Privacy Policy

We collect the following types of information when you use our platform:

• Account Information: name, email address, phone number, company name, and billing details provided during registration.
• Customer Conversation Data: messages, media, and metadata from conversations handled through our platform across WhatsApp, Instagram, Messenger, and other connected channels.
• Usage Data: information about how you interact with our platform, including features used, pages visited, and actions taken.
• Device and Technical Data: IP address, browser type, operating system, device identifiers, and access timestamps.
• Integration Data: information from third-party services you connect to Custive, such as payment providers, CRM systems, and spreadsheets.
• AI Training Data: anonymized and aggregated interaction patterns used to improve our AI models. We do not use your raw customer conversations to train AI models shared with other clients.

We use collected information for the following purposes:

• To provide, operate, and maintain our platform and services.
• To process AI-powered automated responses and intent-based workflow actions on your behalf.
• To manage your account, process payments, and communicate with you about your subscription.
• To analyze usage patterns and improve our platform's performance, features, and user experience.
• To provide customer support and respond to your inquiries.
• To detect, prevent, and address technical issues, fraud, or security threats.
• To comply with legal obligations and enforce our terms of service.

We do not sell your personal data. We may share your information in the following circumstances:

• Service Providers: with trusted third-party vendors who assist in operating our platform (e.g., cloud hosting, payment processing, messaging APIs) under strict confidentiality agreements.
• Channel Partners: with messaging platform providers (WhatsApp, Meta) as required to deliver messages through their APIs.
• Legal Requirements: when required by law, regulation, legal process, or governmental request.
• Business Transfers: in connection with a merger, acquisition, or sale of assets, with prior notice to affected users.
• With Your Consent: when you have given explicit permission to share information with a specific third party.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL) and at rest, access controls, regular security audits, and multi-tenant data isolation. While we strive to use commercially acceptable means to protect your personal information, no method of electronic transmission or storage is 100% secure.

We retain your data for as long as your account is active or as needed to provide services. Conversation data is retained according to your plan's retention settings. Upon account termination, we will delete or anonymize your data within 90 days, unless required by law to retain it longer. You may request earlier deletion by contacting us.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access and receive a copy of your personal data.
• Right to rectify inaccurate or incomplete personal data.
• Right to request deletion of your personal data.
• Right to restrict or object to processing of your personal data.
• Right to data portability (receiving your data in a structured, machine-readable format).
• Right to withdraw consent at any time where processing is based on consent.

We use cookies and similar technologies to enhance your experience, analyze usage, and deliver relevant content. Essential cookies are required for platform functionality. Analytics cookies help us understand usage patterns. You can control cookie preferences through your browser settings, though disabling certain cookies may affect platform functionality.

Our platform integrates with third-party services (payment providers, messaging platforms, analytics tools). These services have their own privacy policies, and we encourage you to review them. We are not responsible for the privacy practices of third-party services.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal data from a child, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use of the platform after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at: PT Arah Baru Global, Jl. KH Mas Mansyur No. 47 Blok C-D, Kebon Melati, Tanah Abang, Jakarta Pusat, DKI Jakarta. Email: gafi@shyft.id