Privacy Policy

1. Definitions

• "We" means Vyber.id Company, a company established under the laws of the Republic of Indonesia.
• "Application" is a software application that functions to support Vyber.id services.
• "Services" means Vyber.id services as set forth in www.vyber.id, including VybeFlow AI Omnichannel.
• "VybeFlow AI Omnichannel" means a Customer Relationship Management platform that provides multi-channel communication services (WhatsApp, Instagram, TikTok, Email, Telegram, Tokopedia, Shopee) with AI Assistant.
• "OntPilot AI ISP" means the subscription software platform for running the operations of an internet service provider (ISP) or community network, served at www.ontpilot.com.
• "Operator" means the internet service provider or community network operator that subscribes to OntPilot AI ISP.
• "Subscriber" means the Operator's internet customer, whose data is managed through OntPilot AI ISP.
• "WhatsApp Business Platform" means the official business messaging service from Meta Platforms, Inc. connected to Our Services.
• "Personal Information" means information about you that can be personally identified.
• "Website" means Our Website at www.vyber.id

2. Information We Collect

Information Collected Automatically

We collect certain Personal Information from you so that the Application can find Services that suit you.

• Your IP address
• Web pages you have visited
• Internet browser you use
• Duration of each visit/session
• Geo-location data (with your consent)

Information You Provide

When registering on the Application, you will provide Us with:

• Email address
• Full name
• Phone number
• Installation address
• ID card number (for verification)
• Your account password

VybeFlow AI Omnichannel Specific Information

When using VybeFlow AI Omnichannel, We also collect and store:

• Customer Contact Data: Name, WhatsApp number, email, address, and contact information of customers you store in the CRM database.
• Conversation History: All messages and conversations from various channels (WhatsApp, Instagram, TikTok, Email, Telegram, Tokopedia, Shopee) managed through the CRM platform.
• Campaign Data: Marketing campaign information you create, including message content, images, and recipient lists.
• AI Conversation Data: Conversation data processed by the AI Assistant to provide contextual and natural automated responses.
• Labels and Tickets: Categories, custom labels, and ticket statuses you create to manage conversations.

OntPilot AI ISP Specific Information

OntPilot AI ISP is used by Operators to manage their subscribers. Data entered by an Operator may include:

• Subscriber Data: full name, phone number, email address, installation address (hamlet, RT, RW, service area), national identity number (NIK/KTP) where the Operator requires it, and installation coordinates (latitude and longitude) used for distribution-point mapping and fault tracing.
• Billing Data: service plan, monthly charge, arrears, payment status, installation date, and payment date.
• Network and Device Data: serial numbers and MAC addresses of ONU/ONT units, modems, and routers; IP addresses, OLT port numbers, distribution-point identifiers; optical attenuation, link status, traffic usage, and PPPoE session history; and subscriber network credentials such as the PPPoE username.
• Operator Employee Data: name, job title, assigned region, work schedule, attendance times, and selfie photographs together with GPS coordinates captured at clock-in and clock-out.
• Service Conversation Data: the content of conversations between the Operator and its Subscribers over connected channels, including WhatsApp, together with support tickets and handling notes.
• Transaction Data: order number, amount, payment method, and transaction status. We never store card numbers, CVV, PIN, or banking credentials.

3. Use of Information

The information We collect is used to:

• Provide and improve our services
• Process registration and service installation
• Send service-related notifications
• Respond to questions and support requests
• Analyze usage for service improvement
• Detect and prevent fraudulent activity

VybeFlow AI Omnichannel Specific Use of Information

Information collected through VybeFlow AI Omnichannel is used for:

• Unified Inbox: Integrating messages from various channels (WhatsApp, Instagram, TikTok, Email, Telegram, Tokopedia, Shopee) into a single centralized inbox.
• AI Assistant: Processing conversations to provide contextual and natural automated responses. AI can be toggled on/off per conversation as needed.
• Contact Database: Storing and managing customer contact data including name, address, WhatsApp, email, and connected channels.
• Campaign Marketing: Sending broadcast campaigns to all contacts or specific segments with images, text, and automated scheduling.
• Analytics & Reports: Providing message statistics, total conversations, average response time, and channel uptime in real-time.
• Ticket & Labels: Managing conversations with statuses (Open, In Progress, Resolved) and custom labels.

OntPilot AI ISP Specific Use of Information

• ISP Operations: managing subscriber records, calculating and issuing invoices, recording payments, and producing collection reports.
• Network Monitoring: reading the condition of OLT, ONU, and router equipment to raise early warnings about service faults.
• Mapping and Tracing: using installation coordinates to map distribution points and speed up field fault handling.
• Customer Service: displaying subscriber conversations in the Operator's inbox, creating support tickets, and sending operational notifications.
• Technician and Staff Management: recording attendance, field assignments, and leave requests.
• Artificial Intelligence Assistance: producing conversation summaries and suggested replies. This feature is off by default and runs only if the Operator switches it on. AI output is an aid, not a final decision; the Operator remains responsible for the content of any reply sent.

4. WhatsApp Business Platform Data

Our Services connect to Meta's WhatsApp Business Platform so that Operators can serve their Subscribers over WhatsApp. This section explains specifically how that data is handled.

Data We Receive from WhatsApp

• Sender phone number and receiving business number;
• The sender's WhatsApp profile name;
• Message content: text, images, documents, audio, video, and shared location;
• Delivery metadata: send time, receive time, and sent, delivered, read, or failed status;
• Technical identifiers: message ID, conversation ID, and the Operator's business phone number ID.

