Privacy Policy

About Larisi & Data Controller Identity

Larisi ("we", "our", "the platform", or "the service") is an AI-powered digital advertising management platform designed to help local businesses and SMEs (Small and Medium Enterprises) in Indonesia create, publish, and optimize advertising campaigns across multiple social media channels from a single dashboard.

Larisi is developed and operated by:

• Operator Name: PT Kayuwangi Jagadhita Inovasi
• KEPMENHUM RI: AHU-A089433.AH.01.30.Tahun 2026
• Business Classification (KBLI): 62090 — Information Technology Activities and Other Computer Services
• Registered Address: Jl. Tiwir VII Sumbersari, Moyudan, Sleman, Daerah Istimewa Yogyakarta 55563, Indonesia
• Contact Email: halo@larisi.id
• Website: https://larisi.id

Scope of This Privacy Policy

This Privacy Policy applies to all individuals and businesses ("users", "you") who access or use the Larisi platform through https://larisi.id or any associated applications, including but not limited to:

• The Larisi web dashboard and all its features
• AI Vision & Master Persona Scan functionality
• Smart Geo Stitching technology
• AI Caption Generator
• Geo-Radar Targeting system
• Multi-Channel Publishing to Instagram, TikTok, YouTube, and Meta Feed
• Analytics and campaign monitoring features

By registering for or using Larisi, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, please discontinue use of the service.

Data We Collect

3.1 Account & Identity Data

• Full name of the business owner
• Business name and category
• City or regency of business location
• WhatsApp number (primary communication channel)
• Email address (if provided)

3.2 Business Location Data

• Geographic coordinates of the business location explicitly selected by the user on the dashboard map
• Target radius configured by the user for each campaign

3.3 Creative Content

• Photos and videos uploaded by the user for AI processing
• AI-generated caption text and geo-stitched text overlays
• User-edited versions of AI-generated content

3.4 Master Business Persona

• AI-derived business profile based on analysis of uploaded content, including: detected business category, visual mood, communication tone, and audience segmentation preferences
• This persona data is stored to improve the relevance of future AI generations for the same user

3.5 Third-Party Platform Data (via OAuth)

• OAuth access tokens from Meta (Facebook/Instagram), TikTok, and Google (YouTube) — provided voluntarily by the user through each platform's official authorization flow
• Business account identifiers: Page IDs, Ad Account IDs, Instagram Business Account IDs
• Campaign performance data returned by platforms after campaigns run: reach, impressions, engagement metrics, spend data

3.6 Usage & Technical Data

• Activity logs: login events, campaign launches, AI generation usage count
• Campaign analytics: reach, engagement, budget distribution across channels
• Technical information: device type, browser type, access timestamps (for security and debugging purposes only)

How We Use Your Data

• To operate the AI Vision feature — analyzing uploaded content to build the user's master business persona
• To generate Smart Geo Stitching text and per-platform captions based on the combination of business persona, location target, and audience segment
• To operate the Geo-Radar Targeting system and compute real-time audience reach estimates
• To publish content to the platforms selected by the user (Instagram, TikTok, YouTube, Meta Feed) on behalf of and with explicit authorization from the user's business account
• To manage and optimize paid advertising campaigns (boost) as instructed by the user within the dashboard
• To display campaign performance analytics within the Larisi dashboard
• To contact users via WhatsApp for account activation, technical support, and relevant product updates
• To improve the quality and accuracy of Larisi's AI models using aggregated, anonymized usage patterns — without identifying individual users
• To comply with applicable legal obligations in the Republic of Indonesia

Legal Basis for Processing

Larisi processes personal data based on the following legal grounds under applicable Indonesian law (UU No. 27 Tahun 2022 on Personal Data Protection) and internationally recognized standards:

• Consent: You provide explicit consent at registration and when connecting third-party platform accounts via OAuth. You may withdraw consent at any time.
• Contract Performance: Processing is necessary to deliver the services you have requested and agreed to use.
• Legitimate Interests: Aggregate, anonymized service improvement analytics are conducted based on legitimate business interest, balanced against the privacy rights of users.
• Legal Obligation: Compliance with laws and regulations applicable in Indonesia, including UU PDP No. 27/2022 and UU ITE.

Third-Party Platform Integrations

Larisi integrates with the following platforms via their official APIs. Use of these integrations is subject to the respective platform's own terms and policies:

Meta Platform — Specific Disclosures

This section provides specific disclosures required by Meta Platform Terms for applications using the Meta Marketing API and Instagram Graph API.

7.1 Data Obtained from Meta

• Larisi accesses Meta data solely to provide advertising management services to the user who authorized access
• Data obtained from Meta (including Page data, Ad Account data, Instagram account data, and campaign performance metrics) is used only for the purposes disclosed in this policy
• Larisi does not use Meta Platform Data to make decisions that affect users' eligibility for credit, insurance, employment, or other similar purposes

7.2 Data Storage & Deletion

• Meta Platform Data is stored only as long as necessary to provide the service or as required by law
• OAuth access tokens are stored in encrypted form and are revocable by the user at any time through Meta's security settings
• Upon account deletion, all Meta-derived data is permanently deleted within 30 days
• Users can request immediate deletion of their data by contacting halo@larisi.id

7.3 User Consent Mechanism

• Larisi obtains explicit consent from users before accessing any Meta account or data
• Authorization is performed through Meta's official OAuth 2.0 flow — users are redirected to Meta's login page and explicitly grant permissions
• Larisi displays the exact permissions being requested before the user approves
• Users can revoke Larisi's access to their Meta account at any time via: Facebook Settings → Security & Login → Apps and Websites

7.4 Compliance with Meta Platform Terms

• Larisi does not sell, license, or purchase Meta Platform Data
• Larisi does not use Meta Platform Data to build targeting profiles for use outside Meta's platforms
• Larisi does not transfer Meta Platform Data to data brokers
• Larisi complies with Meta's Data Use Policy and Ads API Terms
• Larisi does not scrape or harvest data from Meta outside of approved API endpoints

TikTok API — Specific Disclosures

8.1 Data Obtained from TikTok

• Larisi accesses TikTok Marketing API solely to enable users to publish content and manage ad campaigns on behalf of their own TikTok Business accounts
• Ad performance data retrieved from TikTok is used exclusively to display analytics to the authorizing user within the Larisi dashboard
• Larisi does not access personal data of TikTok end-users (viewers or followers) — only business account and campaign data of the authorizing advertiser

8.2 Data Residency & Security

• TikTok API data processed by Larisi is stored on secured servers with encryption at rest and in transit
• Larisi complies with TikTok's data residency requirements for data obtained through the TikTok Marketing API

8.3 User Control

• Users can revoke Larisi's access to their TikTok Business account at any time through TikTok Business Center settings
• Upon revocation, Larisi will immediately cease accessing the user's TikTok data and will delete stored tokens within 7 days

8.4 Compliance

• Larisi complies with TikTok Marketing API Terms of Service and TikTok's Advertising Policies
• Larisi does not use TikTok data for purposes beyond those explicitly stated in this policy
• Larisi does not share TikTok-derived data with unauthorized third parties

Google / YouTube API — Specific Disclosures

Larisi uses YouTube API Services to enable users to publish video content to their YouTube channels. By using this feature, you also agree to be bound by the Google Privacy Policy.

9.1 Data Obtained from YouTube API

• Larisi accesses YouTube API Services only to upload video content on behalf of authorized users to their own YouTube channels
• Channel performance data (views, engagement) is retrieved only to display in the Larisi analytics dashboard for the authorizing user
• Larisi does not collect, store, or analyze data of YouTube end-users (viewers) — only the channel owner's content and performance data

9.2 Quota & Rate Limiting

• Larisi manages YouTube API quota responsibly and in accordance with YouTube API Services Terms of Service
• API calls are made only in response to explicit user actions within the dashboard

