VybeFlow Privacy Policy

1. About this document

VybeFlow is operated by PT Horizon Vyber Nusantara (formerly PT Vyber Asia Cloud) (“we”), at Plosokuning 5 RT 25, RW 10, Kel. Minomartani, Kec. Ngaglik, Sleman, Special Region of Yogyakarta 55581, Indonesia. The service is reached at vybeflow.vyber.id.

This policy covers the VybeFlow console, the website chatbot you install through our SDK, and every channel integration you connect through the service. It does not cover third-party sites, apps or services you connect yourself — including WhatsApp, Instagram and Telegram, each of which has its own privacy policy.

Read it alongside the Terms & Conditions and the WhatsApp Data Policy.

2. Our two roles over your data

This distinction decides almost everything else in this document, so it comes first.

As data controller

For your business account data — name, email address, phone number, team members and their roles, subscription history and payments — we are the controller. We decide what that data is used for, and you can exercise the rights in section 11 directly with us.

As data processor

For the contents of conversations with your customers — messages, phone numbers, account names, attachments, tickets and notes — we are a processor acting on your instructions. You are the controller. You decide which customers are contacted, what is sent, and how long it stays in your account.

The consequence is real: if one of your customers asks for their data to be deleted, that request is addressed to you, not to us. We provide the tools and will help if asked, but the duty to answer is yours. Section 11 explains how.

3. What we collect

What we do not collect. We never ask for or store credit card numbers or other card details. Payments are handled by a payment provider (see section 8) and we receive only the transaction status. We do not store your password either: sign-in goes through Google or Facebook.

Masked parameters. When you mark an API connector parameter as sensitive — an OTP or a password, say — its value is passed to your target API but is never shown in the console and never written to the conversation transcript.

4. Where the data comes from

• From you, when you sign up, invite a team, connect channels, upload contacts and configure agents.
• From the WhatsApp Business Platform (Meta), when a customer messages your business number. Details in the WhatsApp Data Policy.
• From the Instagram Graph API (Meta), when a customer sends a direct message to your Instagram Business account.
• From the Telegram Bot API, when a customer messages the bot you connected.
• From your website chatbot, when a visitor starts a conversation through the SDK you installed.
• From the payment provider, as a transaction status when you buy quota or a subscription.

5. What the data is used for

We do not sell your data or your customers' data, and we do not share it with advertisers.

6. How AI processes conversations

To generate a reply, the relevant conversation content is sent to the third-party AI model providers we use as subprocessors. What is sent is the context needed to answer: recent messages in that conversation, the system prompt you wrote, and data from the skills you enabled — your product catalogue, for instance.

We choose providers who are contractually barred from using your data to train their models. The list of providers in use can change over time; the current list is available on request through the contact in section 16.

The agent's web search feature sends the search query — not the whole conversation — to a third-party search provider.

A limit you should know about. AI model output is probabilistic and can be wrong. You are responsible for what your agent says to your customers; the AI Lab exists so you can test it before that happens. Do not put data that must not reach a third party into a system prompt or a skill.

7. Connecting an external AI assistant

You can connect an external AI assistant — Claude, for instance — to your workspace through our MCP endpoint, either with an API key you create or by approving an OAuth connection. This section describes what happens to your data when you do.

Connecting is your own act of sharing. When you approve a connection, you are choosing to make your workspace data available to that assistant's provider. Once it reaches them it is governed by their terms and privacy policy, not ours. We are the processor for the transfer; we are not a party to what they do with it afterwards.

What a connection can reach. Only what you ticked when you approved it. A connection is limited to the permissions you granted, can never exceed the permissions you hold yourself, and is bound to the single workspace you chose. When the assistant calls a tool, the data that endpoint returns is sent to it: that may include contact records, conversation content written by your customers, ticket history, campaign data, product catalogue entries and billing summaries. Every change to your data stops and asks for confirmation before it runs.

What we store about the connection. The name the client registered, the permissions you granted, which person approved it, the workspace, and timestamps for when it was created and last used. Access and refresh tokens are stored only as irreversible hashes — we cannot recover them, and a copy of our database would not let anyone use your connection. We do not keep a copy of the data a connection reads.

How long. A connection lasts until you revoke it, and in any case no longer than 90 days from when it was approved, after which it stops working and must be approved again. The record of a revoked connection is kept so that "why did my assistant stop working" has an answer.

How to withdraw it. Settings → Connected apps, in the vybeflow console. You can always see and revoke the connections you approved yourself; revoking takes effect on the assistant's next request. Connector data is never used to train any model.

8. Who the data is shared with

We share data only with the subprocessors needed to run the service, and only as far as they need it:

Beyond that, we may disclose data where required by law or a valid court order, or where necessary to protect the rights, safety and security of ourselves or our users. In a merger, acquisition or asset sale, data may pass to the successor, and you will be told before that takes effect.

9. How long data is kept

• Account data is kept while your account is active.
• Conversation contents and tickets are kept while your account is active, because that history is what lets an agent recognise a returning customer. You can delete them sooner — see section 12.
• Payment records are kept for as long as tax and accounting rules require.
• Technical logs are kept briefly, for diagnosis and security.
• After an account is closed, data is deleted or anonymised within 90 days, except what we are legally required to keep.

10. Security

Access to the console requires authentication through Google or Facebook; we do not store your password. Data in transit is protected by TLS. Internal access is limited to staff who need it for operations and support. Within your own account, the Admin and Operational roles limit who can connect or disconnect a channel.

No system is completely safe. If a security incident affects personal data, we will notify you and the competent authority as the applicable rules require.

11. Your rights

Under Law No. 27 of 2022 on Personal Data Protection, you have the right to: know what data we process and why; obtain a copy; correct inaccurate data; have data deleted; restrict or object to certain processing; withdraw consent you previously gave; and lodge a complaint with the competent authority.

Make a request through the contact in section 16. We will respond within a reasonable time, generally no more than 30 days, and may ask you to verify your identity before acting on a request involving personal data.

If you are a customer of a business that uses VybeFlow, your request must go to that business. They are the controller of those conversations; we only process on their instructions.

12. Data deletion

There are three routes, depending on what you want removed.

Deleting one conversation or one contact

Do it directly in the console, in the Inbox or the Database. Deletion applies to your account and cannot be undone.

Deleting all of your account data

Send a request from the email address registered on your account to admin@vyber.id with the subject “Data Deletion”. Once your identity is verified we delete the account data and every conversation in it within 30 days, and from system backups within 90 days.

Revoking app access from Facebook or Instagram

Open Settings & privacy → Settings → Apps and websites in your Facebook account and remove VybeFlow. Revoking access stops new data from flowing; to remove data already stored, send the deletion request above as well.

Data we are legally required to keep — payment records for tax purposes, for instance — is retained until that period ends and is not used for anything else.

13. Processing outside Indonesia

Some of our subprocessors — particularly the messaging platforms and the AI model providers — process data outside Indonesia. Where that happens, we ensure there is an adequate basis and adequate safeguards as required by the applicable personal data protection rules, including contractual obligations of confidentiality and security.

14. Children

VybeFlow is a service for businesses and is not directed at anyone under 18. We do not knowingly collect children's personal data. If you become aware of such data in our service, contact us and it will be deleted.

15. Changes to this policy

We may update this policy. The version and effective date appear at the top of the page. For changes that materially affect you, we will give notice by email to your registered address or in the console before they take effect.

16. Contacting us

For questions, rights requests, or data deletion: