Who we are
This Privacy Policy is from PT Almeli Labs Indonesia (brand: Almeli Labs, "Almeli", "we"). It explains what personal data we collect, why, who sees it, and what you can do about it.
- Email: almeli.labs@gmail.com
- WhatsApp: +62 851-1030-0113
- Address: Jl. E2 Raya Gg. NN, RT 002/RW 008, Bintara Jaya, Kec. Bekasi Barat, Kota Bekasi, Jawa Barat 17136, Indonesia
What this policy covers
It covers our website (https://www.almeli.ai.id), the Almeli account (one sign-in for all products), Almeli Console (subscriptions, invoices and payments), and our products Melichat, Melidoc, Melibrain, Melikas and Poseli.
We play two roles. For our own website, accounts and billing, we decide how the data is used (we are the controller). For the data a business puts into our products about its own customers, the business decides and we only process it for them (we are the processor).
Data we collect as controller
- Account data: name, email, password (stored only as a hash), your organization and role.
- Billing data: invoices, billing profile such as company name and tax ID if you give it, and payment status. Card and virtual account details are handled by the payment provider and are not stored by Almeli.
- Contact form: name, email, phone and your message.
- Support conversations with us.
- Technical logs: IP address, browser, pages visited and errors, used for security and to keep the service running.
Data we process for business customers
When a business uses our products, it puts data about its own customers and documents into them. In that case the business is the controller and Almeli is the processor. We use this data only to provide the service to that business.
- Melichat: conversations with the business's customers, including name, phone number or account id on the channel, messages, photos, orders, shipping address and payment status.
- Melidoc: uploaded documents and the fields read from them. These can include KTP data.
- Melibrain: uploaded files used as the knowledge base.
- Melikas: menus, orders, and buyer names typed when ordering.
- Poseli: the posts a business writes (text, photos, videos, video titles), their schedule, and the social accounts it connects.
Meta platform data (WhatsApp, Instagram, Messenger)
A business can connect its WhatsApp Business Platform, Instagram or Facebook Messenger account to Melichat through Almeli's Meta app. When it does, we receive the account, page and phone number ids, access tokens (stored encrypted), and the messages its customers send to that business, together with the sender's profile name and id.
We use it only to show the conversation in Melichat, let the business reply, run the business's bot, and keep the connection working.
- We do not sell this data.
- We do not use it for advertising or to build profiles of people.
- We share it only with the service providers listed below that are needed to run the feature.
- It is deleted when the business disconnects the channel, or on request.
- A Facebook user can also remove the app in Facebook Settings, Apps and Websites. Facebook then sends us a deletion request automatically. See the Data Deletion page for how this works.
Our use of this data complies with the Meta Platform Terms and the WhatsApp Business policies.
Social accounts connected to Poseli
A business can connect its Facebook Pages, Instagram business accounts, Threads, LinkedIn, X, TikTok, YouTube, Telegram, Bluesky or Mastodon accounts to Poseli, by signing in on that platform through Almeli's app. Only an owner or admin of the business's workspace can do this.
What we receive and keep
- The account, page or channel id, its name and profile picture.
- The access and refresh tokens the platform issues, encrypted at rest (AES-256-GCM), and when they expire.
- For Facebook and Threads, a one-way hash of the user id, used only to answer Meta's data deletion requests.
- For Bluesky, the app password is used once to sign in and is not stored.
- For each post: whether it went out, the link to the live post, and the error the platform returned if it failed.
How we use it
Only to publish the posts the business writes and schedules, to the accounts it chose, at the time it chose; to show the business which accounts are connected and how each post went; and to keep the connection working. Poseli does not read feeds, messages, followers, comments or statistics from these accounts.
- We do not sell this data, use it for advertising, or build profiles of people.
- Photos for a post are reachable through a long random link, so that platforms such as Meta and TikTok can fetch them when the post goes out. Videos are uploaded to the platform directly.
- A photo or video no post uses is deleted after a day, and one whose post went out is deleted 30 days later. The post on the platform stays; that is under the business's control there.
- When the business removes an account in Poseli, its tokens are deleted and its scheduled posts are not sent.
Platform terms
- Poseli uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (https://policies.google.com/privacy) applies.
- Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Our use of data from Meta, TikTok, LinkedIn and X follows the Meta Platform Terms, the TikTok Developer Terms, the LinkedIn API Terms and the X Developer Agreement.
Taking access back on the platform
- Facebook, Instagram and Threads: Facebook Settings, Apps and Websites, remove the Almeli app. Meta then sends us a deletion request and we remove the accounts.
- YouTube: Google Account, Security, Third-party apps with account access (https://myaccount.google.com/permissions).
- TikTok: Settings and privacy, Security, Manage app permissions.
- LinkedIn: Settings, Data privacy, Permitted services.
- X: Settings, Security and account access, Apps and sessions, Connected apps.
- Bluesky: delete the app password in Settings, Privacy and security, App passwords. Mastodon: Preferences, Account, Authorized apps. Telegram: remove the Almeli bot from the channel or group.
After access is taken back, Poseli can no longer post to that account and marks it to be connected again. You can also ask us to delete the data, as described on the Data Deletion page.
AI features
When a business turns on AI replies, or uses Melidoc or Melibrain, the relevant text is sent to an AI model provider chosen by Almeli to produce the answer. The providers we support are Anthropic, OpenAI, and models routed through OpenRouter.
Where available, we choose providers and options that do not keep the data for training. Almeli does not use customer content to train its own models.
Service providers
We use the following kinds of providers to run the service. They receive only what they need for their part.
- Server and cloud hosting.
- Email delivery (SMTP).
- Paywuz, our payment processor for subscriptions.
- Midtrans or Xendit, only through the store's own account in Melikas.
- Komerce and RajaOngkir, for shipping rates and tracking.
- AI model providers named above.
- Meta, Telegram, Shopee, TikTok Shop and Lazada, only for the channels a business connects.
- Meta, LinkedIn, X, TikTok, Google (YouTube), Telegram, Bluesky and the chosen Mastodon server, only for the accounts a business connects to Poseli and the posts it sends there.
- Google Analytics and Google Tag Manager, on the website.
- Cal.com, when you book a demo.
How we protect data
- Traffic uses HTTPS.
- Secrets, channel tokens and social account tokens are encrypted at rest (AES-256-GCM).
- Data is separated per organization.
- Access is limited by role, and admin actions are logged.
No system is perfectly safe. If you think your account is at risk, write to us right away.
How long we keep data
- Account data: while the account exists.
- Product data: for the retention period of the plan, or until the business deletes it.
- Invoices and tax records: as long as Indonesian tax law requires.
- Logs: for a limited time, for security.
Your rights
Under the Personal Data Protection Law (UU PDP) you can ask to:
- see the data we hold about you,
- correct it,
- delete it,
- withdraw your consent,
- object to how it is processed,
- receive it in a portable format where this applies,
- and complain to the data protection authority.
To use these rights, write to the contact above. If you are a customer of a business that uses our products, contact that business first. We help the business respond to you.
To delete data connected to Meta channels, see the Data Deletion page.
Changes to this policy
When we change this policy, we post the new version here and update the date at the top.
Contact
- Email: almeli.labs@gmail.com
- WhatsApp: +62 851-1030-0113
- Address: Jl. E2 Raya Gg. NN, RT 002/RW 008, Bintara Jaya, Kec. Bekasi Barat, Kota Bekasi, Jawa Barat 17136, Indonesia
This document follows Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi).