Privacy Policy

• Account details: your name, email address, and a securely hashed password. If you sign in with Google, we receive your name, email address, and profile photo from Google, and nothing else.
• Workspace content: briefs, captions, files, comments, approvals, and reports you and your team create.
• Instagram data from the professional accounts you connect, through Meta's official API and only with the permissions you grant: profile details, posts and their performance insights, and comments.
• Billing records: plan, amounts, and payment status. Card and bank details are handled by our payment provider and never stored by us.
• Security and usage logs: sign-in events, IP address, and browser type, used to protect accounts and fix problems.

To provide and secure the service, show your analytics and reports, send the emails the service needs (such as verification, invitations, reminders, and billing notices), process payments, and generate AI suggestions you ask for. We do not use your content to train AI models, and we do not sell or rent personal data.

We use trusted providers to run CantingSpace: Vercel (hosting), Neon (database), Google (sign-in, AI features, and file storage), Resend (email), Xendit (payments), Cloudflare (bot protection at signup), and Meta (the Instagram connection). They process data on our behalf and only for these purposes. Some of them store data outside Indonesia.

Each workspace is kept separate. Only the people its owner invites can see it, with the access their role allows. Clients you invite as guests see only what you share with them.

We keep workspace data while the workspace exists. When a trial ends without a paid plan, the workspace becomes read-only and is archived after 90 days. When an owner deletes a workspace, it can be restored for 30 days and is then permanently deleted. Disconnecting an Instagram account stops all further data collection from it. Billing records are kept as long as Indonesian tax law requires.

You can view and edit your details in your profile, export workspace data from the workspace settings, disconnect Instagram accounts at any time, and delete your workspace. You can also ask us to access, correct, or delete your personal data, or ask how it is used, by emailing hello@cantingcreative.id. We will reply within 14 days.

Passwords are hashed, connections are encrypted, and access inside a workspace follows roles. If we learn of a breach that affects your data, we will tell you without undue delay.

We will post updates to this policy here and tell you about important changes by email or in the app.