Privacy Policy

WhatsAppForm.id is an online form builder operated by PT Rintis Chat Indonesia ("Rintis", "we", "us"). It lets businesses create forms whose responses are saved to a dashboard and sent to the business on WhatsApp.

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit whatsappform.id, sign in to the dashboard, or fill in a form published on whatsappform.id.

This policy is written with reference to Indonesia's Law No. 27 of 2022 on Personal Data Protection (the "PDP Law") and its implementing regulations.

WhatsAppForm.id has two kinds of users, and our role differs for each:

• Form owners: people or businesses who sign in and create forms. For form owner account data, Rintis is the data controller.
• Respondents: people who fill in a form. For response data, the form owner is the data controller, and Rintis is a data processor that stores and processes the data on the owner's instructions.

If you filled in a form and have questions about your answers, please contact the business that published it first. We will help the form owner handle your request.

Form owner data

• Google account data when you sign in with Google: your name, email address, profile photo, and Google account ID, under the email and profile scopes. We don't access your contacts, Gmail, calendar, or Google Drive.
• The WhatsApp number you enter to receive responses for each form.
• Form content: questions, settings, custom links, and the search preview title, description, and image you add.
• Tags you add to responses to organise them.
• Billing data: your plan, payment period, invoices, and payment status. Payments are processed by our payment gateway; we don't receive or store your full card or bank account details. We share the phone number the gateway requires to create a payment.

Respondent data (collected on the form owner's behalf)

• The answers you type into the form. What is asked is decided by the form owner and may include your name, WhatsApp number, email address, address, and order, booking, or registration details.
• When you submitted, and earlier responses sent from the same WhatsApp number to the same form, which the owner sees as history.

Technical data

• IP address, browser and device type, pages visited, access times, and server logs.
• Cookies and local storage, described in the Cookies section below.

When a respondent submits a form, the answers are saved to the form owner's dashboard. WhatsApp then opens with the answers pre-filled in a message to the form owner's WhatsApp number. The respondent decides whether to send that message.

Once a message is sent, it travels through WhatsApp, which is operated by WhatsApp LLC (part of Meta) and covered by WhatsApp's own privacy policy. We don't read WhatsApp chats and don't access anyone's WhatsApp account.

• To provide WhatsAppForm.id: signing you in, publishing your forms, saving responses, and showing them to the form owner.
• To process payments, issue invoices, and apply your plan's features and limits.
• To prevent abuse, such as spam submissions, phishing forms, or unauthorised access.
• To provide support and send important notices about your account or the service.
• To understand how the site is used and improve it, using analytics and aggregated data.
• To comply with legal and tax obligations and lawful requests from authorities.

We don't sell personal data and don't use it for third-party advertising.

We only share personal data in these situations:

• With the form owner: responses are visible only to the owner of the form they were sent to, never to other users.
• With service providers that help us run the service, such as hosting and infrastructure providers, Google (sign-in and Google Analytics), and our payment gateway. They may only process data on our instructions and are bound by confidentiality obligations.
• When required by law, a court order, or a lawful request from an authority.
• As part of a merger, acquisition, or business transfer, with data protection maintained in line with this policy.

Forms themselves are public pages that anyone with the link can open, and a form owner can choose to let search engines list a form. Responses are never public.

• Form owner account data is kept while the account is active.
• Responses are kept until the form owner deletes them or the form, or the account is closed.
• On the Free plan, responses beyond the 5 newest per form are kept but hidden from the dashboard. They become visible again if the owner upgrades.
• After an account is closed, we delete or anonymise its data within a reasonable period, except data we must keep by law, such as invoice and tax records.

We use reasonable technical and organisational measures to protect data, including encrypted connections (HTTPS), access controls, and limiting access to the people who need it to run the service.

No system is completely secure. If a personal data protection failure affects you, we will notify you and the relevant authority as required by the PDP Law.

Some of our service providers, such as Google, may store or process data outside Indonesia. When that happens, we make sure an equivalent or adequate level of protection is in place as required by the PDP Law.

Under the PDP Law, you have the right to:

• Be informed about how your personal data is processed.
• Access and get a copy of your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data.
• Withdraw consent you have given.
• Object to processing for marketing purposes.

Form owners can edit or delete their forms and responses from the dashboard. For anything else, contact us using the details below. We may ask you to verify your identity first, and we will respond within the timeframe required by applicable regulations.

Form owner accounts are for people aged 18 or older, or who otherwise have legal capacity. Respondents under 18 should fill in forms with a parent's or guardian's consent. If we learn that a child's data was collected without valid consent, we will delete it.

• A sign-in cookie that keeps you logged in to the dashboard for up to 30 days.
• Local storage in your browser that remembers which responses you have already seen.
• Google Analytics cookies that tell us how visitors use the site, such as which pages are visited. We don't use advertising cookies.

You can block or delete cookies in your browser settings. The dashboard won't keep you signed in without the sign-in cookie.

We may update this Privacy Policy from time to time. The date of the last update is shown at the top of this page. For material changes, we will notify form owners in the dashboard or by email before the changes take effect.

For questions about this document or your data, contact us at: