1. Principles & Legal Foundation of Data Protection

Qirim is committed to protecting and respecting the privacy rights of every user. This Privacy Policy outlines how we collect, process, store, and safeguard your personal data in accordance with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (PDP Law) and applicable electronic transaction regulations.

2. Categories of Collected Personal Data

In operating the WhatsApp Gateway service, the data we process is limited to legitimate operational requirements:

• Registration & Identity Data: Full name, email address, verified WhatsApp phone number, and password protected with strong one-way cryptographic hashing.
• Business & Store Profile Data: Business name, tagline, description, bank account details for payment notifications, and Knowledge Base materials voluntarily uploaded to train customer service chatbots.
• WhatsApp Gateway Session Data: WhatsApp Web session authentication tokens (multi-device credentials) stored in isolated, secure server directories to enable automated message transmission.
• Transaction & Delivery Logs: Dispatch timestamps, recipient numbers, delivery status (sent, delivered, read, failed), and media attachment file sizes for your analytics reports.
• Access & Session Logs: IP address, estimated geolocation (city, region, country), ISP name, device type, operating system, web browser, login timestamps, and active session duration recorded automatically upon accessing the system.

3. WhatsApp Account Security, Anti-Hijack & Session Privacy

We understand that your WhatsApp number is a vital business and personal asset. Here is our technical approach and operational standard regarding your WhatsApp account security:

• Account Scope Limitation (No Takeover): Qirim connects via official WhatsApp Multi-Device protocols (similar to WhatsApp Web). Qirim possesses neither access nor technical ability to change phone numbers, 2FA PINs, or take over account ownership. Primary control always resides in your physical smartphone.
• Service Transmission Focus (No Personal Chat Snooping): Qirim staff and system administrators do not read, monitor, download, or intercept personal or family chats. Messages are processed with industry-grade encryption and the system acts purely as a transport relay for official messages sent via API, broadcast, or your CS bot.
• Instant Revocation from Phone: You can instantly revoke permissions and disconnect Qirim at any time directly from the WhatsApp app on your smartphone under Settings > Linked Devices > Log Out. The session is destroyed immediately.
• Session Isolation & Key Encryption: Session authentication keys are stored in sandboxed per-user directories with restricted file permissions to prevent unauthorized access or inter-tenant leakage.

4. Purpose of Data Processing

• Provide, maintain, and optimize multi-device WhatsApp gateway functionality, broadcast queues, and REST API webhooks.
• Process AI-powered chatbot auto-replies based on your configured business parameters.
• Send system security alerts, 2FA one-time passwords (OTP), and billing invoice confirmations.
• Monitor server infrastructure health (watchdog auto-heal) and detect unlawful suspicious activities.

5. Access & Session Logging Transparency

To uphold technical integrity and prevent unauthorized intrusions, our platform maintains automated session audit records. Here is why and how this data is utilized:

• Anomaly & Cyber Attack Detection: Logging IP addresses and browser signatures allows detection of brute force attacks, session token theft, or suspicious simultaneous logins from disparate geographic regions.
• Illegal Session Termination & Single Session Protection: Active session tracking empowers the system to enforce Single Active Session Mode and allows account owners to terminate unrecognized login sessions in real-time.
• Electronic System Provider Audit Compliance: Maintaining system access audit trails is a regulatory obligation under PDP Law and electronic system governance frameworks for digital forensic readiness.
• Scheduled Retention & History Pruning: Expired or terminated session logs are automatically purged in accordance with data minimization principles.

6. User Rights (Data Subject) Under Data Protection Laws

In compliance with applicable Personal Data Protection Laws, users possess the following legal rights:

• Right of Access & Update: Access, review, and update your identity and business data independently via Profile Settings.
• Right to Erasure (Deletion): Request permanent deletion of your account, message history, contacts, and WhatsApp session credentials from our servers.
• Right to Data Portability: Export your contacts and message logs in standard CSV/JSON format at any time.
• Right to Revoke Consent: Instantly unpair your WhatsApp device session or regenerate/delete your API key from the dashboard.

7. Security Measures & Data Retention

We implement industry-grade technical and organizational measures to safeguard data against loss, unauthorized access, or illegal disclosure: SSL/TLS 256-bit encrypted transmission, strict rate limiting, database injection protection, and isolated multi-tenant session storage. Data log records are retained periodically for analytics and securely archived or rotated. For inquiries or data protection requests, contact our Data Protection Officer at: hello@outlook.co.id.