We do not access a subscriber's contact list, their conversations with other parties, their WhatsApp status, or any conversation on a number not connected to the Services.

Subscriber Consent

Operators must obtain Subscriber consent before sending WhatsApp messages, and must retain evidence of it. Consent is collected through an internet subscription form stating the WhatsApp number and how it will be used, through a message the subscriber sends first to the Operator's business number, or through a written statement in the subscriber portal.

Types of Message Sent

• Utility and transactional messages: invoice due reminders, payment received confirmations, network outage notices, technician visit schedules, and support ticket updates;
• Customer service messages: replies to subscriber questions within the 24-hour window after the subscriber's last message;
• Authentication messages: one-time codes for signing in to the subscriber portal, where the Operator enables this;
• Marketing messages: only where the subscriber has given separate consent for them.

How to Opt Out

Subscribers can stop receiving messages at any time, free of charge, by replying STOP or BERHENTI to the Operator's business number, blocking that number in the WhatsApp app, telling the Operator through another channel, or emailing [email protected]. Numbers that opt out are flagged in the system and receive no further outbound messages.

Meta's Role and Encryption

WhatsApp messages travel through the infrastructure of WhatsApp Ireland Limited and Meta Platforms, Inc. Meta's processing is governed by the WhatsApp Privacy Policy, which is outside Our control.

Please note: conversations with a WhatsApp Business account served through a business solution provider are not end-to-end encrypted in the same way as personal chats. Once a message reaches the business account, its content can be read by the Operator and processed by Our systems in Our capacity as the Operator's software provider.

Compliance with Meta's Terms

In operating this integration We comply with the Meta Platform Terms, the WhatsApp Business Solution Terms, and the WhatsApp Business Messaging Policy. We do not use data obtained through the WhatsApp Business Platform for any purpose beyond providing the Services to the Operator, and we do not combine it with data from other sources to build advertising profiles.

5. Data Sharing and Sub-Processors

We share personal data only with parties genuinely needed to run the Services, only to the extent needed, and under confidentiality and security obligations.

We may additionally disclose data to law enforcement or competent authorities where required by law or a valid court order; to our legal advisers, auditors, or accountants as far as necessary; and to an acquirer in the event of a merger, acquisition, or transfer of business, with prior notice to you.

We do not sell personal data, rent it, or trade it with anyone. Nor do We use an Operator's Subscriber data to market Our products to those subscribers.

International Transfers

Service data is stored in data centres within the Republic of Indonesia. Certain processing involves providers operating outside Indonesia. Under Article 56 of Law No. 27 of 2022 on Personal Data Protection, We carry out such transfers by ensuring the destination country provides an equivalent level of protection, or under a binding data protection agreement with the provider, or on the basis of your consent.

6. Data Retention and Deletion

How to Request Data Deletion

If you are an internet subscriber: contact the ISP you subscribe to, as they are the Controller of your data. If the ISP does not respond within a reasonable time, email [email protected] stating your ISP's name, your registered phone number, and your request.

If you are an Operator or a staff member: email [email protected] from the address registered on the account, with the subject "Data Deletion Request", stating your account name, what you want deleted, and whether you need a copy of the data before deletion.

What happens next:

• We acknowledge the request within 3 x 24 hours;
• We verify the requester's identity;
• If asked, We provide a data export in a machine-readable format;
• We delete the data from production systems, and from backups at the next backup rotation, within 90 days at the latest;
• We send written confirmation that the deletion has been carried out.

Data We are required by law to retain, such as invoice records for tax purposes, cannot be deleted early. We will tell you specifically which data is excluded and why.

7. Your Rights as a Data Subject

Under Articles 5 to 15 of Law No. 27 of 2022 on Personal Data Protection, you have the right to:

• be informed about Our identity, the legal basis, the purpose, and the accountability for processing your data;
• access the personal data We process about you and obtain a copy of it;
• correct or update data that is inaccurate or out of date;
• end processing, delete, or destroy your personal data;
• withdraw consent you previously gave;
• object to decisions made solely by automated processing that have legal effects on you;
• suspend or restrict processing proportionately;
• obtain and port your personal data to another controller in a machine-readable format;
• claim compensation for violations in the processing of your personal data;
• lodge a complaint with the competent data protection authority.

We acknowledge data subject requests within 3 x 24 hours and resolve them within a reasonable period appropriate to their complexity. We may first ask for proof of identity.

Breach Notification

In the event of a personal data protection failure, We give written notice within 3 x 24 hours to the affected data subjects and to the competent authority, in accordance with Article 46 of Law No. 27 of 2022.

8. Security

We will maintain the confidentiality of any data provided by you. Security measures we implement include:

• Encryption of sensitive data
• Limited access to personal information
• Regular security monitoring
• Network security protocols

9. Changes to Privacy Policy

We may change this Privacy Policy to reflect changes in our activities. If We change this Privacy Policy, We will notify you through:

• Email to your registered address
• Notification on the Website
• Notification on the Application

10. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Indonesia. Any and all disputes arising from this privacy policy shall be governed by the exclusive jurisdiction of the authorized District Court in the Special Region of Yogyakarta.

11. Acknowledgment and Consent

By using our Application and Services, you acknowledge that:

• You have read and understood this Privacy Policy
• You agree to the use of your personal information as stated in this Privacy Policy
• You have the right to share all information you have provided to Us
• You grant Us the right to use such information in accordance with applicable provisions

12. How to Contact Us

If you have further questions about privacy and security of your information, please contact Us: