Platform privacy policy

The operator of the B2B Indonesia platform at b2b.co.id is the controller of personal data for the account, the organization, platform billing, and data you store in modules we operate.

For privacy correspondence, use the support address at the end of this page. Do not send passwords or one-time codes by email.

This policy covers b2b.co.id, registration and sign-in (including Google), the Web Builder dashboard at builder.b2b.co.id, and Omnichannel at omni.b2b.co.id when that portal is available to you.

Sites you publish for your own customers run on our hosting, but those visitors are your relationship with them. If a client site collects its own visitor data, you are the controller of that collection and you must publish a privacy notice on that site.

Marketplace and Invoice, while they are not open, do not process transaction data for those modules. When they open, this policy remains the account baseline, and an additional notice will describe data that is specific to the new module.

Account data: name, email address, phone number if you provide one, password stored as a hash (not the original text), email verification status, and the Google identifier if you link Google.

Organization data: organization name, slug, member roles, and the list of active modules (Web Builder, Omnichannel, and other modules when they are activated).

Billing data: invoice identity, amount, payment status, time, the payment channel reported by the partner, and the module purchased. Full card numbers and one-time bank codes are not stored by us.

Web Builder data: site content you compose, uploaded files, domain names, DNS notes, mailbox addresses, and hosting or email provisioning logs.

Omnichannel data, when you use that module: contacts, notes, pipeline, messages from channels you connect, and channel credentials you paste so the connection can run.

Technical data: IP address, browser type, request time, security records, and traffic-limit records. These are used to keep the service up and to investigate abuse.

When you press the Google button, the browser loads Google’s service and Google shows an account chooser. After you agree, Google sends an identity token to our site. From that token we take the email, whether Google has verified the email, the display name, and the Google subject identifier.

The subject identifier is stored so the next visit is recognized as the same user. The email is used to match an account that already exists. If the email is already registered, the account is not duplicated. Google is only linked. If no account exists, a new one is created and marked verified immediately.

We do not ask for permission to read Gmail, Google Drive, or your Google contacts. This sign-in is account identity only. You can revoke the app from your Google account security settings. Revoking it at Google stops Google sign-in. Data already stored at B2B remains until you ask for deletion or close the account, unless the law requires us to keep it.

Processing on Google’s side is covered by Google’s privacy policy. We only receive the fields named above.

To create and maintain the account and organization, to decide which modules you may open, and to restore a signed-in session.

To provide Web Builder: publish the site, install SSL after DNS is valid, create mailboxes, and show package invoices.

To provide Omnichannel when you activate it: store CRM and carry messages for the channels you connect.

To process payment, reduce fraud, send one-time codes and service notices, and answer support requests.

To keep the service secure: limit sign-in attempts, record an audit of important actions, and handle incidents.

We do not sell personal data. We do not use Omnichannel contact lists or your site content for third-party advertising.

Most processing is required to perform the service contract. Without an email, a name, and organization data, the account and its modules cannot run.

Our legitimate interests cover account security, abuse prevention, and billing records. Google sign-in is processed because you asked for that sign-in method.

If a later feature needs a separate consent, we will ask for it clearly, and you can withdraw it without closing the whole account, as far as that feature is not required for a service you still pay for.

We follow Indonesian Law No. 27 of 2022 on Personal Data Protection and its implementing rules, where they apply to this processing.

The payment partner receives what their hosted page needs to charge you: amount, reference, and payer details that page asks for. They return the payment status to us.

Google receives the sign-in request from your browser when you choose Google. We do not send your B2B password to Google.

The registrar receives domain registrant data only if you buy or renew a domain through us.

Hosting, email, and file storage infrastructure is operated to run the service. Uploads may be stored in object storage. Public site traffic may pass through a distribution network that protects the domain.

Meta and WhatsApp process official-channel data under the Meta account you own, because those credentials and that channel’s policy are yours. For a linked-device channel, messages travel through the session you paired.

Internal staff who handle support or operations may see data only as far as needed to complete your request, under role limits.

We may disclose data when the law, a formal authority request, or the protection of other users from ongoing abuse requires it.

A session cookie keeps you signed in so you do not type a password on every page. This cookie is required for the dashboard.

The interface language choice is stored in your browser. There is no third-party advertising cookie on the account sign-in page or the dashboard.

You can delete cookies in the browser. Deleting the session cookie signs you out.

Account data is stored in the production database with limited access. Passwords are stored as hashes. Traffic between your browser and the site uses HTTPS.

Channel credentials and service keys are treated as secrets. Do not paste those keys into a ticket other people can read, and do not share your password with anyone who claims to be support.

No storage method is free of risk. We keep access controls, watch for abuse, and follow up on incidents that affect personal data.

Account data is kept while the account is active. Billing data and records required for accounting or tax are kept for the period the law requires, even if you close the account.

Site content and module CRM data are deleted or anonymized after the account or module is closed, following the deletion queue and the backup cycle. Backup copies can remain until that cycle overwrites them.

Security logs are kept while they are still needed to investigate an incident and prevent a repeat, then deleted or trimmed.

You may ask for access to and correction of account data. The name can be changed in account settings. Email is changed through a verification flow, and changing the email disconnects Google.

You may ask for the account to be deleted. We may refuse or delay the part we still have to keep because of an invoice, a dispute, or a legal order.

You may stop using Google sign-in by disconnecting it in account settings or in Google’s security settings, as long as the account still has a password so you are not locked out.

To use these rights, email us from the address registered on the account, describe the request, and name the module involved. We may ask you to confirm that the requester owns the account.

If you believe processing breaks data-protection law, you may complain to the competent authority in Indonesia.

This service is for businesses, not for children under 18. We do not knowingly collect children’s data. If you learn of a child’s account, tell us so it can be closed.

Changes are published on this page with a new effective date. If a material change affects how we use account data, we notify the account email while it is still active.