9.3 User Control & Revocation

• Users can revoke Larisi's access to their YouTube/Google account at any time via: Google Account → Security → Third-party apps with account access
• Alternatively, users can revoke access directly at: https://security.google.com/settings/security/permissions
• Upon revocation, Larisi will delete all stored YouTube OAuth tokens within 7 days

9.4 Compliance with YouTube API Terms

• Larisi's use of YouTube API Services complies with the YouTube API Services Terms of Service
• Larisi does not use YouTube API data for advertising targeting, data brokerage, or any purpose beyond publishing and analytics as described in this policy

Data Sharing & Disclosure

Larisi does not sell, rent, or trade personal data to any third party. Data is shared only in the following limited circumstances:

• Advertising Platforms (Meta, TikTok, Google/YouTube): Content, campaign data, and access tokens necessary to execute publishing and boosting operations — solely as directed by the user and with their explicit OAuth authorization
• Infrastructure Service Providers: Cloud hosting and server providers who process data on Larisi's behalf under Data Processing Agreements (DPAs) that prohibit using data for any purpose other than providing services to Larisi
• Legal Requirements: If required by applicable law, regulation, court order, or lawful request from government authorities in Indonesia
• Protection of Rights: If necessary to protect the rights, property, or safety of Larisi, our users, or others
• Business Transfers: In the event of a merger, acquisition, or sale of assets, users will be notified before personal data is transferred and becomes subject to a different privacy policy

Data Retention

Data Security

• All data transmissions use TLS 1.2 or higher encryption
• Data at rest is stored with AES-256 encryption
• OAuth tokens are stored in encrypted, isolated storage with strict access controls
• Access to user data is restricted to authorized personnel on a need-to-know basis
• Regular security assessments are conducted to identify and remediate vulnerabilities
• In the event of a data breach that may affect user rights, affected users will be notified within 72 hours of discovery

International Data Transfers

As Larisi integrates with Meta, TikTok, and Google (YouTube), some data may be processed on servers located outside Indonesia. These transfers occur as part of using the official APIs of these platforms and are subject to each platform's own privacy policies and data protection standards. Larisi ensures that any international data transfer involving data we directly control is protected by appropriate security measures including encryption and contractual data protection obligations with our infrastructure providers.

Your Rights

Under Indonesia's Personal Data Protection Law (UU No. 27/2022) and aligned with international standards, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your account and all associated personal data
• Right to Restriction: Request that we limit the processing of your data in certain circumstances
• Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Revoke Platform Access: Revoke Larisi's access to Meta, TikTok, or YouTube accounts directly through each platform's settings at any time

To exercise any of these rights, contact us at halo@larisi.id. We will respond within 14 business days. Identity verification may be required before processing certain requests.

Cookies & Tracking

Larisi uses only essential cookies necessary for session management and user authentication within the dashboard. We do not use third-party advertising cookies, cross-site tracking technologies, or fingerprinting. Users can configure cookie preferences through their browser settings without affecting core platform functionality.

Children's Privacy

Larisi is a business tool intended for adults aged 17 and above. We do not knowingly collect personal data from individuals under the age of 17. If we become aware that a minor has provided personal data without appropriate parental consent, we will promptly delete such data. Parents or guardians who believe their child has provided data to Larisi should contact us at halo@larisi.id.

Changes to This Privacy Policy

Larisi may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform integrations. Material changes will be communicated to active users via WhatsApp or dashboard notification at least 7 calendar days before taking effect. The "Last Updated" date at the top of this policy will always reflect the most recent revision. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Contact & Data Protection Officer

For questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Email: halo@larisi.id
• Website: https://larisi.id
• Data Controller: PT Kayuwangi Jagadhita Inovasi
• KEPMENHUM RI: AHU-A089433.AH.01.30.Tahun 2026
• KBLI: 62090 — Information Technology Activities and Other Computer Services
• Address: Jl. Tiwir VII Sumbersari, Moyudan, Sleman, Daerah Istimewa Yogyakarta 55563, Indonesia

If you believe your privacy rights have not been adequately addressed, you have the right to lodge a complaint with the relevant data protection authority in Indonesia.