Privacy Policy

In effect since 14 August 2026

WACO is a service operated by PT Cloud Hosting Indonesia. This document explains what data we handle, what for, and what we do not do with it.

Language. This is an English translation provided for convenience. The Indonesian version of this document remains the legally binding text; if the two differ, the Indonesian version prevails. Read it at waco.id/syarat and waco.id/kebijakan-privasi.

Two roles worth separating. For your account data (name, email, number, billing) we are the Data Controller. For the content of conversations with your customers we are only a Data Processor — you own it, we store and forward it on your instruction. We do not use it for our own purposes.

Data we collect

Category	Content	Basis
Account	Name, business name, email, WhatsApp number, password (stored as an scrypt hash — it cannot be read back)	Performance of the agreement
Payment	Billing history, virtual account numbers, transaction status. We never receive or store card numbers — those stay with the payment provider.	Legal obligation & agreement
Conversations	Incoming and outgoing messages between you and your customers, including WhatsApp profile names and attachments	Your instruction as controller
Contacts	Lists you import yourself (number, name, extra fields)	Your instruction
Technical	IP address, access times, browser type, error logs	Legitimate interest: security & diagnostics

Sensitive data

Some of our customers are clinics and schools, so conversations may contain health data or data about children — specific categories under Indonesia's Personal Data Protection Law (Law 27/2022). We treat them under the same rules: we do not read them for our own purposes, we do not analyse them for profiling, and we do not sell them to anyone. The obligation to obtain consent from the people whose data you send remains yours as the controller.

Who can see your conversations

You and the staff you invite.
Meta Platforms, because messages travel over the WhatsApp Business Platform. Their privacy policy applies as well.
Our team, only when you ask for technical help and only as far as needed to resolve that problem. Such access is logged.

We do not sell your data, do not trade it with third parties for advertising, and do not use the content of your conversations to train any AI model.

Where it is stored

Data is stored on IDCloudHost infrastructure in Indonesia. Some supporting services sit abroad: Meta (WhatsApp delivery) and Amazon SES Singapore (emails such as password resets and billing reminders).

How long we keep it

Conversations & contacts — for as long as your account is active, plus 30 days after closure in case the closure was unintended.
Billing records — 10 years, following bookkeeping obligations.
Technical logs — 90 days at most.
Verification codes (OTP) — stored only as hashes, and deleted once expired.

Your rights

Under the Indonesian PDP Law you may request a copy of your data, correct it, delete it, or withdraw consent. Send your request to waco@idcloudhost.com from your account email address; we respond within 14 working days. Some data is retained where the law requires it, and we will say so when that happens.

Security

All traffic uses HTTPS.
Your WhatsApp credentials are stored encrypted (AES-256-GCM), never as plain text.
Passwords are stored as scrypt hashes — we cannot read them ourselves.
Every paying customer gets a separate conversation workspace, not a shared one.

If a data breach occurs that puts you at risk, we notify you and the authorities within the applicable deadlines.

Changes

If this policy changes materially, we notify you by email to your account address before the change takes effect.

Contacting us

PT Cloud Hosting Indonesia · waco@idcloudhost.com