Privacy Policy

Effective 7 October 2026 · version 2026-10-07

This policy explains how Mykurva collects and uses personal data, and the rights you have under Indonesia's Personal Data Protection Law (Law No. 27 of 2022). For your account and workspace data we are the data controller.

1. Data we collect

About you and your agency

Account details: name, email address and password (stored as a secure hash), or your Google account name and email if you sign in with Google.
Agency details and onboarding answers: agency name and logo, your role, team size, number of client brands, platforms, tools you use and time spent per report.
Teammates you invite: their email address and role.
Billing details: invoice name and email, and if you ask for a tax invoice, your company tax number (NPWP) and billing address.
How you found us: campaign tags (UTM) and the referring website, captured when you sign up.
Product activity: actions such as sign-up, data pulls, exports and invites, with the time and the brand involved.
Survey answers and messages you send us.
Your consent to these documents, with the version and the time.

Social media data for your brands

Publicly available data from the brand and competitor accounts you add: usernames, profile names, follower counts, posts, captions, thumbnails, links and engagement numbers. Captions and images can mention or show people; we only keep what the post already makes public.
Insights such as reach, views, followers and audience demographics of the brand's own Instagram and Facebook accounts, when your agency connects them through Facebook Login. We store the access tokens encrypted and use them only to read these insights.

For this data your agency decides which accounts to add and how reports are used, and we process it on your behalf to provide the Service. Agencies are responsible for having the right to report on the brands they add (see our Terms of Service).

2. Why we use it, and on what basis

To provide the Service you signed up for: your account, workspace, data pulls, reports and exports (performing our contract with you).
To bill you and issue invoices and tax invoices (contract and legal obligations).
To keep the Service secure, prevent abuse and fix problems (legitimate interest).
To understand how the Service is used and improve it, mostly in aggregate (legitimate interest).
To send service messages such as invites, invoices and important changes; promotional messages only if you opt in (consent, which you can withdraw).

3. Who we share it with

We don't sell personal data. We share it only with providers that help us run the Service, under agreements that require them to protect it:

Cloud hosting and database providers: the application, database, sign-in and file storage (servers in Singapore).
A third-party provider that collects publicly available post data from social media platforms.
Google: YouTube data and Google sign-in.
Meta: Facebook Login and the insights of the Instagram and Facebook accounts you connect.

A list of our service providers is available on request at the contact details on our website.

Some of these providers process data outside Indonesia. When data leaves Indonesia we rely on providers with an adequate level of protection and contractual safeguards, as UU PDP requires. We may also disclose data when the law or a competent authority requires it.

4. How long we keep it

Account, workspace and social media data: while your workspace exists. Deleting a brand deletes its accounts and pulled data.
When you ask us to close your workspace, we delete or anonymize its data within 30 days.
Billing records: for as long as Indonesian tax law requires (generally 10 years).
Product activity: up to 24 months, after which we keep only aggregated numbers.

5. Cookies

We use only first-party cookies that the Service needs: sign-in session cookies, and a sign-up cookie that remembers how you found us for up to 30 days. We don't use advertising or third-party tracking cookies.

6. Security

Data travels over encrypted connections. Each agency's data is isolated at the database level, access to production systems is limited, and secrets such as platform access tokens are encrypted. If a breach puts your personal data at risk, we'll notify you and the authorities as UU PDP requires.

7. Your rights

Under UU PDP you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct or update it;
delete it, or stop or restrict processing it;
withdraw a consent you gave (for example to promotional messages);
receive your data in a commonly used format to move it elsewhere.

Send requests to the contact details on our website. We may need to confirm your identity first, and we'll respond within the time limits set by UU PDP. If you're unhappy with our answer, you can complain to the Indonesian authority responsible for personal data protection.

If you are a person shown in social media data an agency reports on, you can also contact us; we'll work with the agency concerned.

8. Children

The Service is for businesses and isn't meant for anyone under 18.

9. Changes

We'll update this policy when our practices change and tell you about material changes by email or in the app before they take effect. The version and date at the top show which policy applies.

10. Contact

Mykurva. Privacy questions and requests: the contact details on our website.