Data Deletion Instructions

1. Introduction

This page explains how you can request deletion of your personal data stored on the Dewata AI platform. PT DEWATA ARTIFICIAL INTELLIGENCE ("Dewata AI", "We"), based in Bali, Indonesia, is committed to protecting your privacy rights in accordance with Law No. 27 of 2022 concerning Personal Data Protection (PDP Law / UU PDP).

This page is also provided to fulfill Meta Platform requirements as a "Data Deletion Instructions URL" for applications using the WhatsApp Business API and Instagram API.

2. Data We Collect

Below is a summary of the categories of data we may store in connection with your use of the Dewata AI platform:

• Account information: Name, email address, and authentication credentials
• Bot configurations: System prompts, model settings, knowledge bases, feature configurations, and allowed domains
• Conversation history: Messages between end users and your AI chatbots
• Channel integrations: WABA IDs, WhatsApp phone numbers, Instagram account IDs, Telegram usernames, and encrypted access tokens
• Customer & lead data: End user information captured through chatbots (name, email, phone number), lead scores, and lifecycle status
• E-commerce data: Products, orders, merchant payment configurations, and transaction history
• Subscription & credit data: Subscription plans, credit balances, and credit transaction history

For complete details, please read our Privacy Policy.

3. Self-Service Account Deletion

If you are a registered Dewata AI user, you can delete your account yourself through the platform:

1. Log in to your Dewata AI account
2. Navigate to Dashboard > Settings
3. Scroll to the Delete Account section
4. Click "Delete My Account" and confirm

Data deleted upon account deletion:

• All bots and their configurations
• All conversation history
• API keys and channel integrations
• Customer and lead data
• Subscriptions and credit balances
• Customer memory data
• Knowledge base embeddings (vector embeddings)
• Workflow rules and execution logs
• Extended user profile data
• Notifications and audit logs

For other data deletion requests (e.g., deletion of specific data without deleting the entire account, or if you are an end user of a chatbot built on our platform), please follow the procedure in Section 4 below.

4. How to Request Data Deletion

To submit a data deletion request, send an email to:

Requests may be submitted in written form via electronic means (email) or non-electronic means (written letter), in accordance with the PDP Law.

4.1 Required Information

To process your data deletion request, please include the following information in your email:

• Full name as registered on your account or identity
• Email address registered on the Dewata AI platform
• Description of data you wish to have deleted (e.g., entire account, specific conversation history, channel integration data, etc.)
• Relevant identifiers (if applicable):
  • Connected WhatsApp phone number
  • Connected Instagram username
  • Connected Telegram username
• Reason for deletion (optional, but helps us process your request more effectively)

5. Processing Timeline

Here is the timeline for processing data deletion requests:

1. Acknowledgment of receipt: We will acknowledge receipt of your request within 3x24 hours (business days)
2. Identity verification: We may need to verify your identity to ensure the request is made by an authorized party. Verification is conducted via registered email or equivalent method
3. Deletion execution: Data will be deleted within 30 calendar days of successful identity verification
4. Written confirmation: You will receive written confirmation via email once the data deletion has been completed

6. What Happens After Deletion

After your deletion request is processed, the following data will be permanently deleted from our systems:

• Account information and user profile
• All bots, system prompts, and knowledge bases
• All conversation history and session data
• Channel integrations (WhatsApp, Instagram, Telegram) and encrypted access tokens
• API keys and domain configurations
• Subscription data and credit balances
• Customer data, leads, and lead scores
• Merchant payment configurations
• Customer memory data
• Knowledge base vector embeddings
• Workflow rules and execution logs
• Extended user profile data
• Notifications and referral codes

Warning: Data deletion is permanent and irreversible. Please ensure you have exported any required data before submitting a deletion request.

6.1 Data That May Be Retained

In accordance with applicable laws and regulations, some data may be retained even after a deletion request has been processed:

• Financial transaction records: Retained for a minimum of 10 years in accordance with Government Regulation No. 80 of 2019 concerning Trade Through Electronic Systems (PP 80/2019)
• Non-financial transaction records: Retained for a minimum of 5 years in accordance with applicable regulations
• Legal or regulatory obligations: Data required to be retained by court order, audit requirements, or other legal obligations
• Anonymized aggregate data: Data that has been anonymized and aggregated for statistical and service improvement purposes, which cannot be linked back to any individual
• Admin audit logs: Retained for a minimum of 2 years for compliance and security purposes

7. WhatsApp & Instagram (Meta) Data

If you use WhatsApp Business or Instagram integration through the Dewata AI platform, the following data is stored in our systems and will be deleted upon request:

• WhatsApp Business Account (WABA) IDs and business phone numbers
• Instagram account IDs and business profile information
• Encrypted access tokens (using AES-256-GCM encryption)
• Messages received and sent through channel integrations
• Webhook configurations and integration settings

Important: Dewata AI can only delete data stored on our platform. Data stored directly by Meta (including message history on Meta's servers, WhatsApp Business account data, and Instagram account data) must be deleted separately using the tools provided by Meta.

To delete your data from Meta, please visit: Meta Data Deletion Page or read the Meta Privacy Policy.

8. Legal Basis

Your right to request data deletion is protected by the following laws and regulations:

Law No. 27 of 2022 concerning Personal Data Protection (PDP Law / UU PDP):

• Article 8: Personal Data Subjects have the right to delete their Personal Data (right to erasure)
• Article 45: Personal Data Controllers are obligated to notify the Personal Data Subject of the deletion of their Personal Data (deletion notification obligation)
• Article 57(2): Administrative sanctions in the form of administrative fines of up to 2% (two percent) of annual revenue or annual receipts for violations

Deletion requests may be submitted in written form via electronic means (email) or non-electronic means (written letter), in accordance with the PDP Law.

Other implementing regulations:

• Government Regulation No. 71 of 2019 concerning Electronic System and Transaction Operations (PP 71/2019)
• Government Regulation No. 80 of 2019 concerning Trade Through Electronic Systems (PP 80/2019)

GDPR (for EU residents):

If you are a resident of the European Union, you are also protected by GDPR Article 17 ("Right to Erasure" / "Right to be Forgotten"), which grants you the right to request deletion of your personal data under certain conditions.