Privacy Policy

1. Data controller

For the processing described in this policy, the controller is:

Trading name

PRASĀRA

Privacy contact

hello@prasara.site

Where we process personal data on behalf of a client, the client is the controller of that data. See section 5.

2. Personal data we collect

2.1 Data you provide

• Enquiries. Name, contact details (phone, WhatsApp, Telegram or email), business name, website or social profile, business type, services of interest and your message. With each form submission we also record the page, language setting, time and IP address.
• Correspondence. Messages you send to our email address or via WhatsApp.
• Dashboard accounts. Login email, password (stored only as a salted hash), assigned client workspaces and sign-in attempt records used to prevent brute-force attacks.
• Onboarding. When a client connects advertising accounts through our onboarding flow: the contact email or phone number used for access links and reminders, account identifiers and progress of each setup step.

2.2 Data collected automatically

• Technical data. IP address, browser and device information and request logs processed by our hosting provider to deliver and secure the website.
• Cookies and similar technologies. Session and preference storage, and, only with your consent, analytics and advertising cookies. See section 9.

2.3 Data from our clients’ connected accounts

When a client instructs us to manage or report on their marketing, we access data from accounts the client controls, such as:

• Google Ads: account structure, campaign, keyword and ad performance, conversion actions and conversion data;
• Google Analytics 4: aggregated traffic, acquisition, engagement and conversion reports;
• Google Business Profile: aggregated profile performance metrics and, where review management is part of the service, public reviews;
• Meta (Facebook and Instagram): advertising account structure and performance insights;
• point-of-sale, booking and appointment systems the client connects for revenue reporting (for example Syrve, Fresha or Cloudbeds);
• a client’s CRM (for example Kommo), where the client asks us to report enquiries from its ads to Google Ads.

Advertising, analytics and point-of-sale reports mostly contain aggregated business metrics. They can contain limited personal data, for example the public name of a reviewer or the names of a client’s staff members in sales reports.

2.4 Booking, lead and conversion data of our clients’ customers

For some clients, and only on their instructions, we process data about their own customers:

• Bookings. From a client’s booking system (Cloudbeds): reservation ID, creation date, stay dates, number of nights and guests, status, booking source, amount, guest country, and the values of hidden booking fields that the client’s website fills in (an advertising click ID and a traffic source label). Client dashboards store only these fields and do not store guest names, email addresses or phone numbers.
• Click IDs on a client’s website. A tag in the client’s Google Tag Manager container stores Google or Meta click IDs (gclid, gbraid, wbraid, fbclid) and a traffic source label in first-party cookies for up to 90 days and passes them to the client’s booking engine. For another client, a clicked WhatsApp link sends the click ID, page, time, browser user agent and country to our server, where the record is kept for 14 days.
• Conversions sent to advertising platforms. We report confirmed bookings or qualified enquiries to Google Ads (with the click ID, time and value) and to the Meta Conversions API (with the booking ID, time and value). With these we send the customer’s email address, phone number and, for Meta, first name, last name and country only as SHA-256 hashes, computed before upload. Where a CRM is used, we add a status tag and the matched click ID to the lead record in the client’s CRM.
• Customer lists. On a client’s instruction, we upload lists of the client’s past guests to Google Ads Customer Match and Meta Custom Audiences. Email addresses, phone numbers and other identifiers are SHA-256 hashed before upload.

3. Purposes of processing

• responding to enquiries, preparing proposals and taking steps before entering into a contract;
• providing contracted services: managing advertising, reporting and operating client dashboards;
• operating, securing and maintaining the website, dashboards and onboarding flow;
• measuring the performance of our own website and advertising, where you have consented;
• complying with legal obligations and establishing, exercising or defending legal claims.

4. Legal bases

Where the applicable law requires a legal basis for processing, we rely on the following:

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before it.

5. Controller and processor roles

• We act as controller for data about website visitors, enquiries, dashboard account and security data, and our own marketing.
• We act as processor or service provider for data in clients’ connected accounts that we process to deliver services on the client’s instructions. This includes the booking, lead, click ID and conversion data described in section 2.4, the tags we configure in a client’s Tag Manager container, uploads of conversions and hashed customer lists to Google and Meta, and the history of fetched report data we keep for client dashboards.
• For that data, the client is the controller and is responsible for informing its customers and, where required, obtaining their consent. The advertising platforms receiving the data process it under their own terms with the client.

Where a client agreement or data processing agreement sets different or more specific terms for client data, that agreement prevails over this policy.

6. Google API data

PRASĀRA’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We access Google Ads, Google Analytics and Google Business Profile data only through agency accounts that a client has added to their own Google accounts, and only for those accounts. Website visitors and dashboard users are not asked to sign in with Google, and we do not access Gmail, Google Drive, contacts or other personal Google account data of visitors.

• Purpose limitation. Google user data is used only to provide and improve the reporting and advertising management features requested by the client.
• No sale. We do not sell Google user data.
• No advertising use. We do not use or transfer Google user data to serve advertising, including retargeting or interest-based advertising.
• No generalized AI training. We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
• Limited human access. Our staff view Google user data only when required to deliver the service, for security purposes, to comply with applicable law, or with the client’s explicit permission.

7. Recipients and service providers

We do not sell personal data. We disclose personal data to the following categories of recipients, who process it on our behalf or as independent providers of the platforms concerned:

We may also disclose personal data to professional advisers, to competent authorities where required by law, or in connection with a merger, acquisition or sale of business assets, subject to appropriate confidentiality obligations.

8. International transfers

Our service providers process data in multiple countries, including countries outside the one where you are located. Where the applicable law restricts cross-border transfers of personal data, we take the safeguards that law requires, such as contractual clauses offered by the provider or transfers to countries with an adequate level of protection.

Where Indonesian Law No. 27 of 2022 on Personal Data Protection applies, transfers of personal data outside Indonesia are made in accordance with its cross-border transfer requirements.

9. Cookies and similar technologies

Analytics and advertising cookies are used only after you consent. Until then, Google tags operate in Consent Mode: they do not set or read analytics or advertising cookies and send only cookieless signals (such as the consent state and page load) to Google. You can change your choice at any time in Cookie Preferences.

This website does not use Meta Pixel, TikTok Pixel or other third-party advertising tags. Information on how Google uses data from sites that use its services is available at policies.google.com/technologies/partner-sites.

10. Retention

The periods below are our general retention periods. Where a client agreement sets a different period, that agreement applies.

• Enquiries and correspondence: up to 24 months after our last contact, unless you become a client.
• Client account and reporting data: for the duration of the engagement, and deleted or anonymised within 90 days after it ends, unless the client asks for earlier deletion or the law requires longer retention.
• Dashboard accounts: until the account is closed or the engagement ends.
• History of fetched client report data (compressed snapshots used to restore dashboards when a source is unavailable): for the duration of the engagement, then as for client account and reporting data.
• WhatsApp click records (click ID, page, time, user agent, country): 14 days.
• Google API data: stored only as long as needed to produce and display reports. A client can revoke our access at any time in their Google account.
• Records we must keep by law (for example accounting records): for the period required by law.

11. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), hashed passwords, signed session tokens that can be revoked, rate limiting of sign-in attempts, API credentials stored server-side as secrets and not exposed to browsers, and access to client data limited to staff who need it to deliver services. No method of transmission or storage is completely secure.

12. Your rights

Depending on the law that applies to you, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion of your data;
• receive your data in a portable format;
• restrict or object to processing, including processing based on legitimate interests;
• withdraw consent at any time;
• lodge a complaint with a data protection supervisory authority.

To exercise these rights, email hello@prasara.site. We may need to verify your identity before acting on a request. We respond within the period required by applicable law and generally aim to respond within 30 days.

If your data is processed by us on behalf of a client, we will refer your request to that client or assist the client in responding. Clients can revoke our access to their Google accounts in the user management settings of Google Ads, Google Analytics or Google Business Profile, or at myaccount.google.com/permissions.

13. Automated decision-making

Our dashboards and automatically generated summaries are reporting tools. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

14. Children

Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy. The current version is published on this page with its “Last updated” date. Where changes are material, we will inform clients directly.

16. Contact

Questions and requests about this policy: hello@prasara.site.

See also the Terms of Service.