Privacy Policy

Last updated: 27 October 2026

This Privacy Policy (the "Policy") is issued by PT Kazeer Solusi Digital ("Kazeer", "We" or "Us") to explain how We obtain, collect, process, store, display, share, and delete personal data when you use the Kazeer Services. Personal data ("Personal Data") is data about a person who can be identified, directly or combined with other information.

This Policy follows Indonesia's Law No. 27 of 2022 on Personal Data Protection (the "UU PDP") and forms an integral part of the Kazeer Terms and Conditions of Service (the "Terms and Conditions"). Capitalised terms not explained here have the meaning given in the Terms and Conditions.

1. General Provisions

1.1. Kazeer is a POS app with an AI assistant, made by PT Kazeer Solusi Digital in Yogyakarta, Indonesia. PT Kazeer Solusi Digital's business identification number (NIB) is 2911250128515, and its registered address is Jl. Asem Kranji Blok K-7, Universitas Gadjah Mada Sekip, Bulaksumur, Sendowo, Sinduadi, Kec. Mlati, Kabupaten Sleman, Daerah Istimewa Yogyakarta 55284, Indonesia.

1.2. In this Policy, the "Kazeer Services" means:

the Kazeer website at kazeer.ai;
the Kazeer web app at app.kazeer.ai;
the Android app Kazeer POS on Google Play (opens in a new tab), published by PT Kazeer Solusi Digital;
Kazeer AI, on the web and on WhatsApp;
Zee, Kazeer's AI sales assistant, on WhatsApp, Instagram, and the web chat;
the demos, customer support on WhatsApp, and staff training We provide.

This Policy applies to all of the Kazeer Services above.

1.3. "You" means anyone who uses the Kazeer Services or whose data is processed through them: business owners (the "Owner"), staff the Owner gives access to, customers of businesses that use Kazeer, website visitors, and people who contact Us, for example in a chat with Zee.

1.4. By creating an Account and accepting the Terms and Conditions, you confirm that you have read and understood this Policy. Using the Kazeer Services alone is not treated as consent to processing that relies on consent. For such processing We ask for your consent separately, explicitly, and in Bahasa Indonesia, and you can withdraw it at any time. Not final yet: [wording of this clause: waiting for lawyer review C14]

1.5. If the Terms and Conditions or any other product terms cease to apply for any reason, this Policy still applies.

2. Obtaining and Collecting Personal Data

2.1. We obtain Personal Data when you, among other things:

sign up and set up your Account, business, and Outlets;
use the POS, stock, reports, attendance, Kazeer AI, or other features in the app;
add staff and give them access;
order through table order or make a reservation at a business that uses Kazeer;
ask for a demo, ask a question, ask for help, or send Us feedback, including in a chat with Zee;
allow camera or location access on a phone for attendance;
visit the kazeer.ai website.

2.2. The Personal Data We process includes:

a. Account and Plan

What you enter when you sign up: business name, address, owner's name, phone number, email address, password, and the 6-digit OTP code We send to your email, plus the payment method, a Plan or promo code if any, and, for some e-wallet methods, the phone number you enter on the payment page. An Account is created on the sign-up page of the kazeer.ai website, not in the Android app.
The business and Outlet details you set up in your Account. We do not ask for an NIB (business identification number) or a company deed (akta). For tax purposes, NPWP (tax ID) and NIK (national ID number) are asked for only in the Finance & Tax module (Keuangan & Pajak), as optional fields, for the business's tax profile and for staff data in PPh 21 (income tax) calculations. Without an NPWP, the official export for Coretax cannot be made.
For a payout bank account: account name and number, NIK, place and date of birth, a photo of the KTP (ID card), and a selfie. We use the KTP photo and the selfie only to verify the payout bank account. Not final yet: [The KTP photo and selfie are stored encrypted in private storage that cannot be opened through a public link, can be seen only by the person responsible for the servers and one appointed verification officer, every access is recorded in the audit log, and they are deleted once verification is complete, unless regulations require them to be kept: waiting for programmer confirmation, A100] Not final yet: [Whether this KTP photo and selfie are specific Personal Data: waiting for lawyer review C12]
The Plan you choose: the Free plan (Paket Gratis), Standard Monthly (Standar Bulanan), or Standard Annual (Standar Tahunan).
Billing records for Plans and Deposits: date, amount, Plan, Outlet, proof of payment, and invoice.
On the Free plan: the Deposit balance of each Outlet, and the Rp500 Platform Fee per paid transaction deducted from it.

b. Business Records from the POS

Orders: items ordered, amount due, Dine-in by table or Takeaway, order status, and cancellations. Cancelled orders stay visible in the records.
Payments: payment method (cash, QRIS, or card) and amount, recorded on the same order. These records show totals per payment method and per cashier shift.
Menu, prices, promo and bundle prices, recipes, ingredient stock, cost of goods (HPP), tax settings (VAT and regional tax), and reports per Outlet.

Most of these records are business data, not Personal Data. A record becomes Personal Data when it is linked to a specific person, for example sales totals per cashier shift.

c. Staff data

What the Owner or a manager enters for each staff member given access: full name, email address, password, role, and WhatsApp number. Each staff member has their own login.
The staff member's role in the app, such as store admin, cashier, kitchen, waiter, or accountant, and the Outlet where they work. Access is set per task and per Outlet.
Staff NPWP and NIK, if your business enters them in the Finance & Tax module for PPh 21 calculations.
Attendance records: selfies, face enrolment photos, face template, location, and clock time, as described in Clause 4.

d. Data about your business's customers

Kazeer is used to record your business's customer orders and payments. The customer data that can be recorded in Kazeer:

The customer's name and phone number on an order. If a phone number is entered, a customer record is saved automatically: name and phone number, plus email address and address if entered.
Member and points data, for customers your staff sign up as members with that customer's consent.
Table orders: customers scan the QR code on the table and order themselves on your business's online store page. They enter their name, WhatsApp number, table number (filled in from the QR code), payment choice (pay at the cashier, QRIS, virtual account, or e-wallet, as your business has set up), and a voucher if they have one.
Reservations: name, WhatsApp number, number of guests, and notes.

Kazeer has no delivery address field. Digital receipts are not sent by Kazeer's server: staff can tap "Kirim Struk via WhatsApp" (send receipt via WhatsApp), which opens WhatsApp on that staff member's own device.

If your business records its customers' Personal Data in Kazeer, We process that data on your business's behalf, as described in Clause 3.

e. Technical data from the app

Login details: email address or phone number, and password. Passwords are stored as a hash (bcrypt), not as the password itself. We send a 6-digit OTP code to your email only when you sign up, forget your password, or change your password. An attendance kiosk tablet is paired once with a 6-digit code.
The web app and API audit log: time, User, role, action, page address, IP address, user agent (browser or device type), and status.
Login session data: IP address and user agent.
The server application logs of app.kazeer.ai and api.kazeer.ai, and the Kazeer AI server log described in Clause 5.2.
A random ID the Android app creates once per installation. It is sent when the app syncs offline sales, syncs tax and accounting data, and records attendance. The app does not read built-in device IDs such as the Android ID or IMEI.
On app.kazeer.ai, your login token is kept in browser storage (localStorage), not in a cookie. There are only two cookies: kz_handoff, which lasts about 60 seconds, to log you in when you move between the app and the admin panel; and sidebar_state, which keeps a display preference for 7 days. The web app also loads fonts from Google Fonts.
Permissions the Android app asks for: internet, network status, and Wi-Fi; camera, for face attendance and product photos; precise and approximate location, for attendance, which Android also requires to search for Bluetooth printers; Bluetooth, for receipt printers; and, on older Android versions, storage read and write access to pick photos and files. Microphone and foreground location service permissions come with app components but are not used, and the app records no sound. The app does not ask for notification or background location permission.

The Android app and app.kazeer.ai use no analytics, crash reports, or push notifications.

f. When you contact Us

If you ask for a demo, ask a question, ask for help, or send feedback through WhatsApp, email, Instagram, or LinkedIn, We receive your message and the data that comes with it through that service, such as your WhatsApp number and profile name, email address, or social media account name.

Chats to Kazeer's WhatsApp and Instagram, and the web chat on the kazeer.ai website, are answered first by Zee, Kazeer's AI sales assistant. Zee is an AI program, not a person. Zee runs on Chatmo, a third-party chat service, answers questions about Kazeer, and passes the conversation to the Kazeer team when needed, for example for a demo request. In a conversation with Zee, We process:

the conversation, including replies from Zee and from the Kazeer team;
the data that comes with it through WhatsApp or Instagram, such as your WhatsApp number and profile name, or your Instagram account name;
what you tell Us for a demo request: the name you go by, business name, business type, number of outlets, city, the problems you want the demo to cover, and a proposed day and time for the demo;
in the web chat: your name and email address, if the web chat asks you to fill them in, and your WhatsApp number, if you give it. Zee may ask once for your WhatsApp number so the Kazeer team can reply after you close the page. If you do not want to give it, Zee does not ask again;
your answer if Zee asks whether you are happy to be contacted again, with the date and how you reached Us, for example an ad or the website chat, as described in Clause 6.2.

Conversations with Zee are stored in Chatmo and processed by the AI model provider Chatmo uses, as described in Clause 7.2.

g. Server logs of the kazeer.ai website

These logs are described in Clause 8.

2.3. The Owner confirms that the data entered in Kazeer is correct and that the Owner is entitled to enter it. The Owner is responsible for wrong or misleading data they enter themselves. Not final yet: [wording of this clause: waiting for lawyer review C15]

2.4. From time to time We may ask you to confirm or update your Account details so they stay accurate, for example before handling a request to close an Account or a request about Personal Data.

2.5. Kazeer is made for businesses and used by Owners and their staff. We do not intend to collect children's Personal Data. The UU PDP classes children's data as specific Personal Data, and processing it needs a parent's or guardian's consent. If your business employs staff who count as children under the applicable rules, get their parent's or guardian's consent before entering their data in Kazeer, including attendance selfies. If you know We have received a child's data without that consent, tell Us by email.

3. Our Role in Personal Data

3.1. The UU PDP separates two roles. A Personal Data controller decides what data is processed for and how. A Personal Data processor processes data on a controller's behalf.

3.2. We are the controller of:

the Owner's Account data, Plan, billing, and Deposit;
messages you send when you ask for a demo, ask a question, or ask for help, including conversations with Zee;
your conversations with Kazeer AI, and the WhatsApp number you use for Kazeer AI;
the names, roles, business names, photos, and quotes of the people whose testimonials We show on the website and in Kazeer ads;
the kazeer.ai website server logs;
the audit log, login session data, server application logs, and the Kazeer AI server log, as described in Clause 2.2(e).

3.3. For the data your business enters in Kazeer, meaning staff data, orders, recorded payments, stock, recipes, tax, attendance, and your business's customer data, your business is the controller and We are the processor. We process that data only to run and secure the Kazeer Services for your business according to the settings you choose in the app, to meet legal obligations, and to produce aggregated, anonymised statistics for improving the Kazeer Services, as described in Clause 6.1. Not final yet: [The lawful basis for processing Personal Data into aggregated, anonymised statistics, including data your business controls: waiting for lawyer review C51] Data you send through Kazeer AI is also processed by NVIDIA under the terms described in Clause 5.2.

3.4. As controller, the Owner must have a lawful basis to record staff and customer data, including consent where required, and must tell those people what is recorded. The Owner bears the consequences of processing they carry out themselves without a lawful basis, to the extent the law allows. This does not reduce Our duties as processor. Not final yet: [wording of this clause: waiting for lawyer review C16]

3.5. If you work for or buy from a business that uses Kazeer, send questions or requests about your data to that business. We help the business follow them up. If you don't know where to go, contact Us.

4. Attendance with Selfie and Location

4.1. How it works:

Before attendance with face matching is used, staff enrol their face, with their consent, by taking 3 to 5 photos. From these photos, the Kazeer server creates a face template, which is stored encrypted.
Staff clock in and clock out from their phone by taking 2 photos: one facing the camera, then one turning their head as instructed. The second photo is used to check that the person clocking in is real, not a photo on a screen. The photo facing the camera (the selfie) is then matched with that staff member's face template. Not final yet: [How attendance works through the attendance kiosk tablet, and what data it takes; if the kiosk takes a selfie, matches faces, or takes a location, the same rules and retention periods apply as for attendance on a phone: waiting for programmer confirmation, A99]
If the staff member's role requires a location, the location when clocking in or out is matched to the Outlet where they work. If the location doesn't match, the clock-in fails.

Face matching runs on an open-source model on Kazeer's own server, with no third-party face recognition service. What is kept: the selfie taken when clocking in or out, the face enrolment photos (so the Owner can check them), and the face template. The head-turn photo is not kept. The Owner can turn face matching off for specific roles.

Location is taken only at clock-in and clock-out, and there is no location tracking in the background. What is stored is the location point, meaning latitude, longitude, accuracy, and distance to the Outlet's point, not only whether it matched. Rejected clock-in attempts, for example from outside the Outlet's radius, are also recorded with their location.

4.2. The selfie and face matching show who clocked in, so clocking in for someone else is no longer easy. The location confirms the clock-in happened at the staff member's Outlet. We use attendance selfies, face enrolment photos, face templates, and locations for nothing other than attendance.

4.3. In the app, attendance records, including selfies and locations, can only be seen by the Owner.

4.4. Selfies and face enrolment photos contain an image of a face, and the face template is made from those images to match faces. The UU PDP names face images as an example of biometric data, which is specific Personal Data, so We treat attendance selfies, face enrolment photos, and face templates as specific Personal Data. Attendance location is general Personal Data, but We limit its use the same way as selfies.

4.5. Attendance needs camera permission on the staff member's phone, and location permission only if the staff member's role requires a location. These permissions are managed in the phone's settings.

4.6. Before staff start clocking in, the Owner is responsible for telling them:

that attendance uses a selfie, face matching, and location, and what for;
that selfies, face enrolment photos, and face templates are specific Personal Data, and that face enrolment needs their consent;
that in the Kazeer app only the Owner can open those records, and Kazeer stores them on the business's behalf;
how long selfies and locations are kept;
their rights over their data and where to send requests;
what to do if a clock-in fails.

4.7. The Owner is also responsible for using attendance in line with the employment agreement and applicable rules, and for protecting staff selfies and locations, for example by not sharing them in group chats or with others.

4.8. Staff with questions, or whose clock-in fails while they are at the Outlet, should raise it with the Owner they work for. Requests to see, correct, or delete attendance records also go to the Owner.

5. Kazeer AI

5.1. Kazeer AI helps the Owner understand their Business Records. You can ask in everyday language on the web or on WhatsApp, for example "What are today's sales?" or "What sells best?". Kazeer AI also sends an automatic WhatsApp alert to the Owner and store admins when stock runs out or runs low after a transaction. Kazeer AI sends no other automatic messages.

5.2. For this We process:

your questions and Kazeer AI's answers, the business name, your name and role, and a short conversation history;
the Business Records needed to answer, such as sales, transactions, best-selling items, and stock. These records can include staff data, for example sales per cashier shift, and customer data, such as names and phone numbers, when the question is about customers;
for the receipt-logging feature (catat nota): the photo or text of the receipt you send;
if you use WhatsApp: your WhatsApp number and profile name.

Kazeer AI uses AI models from Meta's Llama family through the NVIDIA NIM service, provided by NVIDIA, a United States company. The models are not Our own. To answer, We send NVIDIA: your question, the business name, your name and role, a short conversation history, the database structure with sample product and category names, and up to 15 rows of Business Records to summarise, which can include customer names and phone numbers when the question is about customers. For the receipt-logging feature, the photo or text of the receipt is sent too. In tax mode, only a summary of the calculation is sent, with identity numbers masked. This data is sent outside Indonesia. Not final yet: [We stop sending names, phone numbers, and receipt photos to NVIDIA while Kazeer AI uses NVIDIA's trial service: waiting for programmer confirmation, A91]

Kazeer AI currently uses NVIDIA's free trial service, which is subject to NVIDIA's API trial terms (the NVIDIA API Trial Terms of Service). Under those terms, NVIDIA does not keep the data sent and the results after each session ends, but it may collect that data and those results, in a way that does not identify the user, to improve NVIDIA's products, including AI models. We ourselves do not use this data to train AI models. If Kazeer AI moves to another provider, We will update this Policy before the new provider is used, including the provider's name and the country where data is processed, and give notice of it as set out in Clause 12.2.

The text of each question, with the business name and the User's name, and the database query generated to answer it are recorded in the Kazeer AI server log.

5.3. Kazeer AI's recommendations are suggestions. The decision stays with you.

5.4. When you use Kazeer AI on WhatsApp, your messages and Our replies pass through WhatsApp, which is run by WhatsApp (Meta) under its own privacy policy (opens in a new tab). Kazeer AI on WhatsApp runs on a WhatsApp number owned by Kazeer, not on the official WhatsApp Business Platform. Kazeer AI recognises the sender by matching their WhatsApp number with the phone number of a User or business registered in a Kazeer Account. Not final yet: [A verification code is sent when a WhatsApp number is linked to an Account: waiting for programmer confirmation, A101]

6. Use of Personal Data

6.1. The UU PDP requires every processing to have a lawful basis. We use Personal Data for these purposes:

Running your Account and the Kazeer Services (POS, orders, online payments and payouts, stock, reports, multi-Outlet, attendance, and Kazeer AI). Data: Account data, payout bank account data, Business Records, staff data, and Kazeer AI conversations. Basis: performing the service agreement with you; for staff and customer data, on behalf of your business as controller.
Handling Plans, billing, Deposits, and Platform Fees. Data: Account and Plan data. Basis: performing the service agreement.
Answering demo requests, questions, feedback, customer support, and staff training. Data: your message, including conversations with Zee, and contact details. Basis: meeting your request before you subscribe, or performing the service agreement.
Telling you about changes to the service, Plans, or this Policy. Data: Account contact details. Basis: performing the service agreement and meeting legal obligations.
Running and securing the website and services, finding the cause of faults, and preventing misuse. Data: server logs and Account data, only as needed. Basis: legitimate interests, with regard to your rights.
Producing aggregated, anonymised statistics to improve the Kazeer Services. Data: the data your business enters in Kazeer, as listed in Clause 3.3, before it is anonymised. Basis: Not final yet: [waiting for lawyer review C51]
Showing customer testimonials on the website and in Kazeer ads. Data: the name, role, business name, photo, and quote of each person giving one. Basis: their written consent, which they can withdraw at any time by email. We may show a customer's business name and logo only with separate written permission, which can be withdrawn at any time. Not final yet: [All five people giving testimonials and every business whose logo is shown on the website have given written consent, each of those businesses uses Kazeer, and any testimonial or logo that does not meet these conditions has been taken down from the website: waiting for Kazeer team confirmation, A35 and A61]
Meeting legal obligations, such as data breach notices or official requests from authorities. Data: the data required. Basis: legal obligation.

6.2. We send promotions and program news by WhatsApp only to people who contacted Us first, for example through an ad that opens a WhatsApp chat or through the website chat, and to Kazeer customers, and only after they say yes when Zee asks whether We may contact them again. We record that consent in Chatmo with the date and how they reached Us. Basis: your consent, which you can withdraw at any time, for example by replying "STOP". Once you withdraw it, We send you no more promotions. In a conversation with Zee, Zee may send at most 2 automatic follow-up messages within 24 hours, and sends none after you ask to stop or say no. If We send promotions by email, the same rules apply, and every email has an unsubscribe link.

6.3. We do not use Personal Data for any purpose outside Clauses 6.1 and 6.2. If We want to use it for a new purpose that needs consent, We will ask for that consent first, separately from anything else and in clear language.

7.1. We do not sell or rent Personal Data.

7.2. We share Personal Data only with the following, and only as much as needed:

Users in your business, according to the roles and Outlets the Owner sets. Among them, only the Owner can see attendance records.
Hostinger (Hostinger International Limited), a server provider, for all of Kazeer's servers. The kazeer.ai website, the web app, the API, the database, and uploaded files, including attendance selfies, are on one Hostinger VPS in Kuala Lumpur, Malaysia.
Google, for email received at admin@kazeer.ai, for OTP code and notification emails from the app sent through Gmail, for fonts in the web app loaded from Google Fonts, and for Google Calendar when a demo is booked through Zee. In that case, Google Calendar receives the demo booking with the name you go by, business name, business type, number of outlets, city, and demo focus you gave.
NVIDIA, which runs the AI models for Kazeer AI through the NVIDIA NIM service, for the data and under the terms described in Clause 5.2.
WhatsApp and Instagram (Meta), for messages you send or receive on WhatsApp or Instagram, including Kazeer AI on WhatsApp and conversations with Zee.
Chatmo (PT Chatmo Teknologi Indonesia, in Sleman), the chat service that runs Zee, for conversations on WhatsApp, Instagram, and the web chat as described in Clause 2.2(f). Chatmo stores those conversations and the data you give in them, contacts, conversation labels, and records of consent to be contacted again, on Amazon Web Services and Google Cloud servers. Under its terms of service, Chatmo processes that data as a processor on Our behalf. Chatmo may also use anonymised, aggregated conversation content to train its AI agents, but does not use one customer's specific data for models that other customers use. Not final yet: [The country where Chatmo's servers store the conversations: waiting for Kazeer team confirmation, A103]
The AI model provider Chatmo uses to run Zee, which receives conversations with Zee to write Zee's replies. Not final yet: [The provider's name and model, whether that provider keeps conversations or uses them to train models, and whether We can refuse to let Kazeer's conversations be used for training: waiting for Kazeer team confirmation, A104]
Xendit (PT Sinar Digital Terdepan), a payment service provider, for Plan and Deposit payments on Kazeer's payment page, for QRIS, virtual account, and e-wallet payments at your business, and for payouts. Xendit receives the payer's email address, and the name and account number of the payout recipient, only as needed for that transaction. Not final yet: [Xendit is the only payment service provider that receives data from the Kazeer Services: waiting for programmer confirmation, A90; whether Xendit also receives the phone number you enter on the payment page for some e-wallet methods: waiting for owner answer A110]
Let's Encrypt, for HTTPS certificates. Let's Encrypt receives only the domain name.
Authorities, when laws and regulations require Us to provide it. Where the law allows, We tell you.

Apart from Chatmo for conversations with Zee, We do not use SMS services, push notifications, analytics, crash reports, outside CRM or accounting software, or map services.

7.3. Processing by the providers in Clause 7.2 that process data on Our behalf is governed by the terms We accepted with each of them:

Hostinger: a data processing agreement that is an annex to Hostinger's Terms of Service.
Google: Google's data processing terms (the Cloud Data Processing Addendum), which form part of the Google Workspace agreement We use for email on the kazeer.ai domain. Not final yet: [Whether the OTP code and notification emails from the app, and Google Calendar for demo bookings, also use this Google Workspace account: waiting for owner answer A109]
Xendit: Xendit's merchant terms, which include rules on end-user data. There is no separate data processing agreement.
Chatmo: Chatmo's terms of service, which state that Chatmo processes data as a processor on its customers' behalf. There is no separate data processing agreement.
NVIDIA: there is no data processing agreement. Processing by NVIDIA is subject to the trial terms described in Clause 5.2.

Processing by services you use directly, such as WhatsApp, is also subject to their own privacy policies. Sharing does not remove Our responsibility as controller under the UU PDP. Not final yet: [wording of this clause: waiting for lawyer review C17]

7.4. Transfers outside Indonesia:

Email you send to admin@kazeer.ai is received and stored by Our email provider, Google, through Google Workspace, and may be processed on servers outside Indonesia. That processing is subject to Google's data processing terms as described in Clause 7.3.
OTP code and notification emails from the app are sent through Gmail (Google), and the web app loads fonts from Google Fonts. Data for both of these Google services is sent outside Indonesia.
Data sent to Kazeer AI is processed by NVIDIA, a United States company, outside Indonesia, as described in Clause 5.2.
Messages on WhatsApp and Instagram, including Kazeer AI on WhatsApp, conversations with Zee, and messages from the Book a demo form, are processed by Meta under its own privacy policy.
Conversations with Zee are stored by Chatmo on Amazon Web Services and Google Cloud servers, and processed by the AI model provider Chatmo uses. Under Chatmo's privacy policy, data may be processed outside Indonesia under Standard Contractual Clauses. Not final yet: [The countries where Chatmo stores the conversations and where its AI model provider processes data: waiting for Kazeer team confirmation, A103 and A104]
If a demo is booked through Google Calendar, the booking is stored by Google, which may process it on servers outside Indonesia.
Kazeer app data, meaning the database and uploaded files, including attendance selfies, is stored on Hostinger's server in Kuala Lumpur, Malaysia, so it is outside Indonesia.
Not final yet: [One backup copy of Kazeer app data is kept outside the main server, as described in Clause 10.2: waiting for programmer confirmation, A93; the provider and country where that backup copy is kept: waiting for owner answer A107]

Not final yet: [The basis for transfers outside Indonesia under the UU PDP, that is a country with equal protection, adequate and binding safeguards, or your consent: waiting for lawyer review C13]

7.5. If PT Kazeer Solusi Digital merges with another company, is split, is acquired, or is dissolved, Personal Data may move with it. We will tell you before and after that move.

8. Cookies, the kazeer.ai Website, and Third-Party Services

8.1. Apart from the Zee web chat widget described in Clause 8.7, the kazeer.ai website sets no cookies and uses no analytics, ads, social media pixels, or scripts from other parties. Apart from the Account sign-up and payment pages and that web chat widget, it stores nothing in your browser. The Account sign-up and payment pages temporarily keep the following in your browser tab's session storage (sessionStorage): the Plan you picked, the sign-up token, the sign-up form details without the password (business name, address, owner's name, phone number, and email), and the bill being paid, so payment can continue if the page reloads. This data is cleared when you close the tab, or when you press the button to go to the app after a successful payment. Not final yet: [The form details and sign-up token are cleared as soon as sign-up or payment is complete: waiting for programmer confirmation, A96] The website's fonts and images load from its own server.

8.2. Apart from the Account sign-up and payment pages, which send what you enter to Our server as described in Clause 2.2(a), the website has no form that sends data to Our server. The Book a demo form asks for your name, business name, and business type, which are required. The number of outlets starts at 1 and you can change it. City, a good time, and notes can be left blank. The Plan you picked in the pricing section, if any, and the part of the page where you opened the form are added to the message. When you press Continue to WhatsApp:

Your answers are put together into a WhatsApp message. Nothing is sent to Our server.
The message goes into a wa.me link that opens in a new tab. When that link opens, WhatsApp (Meta) receives its content, even before you press send.
We only receive your message if you press send in WhatsApp. It reaches Our WhatsApp (+62 851-2103-2981) with your WhatsApp number and profile name.

Other WhatsApp buttons on this website open a greeting We wrote, with none of your data.

8.3. The sample chat on the home page is not the real Kazeer AI. Its replies are picked in your browser from examples We prepared, and what you type is not sent anywhere. The blog search also runs in your browser.

8.4. This website's server logs every page request, with your IP address; date and time; the address of the page requested; the page you came from, if your browser sends it; browser type, operating system, and device; and the status code and size of the server's response. We use the log to run the website, find the cause of faults, and keep it secure. The log has a size limit: when it is reached, the oldest entries are deleted automatically, and the whole log is deleted each time the website's server is reinstalled. Not final yet: [The log contents and deletion described above match the production server's settings, and no other access log runs in front of the website's server: waiting for programmer confirmation, A32]

8.5. Links to Google Play, WhatsApp, Instagram, LinkedIn, YouTube, Facebook, and the Kazeer app take you to services with their own privacy policies.

8.6. If We add analytics, cookies, a chat service, forms, or anything else that changes the data this website processes, We will update this Policy first.

8.7. The Zee web chat on this website is provided by Chatmo. When you use it, your chat and what you fill in on the web chat are sent to Chatmo, as described in Clause 2.2(f) and Clause 7.2. We add this web chat widget to the kazeer.ai website only after this Policy describes the scripts it loads from Chatmo's servers and the data it stores in your browser. Not final yet: [The scripts the web chat widget loads from Chatmo's servers, and the cookies or other data it stores in your browser and for how long: waiting for programmer confirmation, A105]

9. Your Rights and How to Use Them

9.1. Under the UU PDP, you have the right to:

be told who processes your data, the legal basis, and what it is used for;
see your data and get a copy of it;
complete, update, or correct data that is wrong or inaccurate;
ask for processing to stop, or for your data to be deleted or destroyed;
withdraw consent you have given;
delay or restrict processing, in line with its purpose;
object to decisions made only by automated processing, including profiling, where they have legal effects or a significant impact on you;
get your data in a common, machine-readable format, and use it or send it to another controller;
sue and receive compensation if your data is processed unlawfully.

9.2. Some of these rights can be limited in specific cases set by law. Data We must keep under regulations also cannot be deleted right away. Withdrawing consent or deleting data may mean you can no longer use some or all of the Kazeer Services.

9.3. To make a request, email admin@kazeer.ai and include:

your name and how you relate to Kazeer: Owner, staff member, customer of a business, website visitor, or someone who contacted Us;
the related Account or business, if any;
what you are asking for.

9.4. We may ask you to prove the data is yours, so it isn't given to the wrong person.

9.5. The UU PDP sets a limit of 3 x 24 hours for requests to correct or update data, give access to data, withdraw consent, and delay or restrict processing. We act on those requests within that limit, then tell you the result. For deletion requests, We tell you once the data has been deleted or destroyed.

9.6. For data recorded by the business you work for or buy from, including attendance records, send your request to that business as set out in Clause 3.5.

10. Storage and Deletion

10.1. If the internet drops, the POS keeps working. POS data is saved on the device first, then saved to the Kazeer cloud once the connection is back. Until it syncs, that data exists only on that device. In the Android app, offline data is stored without encryption in an SQLite database on the device: offline sales, copies of products, copies of customer data (name, phone number, email, and address), tables, vouchers, and shifts. After syncing, only the send queue is cleared: offline sales records stay on the device, even after you log out of the app. So protect your POS devices as set out in Clause 11.2.

10.2. We keep Personal Data for these periods:

Account and Plan data: until the Account is closed, including after a subscription stops or the Deposit runs out, so the Owner can come back to Kazeer or download their data. After the Account is closed, this data is handled as set out in Clause 10.4. Kazeer's billing records, meaning invoices and proofs of payment for Plans and Deposits, are kept for 10 years, because documents that form the basis of bookkeeping must be kept for 10 years under Article 28(11) of the Law on General Provisions and Tax Procedures (UU KUP).
Business Records, such as orders, payments, stock, and reports: until the Account is closed, including after a subscription stops or the Deposit runs out. After the Account is closed, Business Records are handled as set out in Clause 10.4.
Staff data: until the Account is closed. After the Account is closed, staff data is handled as set out in Clause 10.4.
Attendance selfies: deleted automatically after 90 days. The Owner can change this to anywhere from 7 to 730 days.
Face enrolment photos and face templates: deleted when the Owner resets a staff member's face, when that staff account is deleted, or 90 days after the business's Plan stops including attendance. Not final yet: [Whether face enrolment photos and face templates are also deleted when a staff account with transaction history is only archived: waiting for owner answer A106]
Location points and attendance records: clock-in and clock-out records are kept until the Account is closed, because the Owner uses them to work out pay. For now the Owner cannot delete a single selfie, location point, or attendance record directly, but can shorten how long selfies are kept, reset a staff member's face, or correct an attendance record. Not final yet: [Attendance location points, including the locations of rejected clock-in attempts, are deleted automatically after 90 days, the same as selfies, and the Owner can delete clock-in and clock-out records: waiting for programmer confirmation, A92]
Kazeer AI conversations: on Kazeer's server, conversation history is kept only in memory, up to 20 messages, and is lost after 30 minutes without activity or when the server restarts. On the web, the history is kept in your browser session, up to 50 messages, for 30 minutes. On WhatsApp, messages stay in WhatsApp. The Kazeer AI server log described in Clause 5.2: Not final yet: [deleted automatically after 30 days: waiting for programmer confirmation, A92].
Technical data from the app: the audit log is kept for 365 days, and login session data is deleted once the session expires, after 30 days at most. Server application logs of app.kazeer.ai and api.kazeer.ai: Not final yet: [deleted automatically after 30 days: waiting for programmer confirmation, A92].
Demo messages, questions, and help requests, including conversations with Zee in Chatmo and demo bookings in Google Calendar: for prospective customers who do not subscribe, 12 months from the last contact, after which We delete them from Chatmo and Google Calendar. If Kazeer's Chatmo account or subscription ends, Chatmo deletes or anonymises that data within 90 days. Not final yet: [Whether the sales team also records demo requests in a spreadsheet, which is also cleared after 12 months, and whether conversations We delete in Chatmo are also deleted from Chatmo's servers, and when: waiting for Kazeer team confirmation, A27 and A103] Not final yet: [How long messages and conversations from subscribed Owners are kept: waiting for owner answer A108]
Testimonials on the website and in ads: until the person withdraws consent.
Website server logs: until deleted automatically as described in Clause 8.4.
Backups: Not final yet: [backups are made at least once a day, including photos, with one copy outside the main server, and each backup is kept for 30 days at most: waiting for programmer confirmation, A93; the provider and country where that backup copy is kept: waiting for owner answer A107].

Not final yet: [The retention periods in this Clause, including Kazeer's billing records and Business Records after an Account is closed: waiting for lawyer review C4]

10.3. When the retention period ends, We delete Personal Data or destroy it so it can no longer identify you, unless regulations require Us to keep it longer. Not final yet: [This applies in full once the automatic deletion for the retention periods in Clause 10.2 and the Account deletion in Clause 10.4 are running, and deleted data also leaves backups within 30 days, when the retention period of those backups ends: waiting for programmer confirmation, A92, A93, and A94]

10.4. To close your Account and ask for your data to be deleted, email admin@kazeer.ai with the subject "Hapus akun" (delete account), and name the business and Account concerned. Not final yet: [An Account can also be deleted in the Android app and on a web page: waiting for programmer confirmation, A94] We will confirm the request comes from the Account owner, then tell you which data We still have to keep for legal reasons, for how long, and when deletion will be complete. Before the Account is closed, We remind the Owner to download their Business Records, because sales records are the business's own tax documents. On request to admin@kazeer.ai before the Account is closed, We send the data you cannot yet download yourself in the app, such as the product list and menu, as an Excel or CSV file, free of charge, within 3 working days, with a download link that works for 7 days. After the Account is closed, Not final yet: [all Account data is deleted within 1 day, including the data of a business that has transactions, which is no longer only archived: waiting for programmer confirmation, A94], except Kazeer's billing records as described in Clause 10.2. Not final yet: [Other data that must still be kept after an Account is closed, and for how long: waiting for lawyer review C49] Once the Account is closed, you can no longer use the Kazeer Services.

10.5. Stopping use of Kazeer or removing the app from your phone does not delete your Account or the data stored in the Kazeer cloud.

10.6. If an Account has no active Plan and nobody has logged in to it for 24 months, We notify the Owner by the registered email and WhatsApp. If there is no reply within 30 days of that notice, We close the Account, and its data is handled as set out in Clauses 10.2 and 10.4.

11. Security and Limitation of Liability

11.1. What We do:

The kazeer.ai website and the web app at app.kazeer.ai can only be opened over an encrypted connection (HTTPS).
The release version of the Android app connects to Kazeer's servers (api.kazeer.ai and chat.kazeer.ai) only over HTTPS and refuses plain HTTP connections. The exception is printing to a network (LAN) printer, which connects directly to the printer on the local network, not to Kazeer's servers.
Passwords are stored as a hash (bcrypt).
Login sessions are short (15 minutes) and renew automatically. Their refresh tokens are rotated and stored as a hash. You can log out of all devices.
Face templates, and the NPWP and NIK in the Finance & Tax module, are stored encrypted (AES-256-GCM).
Login and OTP attempts are limited.
Access is separated by role and by business, and the system checks this separation automatically.
In the app, the Owner sets each staff member's access per task and per Outlet, and only the Owner can see attendance records.
The audit log records actions in the web app and API and is kept for 365 days.
On the servers and in the database, Users' data may be opened only by the person responsible for Kazeer's servers and one appointed backup, and only at the Owner's request or with the Owner's permission for support, to fix a fault or a security problem, or because of a legal obligation. Kazeer's sales and support team may not open business data without the Owner's permission. Not final yet: [Every access uses a personal account, not a shared one, and is recorded in an audit log stating who, when, what data, and why: waiting for programmer confirmation, A95]

11.2. You are responsible for keeping your Account secure: keeping your login details secret, using a screen lock on POS devices and phones used for Kazeer, and resetting access for staff who move Outlets or leave.

11.3. To the extent the law allows, We are not liable for losses caused solely by your failure to protect your login details or devices, or by Personal Data you share yourself outside the Kazeer Services. Nor are We liable for the accuracy of data you enter yourself. This clause does not limit your rights under the UU PDP, including the right to sue and receive compensation. Not final yet: [wording of this clause: waiting for lawyer review C18]

11.4. No system is completely secure. If Personal Data protection fails, for example through a leak or unauthorised access:

For data We control, We notify in writing, within 3 x 24 hours, the people whose data is affected, by the registered email and WhatsApp and with a notice in the app, and the authority named in the UU PDP, or, while that authority has not been set up, the Ministry of Communication and Digital Affairs (Komdigi). Not final yet: [Whom to notify while the authority named in the UU PDP has not been set up: waiting for lawyer review C7] The notice states what data was exposed, when and how, and what We are doing to handle and recover from it.
For data We process on your business's behalf, We promptly tell that business's Owner and help them notify their staff and customers and meet their own notice duties.

12. Miscellaneous

12.1. We may change this Policy, for example when Kazeer adds features or regulations change. The date at the top shows when it last changed.

12.2. If a change concerns the data We process, its purpose, or who receives it, We tell Account users at least 30 days before the change takes effect, by the registered email and WhatsApp. If you disagree, you can object or close your Account before the change takes effect, at no cost, and the Owner gets back the Subscription Fee for the rest of the period already paid. For example, automatic ingredient ordering from suppliers over WhatsApp is in development, and We will update this Policy before that feature goes live.

12.3. If any provision of this Policy is invalid or unenforceable, it is treated as removed, and the other provisions remain in effect.

12.4. This Policy is also available in Bahasa Indonesia. If the two versions differ, the Bahasa Indonesia version applies.

13. Contact Us

13.1. Questions, feedback, complaints, and requests about Personal Data can be sent to:

Email for Personal Data matters: admin@kazeer.ai
WhatsApp and phone: +62 851-2103-2981. WhatsApp messages can be sent at any time, and the Kazeer team answers them every day, including public holidays, from 09:00 to 21:00 WIB (Western Indonesia Time, UTC+7).
Registered address: Jl. Asem Kranji Blok K-7, Universitas Gadjah Mada Sekip, Bulaksumur, Sendowo, Sinduadi, Kec. Mlati, Kabupaten Sleman, Daerah Istimewa Yogyakarta 55284
Yogyakarta office: EDS Building, at the registered address above
Jakarta office: Graha Mampang, Jl. Mampang Prapatan Raya, Mampang Prapatan, Kec. Mampang Prapatan, Kota Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12790

Personal Data matters at Kazeer are handled by the Kazeer team responsible for personal data, at the email address above.

13.2. Formal requests about Personal Data are best sent by email, so they are on record and We can verify them. If you raise one on WhatsApp or by phone, We will help you send it by email, and the response time counts from when We received your request.

13.3. We may record your correspondence with Us to follow up requests and improve the service.

13.4. If you are not satisfied with Our response, you can use the remedies set out in the UU PDP. The official text of the UU PDP is on JDIH BPK (opens in a new tab) (in Indonesian).