Privacy Policy

The controller of your personal data is PT Sieka Digital Nusantara (PT Perorangan), Kagokan RT 001 RW 002, Kemudo, Prambanan, Kab. Klaten, Jawa Tengah 57454, Indonesia. For any privacy question or request, email [email protected].

• Account: your name, email address, password (stored only as a secure hash), language, plan and credit balance, and — if you sign in with Google, Facebook or another provider — that provider’s account ID, name, email and profile picture.
• Security: your two-factor settings (authenticator app secret stored encrypted, recovery codes stored hashed), sign-in sessions and recent sign-in activity.
• Phone number: if you add one for WhatsApp, the number, its verification status and your notification choices.
• Your content: videos you upload, links you import, and what we make from them — transcripts, translations, subtitles, clips, captions, titles and descriptions — plus your AI assistant conversations.
• Connected accounts: for each social account you connect: its ID, name, handle and profile picture, the permissions granted, and access and refresh tokens (stored encrypted). For channels you follow in a workflow: the channel ID and name.
• Posts: what you schedule — which video, text, accounts and times — and the result returned by the platform (post ID, link, errors).
• Inbox and automations: comments and direct messages on your connected accounts that you view, answer or automate, the names and IDs of the people who sent them, and contact details those people chose to share (see below).
• Payments: plan, invoices, billing name, email and country, and payment status. Card and bank details are entered with our payment providers (Stripe, Midtrans) and are not stored by us.
• Support: messages you send us by email, in the app or on WhatsApp.
• Technical data: IP address, browser and device type, and logs of requests and errors, used for security and to keep the Service running.

Under UU PDP (Article 20) we process personal data on these bases:

• Performing our contract with you — to create your account, process your videos, run the features you use, publish posts and messages to the accounts you chose, show your statistics, manage your plan, credits and payments, and answer support requests.
• Your consent — for connecting each social account (given on that platform’s consent screen), WhatsApp messages, and optional features you switch on. You can withdraw consent at any time; this doesn’t affect processing before the withdrawal.
• Legal obligations — for tax, accounting and records the law requires, and to answer lawful requests from authorities.
• Legitimate interests — to keep the Service secure (prevent abuse and fraud, rate-limit, protect sign-in including Cloudflare Turnstile bot checks), send service messages (a failed post, a reconnect request, a renewal reminder), and understand and improve the Service using aggregated usage information. We balance these interests against your rights.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

When you connect a social account, we use only that platform’s official API and only the permissions you grant on its consent screen. Data from these APIs is used only to provide the features you use, shown only to you and the team members you give access to, and is never sold, used for advertising, or used to build profiles of people. Statistics are fetched when you open them and kept only in a short-lived cache (15 minutes for most platforms, 1 hour for X, 6 hours for LinkedIn); they are not stored permanently. Disconnecting an account deletes its stored tokens, details and inbox data immediately. If you revoke access on the platform instead, we delete the stored data from that platform within 30 days of learning of it. The sections below list what we access on each platform and why.

Vidcli uses YouTube API Services. By using the YouTube features of Vidcli, you agree to be bound by the YouTube Terms of Service. How Google uses data is described in the Google Privacy Policy.

What we access and why

• https://www.googleapis.com/auth/youtube.upload — to upload the videos you choose and set the title, description, tags, privacy and scheduled time you chose.
• https://www.googleapis.com/auth/youtube.readonly — to show which channel you connected (ID, title, handle, picture, public statistics) and the status and view counts of the videos Vidcli published for you.
• https://www.googleapis.com/auth/yt-analytics.readonly — to show your channel’s analytics (views, watch time, likes and subscribers per day, and statistics of recent videos) on the Analytics page.
• https://www.googleapis.com/auth/youtube.force-ssl — to read comments on your channel’s videos and post or moderate replies when you use the inbox or comment automations.
• Google Sign-In (openid email profile) — your Google account ID, name, email and picture, to sign you in.

When you import a YouTube link, we also read that video’s public details (title, duration, thumbnail) through the YouTube Data API.

Limited Use

Vidcli’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we use Google user data only to provide and improve the user-facing features described above; we don’t transfer it except as needed to provide those features, for security, to comply with the law, or as part of a merger or acquisition with your consent; we don’t use it for advertising, and we don’t sell it; our staff don’t read it unless you ask us to (for example for support), it’s needed for security or the law, or it’s aggregated and anonymized for internal operations. We do not use Google user data, including YouTube data, to develop, improve or train AI or machine-learning models.

Storage, refresh and deletion

We store your channel ID, title and picture, encrypted OAuth tokens, and the IDs of videos Vidcli published for you. YouTube analytics and statistics are fetched live and kept in a cache for at most 15 minutes. Other YouTube data we keep is refreshed from the API when it is used, and not kept for more than 30 days without being refreshed or deleted.

How to revoke access

You can revoke Vidcli’s access at any time on Google’s security settings page at https://security.google.com/settings/security/permissions, or disconnect the channel in Schedule → Accounts. Disconnecting deletes the stored tokens and channel data immediately. If you revoke access through Google, we delete all stored data obtained through YouTube API Services within 30 days. You can also ask us to delete it at any time by emailing [email protected]; we do so within 7 days.

You connect Facebook Pages and Instagram professional accounts through Facebook Login, and Threads through Threads’ own login. If you sign in to Vidcli with Facebook, we receive your app-scoped ID, name, email and profile picture. We use the following permissions only for the purposes listed.

Facebook Pages

• pages_show_list — to list the Pages you manage so you can choose which to connect.
• business_management — to find Pages and Instagram accounts that you manage through a Meta business portfolio.
• pages_manage_posts — to publish the posts and videos you scheduled to your Page.
• pages_read_engagement — to read your Page’s details, posts and their comments so we can confirm publishing and show them in the inbox.
• read_insights — to show your Page’s statistics on the Analytics page.
• pages_manage_metadata — to subscribe your Page to webhooks so new comments and messages reach your inbox and automations.
• pages_messaging — to receive Messenger conversations with your Page and send the replies you or your automations write, within Meta’s messaging windows.
• pages_manage_engagement — to reply to, hide or delete comments on your Page when you or your automations do so.
• pages_read_user_engagement — to read comments and reactions on your Page’s content for the inbox and comment automations.

Instagram

• instagram_basic — to read your Instagram profile (ID, username, picture) and media.
• instagram_content_publish — to publish the photos, videos and reels you scheduled.
• instagram_manage_comments — to read and reply to comments on your posts for the inbox and comment automations.
• instagram_manage_messages — to receive and answer Instagram direct messages in the inbox and automations.
• instagram_manage_insights — to show your account and post statistics on the Analytics page.
• pages_show_list, pages_read_engagement, business_management, pages_manage_metadata — to find the Facebook Page linked to your Instagram account and receive webhooks, as described above.

Threads

• threads_basic — to read your Threads profile (ID, username, picture).
• threads_content_publish — to publish the posts you scheduled.
• threads_read_replies — to read replies to your posts for the inbox and automations.
• threads_manage_replies — to post, hide or manage replies when you or your automations do so.
• threads_manage_insights — to show your post and profile statistics on the Analytics page.

Meta data is shown only to you, never sold, never used for advertising or to build profiles, and handled according to the Meta Privacy Policy on Meta’s side. To delete it, see Data deletion.

• user.info.basic — to identify your TikTok account (open ID, display name, avatar).
• user.info.profile — to show your profile details (username, bio link, verification) in Vidcli.
• user.info.stats — to show follower, following, like and video counts on the Analytics page.
• video.publish — to post the videos you scheduled, with the caption and privacy options you chose.
• video.list — to show your videos and their statistics on the Analytics page.

Videos are posted with the caption, privacy level and comment setting you chose checked against the options TikTok allows for your account. TikTok processes the content you publish under the TikTok Privacy Policy.

• users.read — to identify your X account (ID, name, handle, picture).
• tweet.read — to read your posts, their metrics and replies for analytics and the inbox.
• tweet.write — to publish the posts and replies you scheduled or approved.
• media.write — to upload the media attached to your posts.
• dm.read / dm.write — to show direct messages in the inbox and send the replies you or your automations write.
• offline.access — to keep the connection working without signing in again.

