1. Information We Collect
We collect the following types of information:
- Account information:Email address, name, and profile picture from your Google account when you sign in.
- Usage data:Chat messages, conversation history, and AI processing consumption for providing and improving the Service.
- Subscription data:Payment and billing information processed through Polar.sh (international) or Midtrans (Indonesian QRIS/VA).
- Shared conversation metadata:When you generate a share link, the share token and linked conversation content become accessible to anyone with the link.
- Technical data:IP address, browser type, and device information for security, rate limiting, and error monitoring.
2. How We Use Your Information
We use your information to:
- Provide and maintain the Service
- Process subscription payments and manage usage metering
- Generate AI responses to your chat queries
- Enable conversation sharing when you choose to share
- Improve the Service through aggregated usage analytics
- Communicate with you about your account
- Detect, prevent, and respond to security and fraud issues
3. Data Storage
Your data is stored on secure servers. Database servers are located in our private infrastructure. We use industry-standard encryption and access controls to protect your information. Conversation data is retained until you delete it or close your account.
4. Third-Party Services
We use the following third-party services:
- Google OAuth:For authentication. Google's privacy policy applies to data collected during sign-in.
- AI Providers (OpenAI):Chat messages and tool inputs are sent to AI providers for processing to generate responses. We do not use your data to train AI models.
- Polar.sh:For international subscription billing and metered usage tracking. Polar.sh processes payment information according to their own privacy policy.
- Midtrans (PT Midtrans):For Indonesian local payments (QRIS and Virtual Account). Midtrans processes payment data according to their privacy policy and Indonesian regulations.
- Sentry:For error monitoring and performance tracing. Sentry receives error reports and technical metadata (no conversation content) to help us fix bugs.
- Umami:For privacy-friendly, cookieless product analytics. Umami tracks aggregated page views and events without cross-site tracking.
- Web Search:The Service performs web searches to retrieve current information. Search queries are sent to a search provider; results are processed to answer your query.
- Market data providers:Stock, broker, and market data is sourced from third-party market data providers. Query parameters (e.g. ticker symbols) are processed by the Service to retrieve market data used as input to AI analysis.
5. Data Retention
We retain your account data for as long as your account is active. Conversation history is stored until you delete it or close your account. Shared conversations remain accessible until you revoke the share link. Usage and billing records are retained for accounting and tax purposes per applicable regulations. Error monitoring data is retained per Sentry's data retention policy.
6. Conversation Sharing
When you create a share link, the conversation content becomes publicly accessible to anyone with the link. We apply noindexdirectives to discourage search engine indexing, but cannot guarantee content will not be cached or screenshotted by others. You can revoke a share link at any time, after which the link stops working. Be mindful of sharing content that contains personal or sensitive information.
7. Your Rights
You have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your account and data
- Export your data in a machine-readable format
- Revoke any active conversation share links
To exercise these rights, contact us at support@metasora.com.
8. Cookies
We use essential cookies for authentication and session management. The Service does not use tracking cookies or third-party advertising cookies. Analytics (Umami) is cookieless.
9. Security
We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and continuous error monitoring. However, no method of transmission over the Internet is 100% secure.
10. Children's Privacy
The Service is not intended for children under 18. We do not knowingly collect data from minors.
11. International Data Transfers
Your data may be processed by the third-party services listed above, some of which operate outside Indonesia. By using the Service, you consent to these transfers in accordance with this Privacy Policy and applicable data protection laws.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Service.
13. Contact
For privacy-related inquiries, contact us at support@metasora.com.