Privacy Policy
1. What we collect
Account data: name, email, phone number, and password (stored as a hash, never as plain text). If you sign in with Google, we receive your name, email, and Google account identifier — not your Google password.
What you create: your business story, revision requests, uploaded photos, and the contents of Business Data (menus, products, prices, schedules, guest lists, and similar).
Domain registration data: if you buy a domain, we collect name, address, city, province, postal code, country, phone, and email, as ICANN requires.
Technical data: IP address, access time, and requested pages, recorded in server logs and the audit trail. To count daily visitors, IP addresses are turned into a one-way fingerprint and those fingerprints are deleted after 2 days; what we keep beyond that is only the daily totals, tied to no one. We use no third-party analytics service. On our public pages (before you sign in) we offer ad measurement — the Meta Pixel and the Google Ads conversion tag — and both only load if you press Accept on the cookie banner; see sections 3 and 7.
We never store your card number, CVV, or bank credentials. Those go directly to the payment provider and never pass through our systems.
2. Why we use it
To run the service: building and serving your website, processing AI requests, publishing public tables to your site, registering domains, issuing invoices, and answering your questions in the Help menu. We also use it to prevent abuse — for example detecting prohibited content and rate-limiting requests.
Email. We send service emails (verification, invoices, receipts, account security) for as long as your account exists. We also send a few reminders and promotions about your own account: when your trial ends, when a website you built is still unpublished after 7 days, and when a promotion is running — at most one email a day, in your website's language. Every reminder and promotion includes a link to stop receiving them without signing in; service emails are still sent.
We do not sell your data, do not rent it out, and do not use your website content or Business Data to train AI models.
3. Third parties involved
To operate the service, some data is sent to the providers below, limited to what each one needs:
- An AI model provider — your business story and revision requests are sent to a third-party language model provider to generate the website. Processed outside Indonesia. That provider is contractually bound not to use your content to train its models.
- Paddle — payments in US dollars. Paddle is the Merchant of Record: it is the seller of record for that transaction, issues the invoice, and handles taxes. Its name appears on your card statement.
- Midtrans — payments in Indonesian rupiah.
- A domain registrar partner — only if you buy a domain. Registrant details are passed to the registrar and to that extension's registry as ICANN requires, and some of them may appear in WHOIS where the extension does not support WHOIS privacy.
- Google — only if you choose to sign in with a Google account, or if you connect Google Drive to receive files from your website's visitors (and the site's Google Sheets, which uses the same connection). For that Drive connection we request the
drive.filescope only: we can see and manage only the files we create ourselves in your Drive — the rest of your Drive is never read by us. You can revoke it at any time, from the panel or from your Google account. - Meta (Facebook/Instagram) — only if you press Accept on the cookie banner, only on public pages before you sign in, and only to measure our own ads: what is sent is the page visit plus three steps that carry no personal data (business story written, sign-up form submitted, email verified). Your name, email, phone number, website content, and Business Data are never sent to Meta. Once you are signed in no ad measurement is loaded at all, and it is never placed on customer websites. Processed outside Indonesia.
- Google Ads — same as Meta: only if you press Accept, only on public pages before you sign in, and only to measure our own ads on Google. What is sent is the page visit and a signal that a step was reached (sign-up form submitted, email verified). We do not enable "enhanced conversions" — the Google feature that sends customer email addresses — so your name, email, and phone number are never sent to Google through this tag. Processed outside Indonesia.
We name the categories rather than each provider, because that list can change. If you need the list that applies today — for your own company's compliance, for example — ask us and we will give it to you.
4. Data about your own customers
If your website collects other people's data — invitation guest lists, WhatsApp numbers, event registrations — you are the controller of that data and we process it on your behalf. Tables containing personal contact details are always private: the system refuses to publish them, so they are never included in what goes live.
Files sent by your website's visitors. If you switch on the upload box (Guest uploads), files sent by visitors — you decide which types: photos, PDFs, video, documents, or any file — are forwarded to your own Google Drive and are not stored by us: the temporary copy is deleted as soon as it has been forwarded, and we never serve it back to the internet. What we keep is the record only: file name, type, size, time, and the sender's name and WhatsApp number if you require them. The sender's IP address is stored as a one-way random fingerprint, not as the address itself. Photos are re-encoded before being forwarded, so the metadata inside them — including GPS coordinates — is removed. Other types (PDF, video, documents) are forwarded as they are: their own metadata, including the location some video cameras store, reaches your Drive too. You are the controller of that visitor data; tell them what you collect it for, and delete what you do not need.
Guestbook and forms on your website. If you connect Google Sheets, what visitors submit — guestbook wishes, attendance confirmations, orders, registrations, or any other form you ask for — is written to your own spreadsheet in your Google Drive. On our side each submission is only held temporarily in a queue until it reaches the spreadsheet: the record is deleted 7 days after delivery, and submissions that can never be delivered (for example because your Google Drive is not reconnected) are deleted after 30 days. The sender's IP address is stored as a one-way random fingerprint. Guestbook wishes are shown on your website until you delete their row in the spreadsheet or hide the tab; other form entries are not shown unless you show their tab yourself, and personal contact columns (WhatsApp/phone numbers, email, national ID) are never shown. You are the controller of that data; tell visitors what you collect it for.
5. Where it is stored
Your website, photos, and business database are stored on servers in Indonesia. Each site's database is a separate file that is never served to the internet and cannot be read by the web-serving process. Published sites are static pages in a directory kept apart from the database and drafts.
6. How long we keep it
- Website content, versions, photos, and Business Data: for as long as your account exists. A website you delete yourself is gone permanently and immediately.
- Unclaimed anonymous trials from the home page: deleted automatically after 48 hours.
- Audit records: 180 days.
- Records of files from visitors: for as long as the site exists. The files themselves are in your Google Drive and only you can delete them — from the panel or directly in Drive.
- Guestbook and form submissions: 7 days after they reach your spreadsheet, or 30 days if they can never be delivered. What is in the spreadsheet is entirely under your control.
- Password reset links and similar tokens: deleted 7 days after they expire.
- Invoice records: kept longer where tax and accounting law requires it.
7. Cookies
We use only the cookies we need: one to keep you signed in, one for CSRF protection, plus your language and currency choices. If you arrive through one of our ads, one more cookie stores the name of that source (for example google/umkm, no personal data) for 30 days, so we know which ads actually bring users. If you open a friend's invite link, one cookie stores that invite code for 60 days — it holds your friend's code, not your data — so your friend receives a Magic token if you later subscribe. Your friend only sees the number of people they invited and who subscribed, never your name, email, or account data. The only third parties that set cookies are the Meta and Google ad-measurement tags on our public pages (section 3), and even then only after you press Accept. If you press Decline their scripts are never downloaded at all — not merely hidden. Your choice is stored in a ws_izin cookie for 180 days and can be changed at any time through the Cookies link in the footer. Once you are signed in no ad measurement is loaded at all and there are no third-party trackers in the panel. Blocking third-party cookies in your browser does not affect the service.
8. Your rights
You can view and change your account details inside the panel, export your website content, and delete a website at any time. To request a copy of all your data or full account deletion, contact us at support@websalabim.com or through the Help menu. We respond within a reasonable time, normally 30 days.
If you are in a region covered by the GDPR or similar rules, you have the right to access, correct, delete, restrict the processing of, and port your data, and to object to certain processing.
9. Security
All traffic is encrypted with HTTPS. Passwords are stored as hashes. Admin accounts use two-step verification. Customer files are separated from core code, and each site's database cannot be read by the process that serves the web. No system is perfectly secure — if a breach affects you, we will tell you.
10. Children
The service is not intended for anyone under 18, and we do not knowingly collect their data.
11. Changes
If this policy changes in a meaningful way, we will give notice by email or inside the panel before it takes effect.
Questions about this page? support@websalabim.com or through the Help menu inside the panel.