We display X content as X provides it, with attribution. If a post or message is deleted, made private or otherwise changed on X, we delete or update our copy within 24 hours of learning about it; we only keep IDs of posts we published for you plus short-lived caches. We don’t use X data for surveillance or to infer sensitive characteristics of people.

• openid / profile — to identify your LinkedIn account (ID, name, picture).
• w_member_social — to publish the posts you scheduled to your profile.
• r_member_postAnalytics / r_member_profileAnalytics — where enabled, to show statistics of your posts and followers on the Analytics page.

LinkedIn statistics are cached for at most 6 hours and never stored permanently. LinkedIn data is never sent to AI providers. Disconnecting deletes the stored tokens and profile data.

When you use the inbox or automations, we process the comments and messages that people send to your connected accounts, their platform IDs, names and pictures, and — only if they agree — contact details such as an email address or phone number, together with a record of their consent. For this data you are the controller and we act as your processor: we process it only to provide these features to you, on your instructions.

People who reply STOP (or a similar word) are not messaged again by automations. This data is deleted when you disconnect the account, delete the automation’s leads, or delete your Vidcli account. People who want their data removed can contact you or us at [email protected].

We use the WhatsApp Business Platform (provided by Meta) for our official Vidcli number.

• Opt-in: we send you WhatsApp messages only after you add your number and verify it with a code — that verification is your opt-in. We send only one-time codes and the notifications you switched on.
• Opt-out: reply STOP (or BERHENTI) at any time, switch notifications off in Settings, or remove your number. Reply START to receive messages again. One-time codes for sign-in are sent only when you request them.
• Support: when you message us, an AI assistant may answer first using our help articles; you can ask for a person and our staff may take over. Messages are processed by Meta as our WhatsApp provider.

Support conversations and contacts are deleted after 12 months without activity; delivery records after 90 days; one-time codes shortly after they expire.

Speech is transcribed on our own servers. To produce translations, clip suggestions, captions, titles, descriptions, suggested replies and assistant answers, we send the needed text (such as transcripts, your prompts, or a message you are answering) to an AI model provider listed under Subprocessors, only to produce that output for you.

We don’t use your content, or data from Google, YouTube, Meta, TikTok, X, LinkedIn or WhatsApp, to train or improve AI models, and we don’t allow AI providers to do so on our behalf. LinkedIn data is never sent to AI providers.

We share personal data only with the service providers below, which process it for us under their terms and only to run the Service, with the platforms you connect when you ask us to, or when the law requires it.

• Hosting: Tencent Cloud — the virtual private server (VPS) that runs our application, databases and caches.
• Object storage: Tencent Cloud Object Storage (COS), and Cloudflare R2 where used — video and project files.
• Network and security: Cloudflare — DNS, content delivery, protection against attacks, and Turnstile bot checks.
• Email: Brevo — account, security and service emails.
• Payments: Stripe (cards) and Midtrans (Indonesian payment methods).
• WhatsApp: Meta Platforms (WhatsApp Business Platform) — WhatsApp messages and support.
• AI model provider: DeepSeek — text processing for the AI features, with processing in the People’s Republic of China. We may add other AI providers; if we do, we will update this list first.
• Sign-in and connected platforms: Google, Meta, TikTok, X and LinkedIn — when you sign in with them or publish to them.
• Legal reasons: authorities or others when required by law, or to protect rights, safety and the Service.

If PT Sieka Digital Nusantara is merged or acquired, personal data may transfer to the new owner under this policy, and we will tell you first.

Some of the providers above process data outside Indonesia. In particular, text sent to our AI provider, DeepSeek, is processed in the People’s Republic of China, and Cloudflare and the connected platforms may process data in other countries, including the United States. Under UU PDP (Article 56) we transfer personal data abroad only to providers that offer an equal or higher level of protection, or under appropriate safeguards such as their data processing terms, or with your consent. Where the destination country’s protection is not equal to Indonesia’s, as may be the case for China, we send only the text needed for the feature you use, never your account details, tokens or LinkedIn data, and we ask for your consent where the law requires it.

• Account data: while your account exists, then deleted, except what we must keep by law.
• Projects (videos, clips and everything made from them): while they fit in your storage — on the Free plan for 7 days after they are created. When you are over your storage limit for 14 days, your oldest projects are deleted automatically until you fit again (projects used by a scheduled post are kept). Also deleted when you delete them.
• Connected-account tokens and data: until you disconnect the account, or within 30 days after you revoke access on the platform.
• Analytics: cached only (15 minutes to 6 hours), never stored permanently.
• Inbox and automation data: until you delete it, disconnect the account or delete your account.
• WhatsApp: see WhatsApp.
• Payment records: as long as Indonesian tax and accounting laws require.
• Logs: for a limited time for security and troubleshooting.

You can delete your data in any of these ways:

• In Vidcli: delete projects in the app, disconnect social accounts in Schedule → Accounts (this deletes their tokens, details and inbox data), and remove your WhatsApp number in Settings.
• Facebook, Instagram or Threads (automatic): remove Vidcli in your Facebook settings under Apps and websites (or in Instagram / Threads settings) and choose to send a deletion request. Meta then calls our Data Deletion Callback at https://vidcli.online/api/meta/data-deletion. We delete your Meta sign-in link and all Facebook, Instagram and Threads accounts connected with it, including their tokens and cached data, and give you a confirmation code. You can check the status at https://vidcli.online/data-deletion?code=your-code.
• Google / YouTube: revoke access at https://security.google.com/settings/security/permissions; we delete the stored YouTube data within 30 days.
• By email (manual): send a request from the email address of your account to [email protected] with the subject “Data deletion request”, saying whether you want your whole account or specific data deleted. We confirm your identity and complete the deletion promptly, at the latest within 7 days.

Deleting your Vidcli account removes your content, connected-account tokens, inbox data and scheduled posts. Records we must keep by law (such as invoices) are kept for the required period only. Content you already published on a platform stays there until you delete it on that platform.

Under UU PDP you have the right to:

• get information about how your data is processed;
• access your data and get a copy of it;
• correct inaccurate or incomplete data;
• have your data deleted or its processing ended;
• withdraw consent you gave;
• object to decisions based solely on automated processing;
• restrict or postpone processing;
• receive your data in a commonly used format or have it sent to another controller;
• complain to the authority responsible for personal data protection and claim compensation for violations, as provided by law.

You can do much of this yourself in Settings. For anything else, email [email protected] from your account’s email address. We may need to confirm your identity. We respond within the time limits set by UU PDP: requests for access, correction, stopping processing after you withdraw consent, and restriction are handled within 3 × 24 hours of a verified request.

We protect your data with encrypted connections (HTTPS/TLS), passwords stored as secure hashes, social account tokens and provider secrets encrypted at rest (AES-256-GCM), private object storage, optional two-factor authentication (authenticator app, email or WhatsApp codes) with recovery codes, role-based staff access with audit logs, and sign-in protection against bots. No system is perfectly secure.

If a personal data breach occurs, we will notify affected users and the authority responsible for personal data protection in writing within 3 × 24 hours, as UU PDP (Article 46) requires, stating what data was involved, when and how it happened, and what we are doing about it. We will also notify the platforms concerned where their terms require it.

We use only cookies and browser storage needed to run the Service:

• a sign-in session cookie (secure, HTTP-only);
• a short-lived cookie that protects third-party sign-in from forgery;
• a language preference cookie;
• local storage for interface preferences (such as a collapsed sidebar or a dismissed notice);
• Cloudflare cookies and Turnstile checks used for security.

We don’t use advertising or third-party tracking cookies. You can block or delete cookies in your browser, but signing in won’t work without the session cookie.

The Service is not meant for children under 13, or under the minimum age set by your country or the platforms you connect, and we don’t knowingly collect their data. Users under 18 need the consent of a parent or guardian, as UU PDP (Article 25) requires. If you believe a child has given us personal data, email [email protected] and we will delete it.

We may update this policy. We will show the new “Last updated” date here and tell you in the app or by email about important changes before they apply. If a change needs your consent (for example a new use of platform data), we will ask for it.

PT Sieka Digital Nusantara, Kagokan RT 001 RW 002, Kemudo, Prambanan, Kab. Klaten, Jawa Tengah 57454, Indonesia. For privacy questions, data requests or complaints, email [email protected].