automated processing and complain to the competent authority.

10. Cookies and local storage

TELEKOS.ID uses session cookies and browser storage needed for sign-in, security, theme preference, cached dashboard state, and pending workflow recovery. Disabling essential storage may prevent account and dashboard features from working correctly.

11. Children

TELEKOS.ID is not directed to children or to people who cannot legally create an account without authorization. If you believe a child has supplied personal data without valid authorization, notify us through an official support method published within TELEKOS.ID so the matter can be reviewed.

12. Updates and privacy requests

We may update this Policy when our service, providers, or legal obligations change. The updated date will appear at the top of this page, and material changes may also be announced through TELEKOS.ID.

To exercise a privacy right or ask a privacy question, use the official support channel displayed in the authenticated TELEKOS.ID dashboard. We may request information necessary to verify your identity and protect the account before completing a request.