Privacy Policy

01. Who We Are & Our Role

The data controller is PT. Modulus One Indonesia, a company organized under the laws of the Republic of Indonesia, contactable at dam@modulus1.co.

Two roles. For your account and your use of the Service, we act as a data controller. For advertising and platform data you connect on behalf of your own clients or third parties, we act as a data processor acting on your documented instructions, and you are the controller responsible for that data and for having a lawful basis and all necessary authority to provide it to us.

02. Information We Collect

2.1 Information you provide

• Account data: your email address, and either a password hash or, if you sign in with Google, your Google account identifier, name, email, and avatar. We support passwordless "magic-link" sign-in.
• Assets you analyze: images you upload, and captions, text, or URLs you paste. For videos, a small number of still keyframes are sampled in your browser and only those frames (plus any caption you provide) are transmitted for analysis — the original video file is not uploaded unless you choose to.
• Content you create: prompts, analyses, structural teardowns, templates, generated scripts, captions, images, and projects you save.
• Communications: support messages, waitlist sign-ups, and feedback.

2.2 Connected advertising & social accounts

If you connect a platform (e.g., Meta/Facebook, Instagram, TikTok) via OAuth or by providing a long-lived or system-user access token, we collect and store:

• Access and refresh tokens, which we store encrypted at rest using AES-256-GCM and use only to retrieve the data you ask us to display;
• Ad-account and advertiser identifiers, account name, and currency;
• Advertising metrics such as spend, impressions, reach, clicks, results, conversions, conversion value, and derived figures (CPR, CAC, CPM, CPC, CTR, ROAS); and
• Published-content metrics for accounts you own or are authorized to manage.

We do not post, edit, or delete content on connected platforms, and we do not access private messages.

2.3 Billing data

Payments are handled by our payment processor / merchant of record (Lemon Squeezy). We do not receive or store full card numbers. We store subscription status, plan, and processor customer/subscription identifiers needed to manage your subscription.

2.4 Information collected automatically

• Technical data: IP address, browser and device type, operating system, and referring URLs.
• Usage data: features used, actions, timestamps, quotas consumed, and error/diagnostic logs.
• Cookies / local storage: strictly necessary cookies and browser storage for authentication, session, and preferences (e.g., theme, language). We do not use third-party advertising cookies.

03. Legal Bases

We process personal data on one or more of the following bases (UU PDP Art. 20; GDPR Art. 6):

• Consent — for connecting third-party accounts, optional features, and international transfers;
• Performance of a contract — to provide the Service you request and administer your account and billing;
• Legitimate interests — to secure, maintain, debug, and improve the Service, prevent fraud and abuse, and pursue or defend legal claims, balanced against your rights; and
• Legal obligation — to comply with applicable law, lawful requests, and record-keeping.

You may withdraw consent at any time (Section 10); withdrawal does not affect processing already carried out or processing on another lawful basis.

04. How We Use Information

• To provide core features — analyzing assets, computing metrics and dashboards, generating reproductions and content, and managing workspaces and accounts;
• To retrieve and display the connected-platform data you ask us to show you;
• To authenticate you, enforce quotas and plan limits, and secure the Service;
• To process payments and administer subscriptions;
• To communicate with you about your account, security, transactions, and — where permitted — product updates (you may opt out of non-essential messages);
• To monitor, debug, and improve the Service, including by creating aggregated, anonymized, and de-identified data that does not identify you and which we may use for any lawful business purpose; and
• To prevent fraud and abuse, enforce our Terms, and establish, exercise, or defend legal claims.

05. AI Processing

To analyze assets and generate Output, the Service transmits the relevant content (e.g., sampled image frames, captions, prompts, and structural data) to third-party AI providers, including Anthropic, OpenAI, and Google. These providers process the content under their own terms to return a result. We use these providers' business/API offerings, under which, to our knowledge, submitted content is not used to train their models by default; however, we do not control and are not responsible for third-party providers' processing. Do not submit sensitive personal data or content you are not authorized to share. See Section 16 (Output and AI disclaimers in the Terms).

06. How We Share Information

We share personal data only with the categories of processors and recipients below, under contract and only to operate the Service:

We may also disclose data: (a) to comply with law, regulation, legal process, or a lawful government request; (b) to enforce our Terms or protect the rights, property, safety, or security of Assetry, our users, or the public; (c) to detect, prevent, or address fraud, security, or technical issues; and (d) in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case data may be transferred to the successor (we will require it to honor this Policy).

07. International Transfers

We operate from Indonesia, and your data may be processed in other countries — including Germany (EU), the United States, and wherever our processors operate — which may have different data-protection standards. Where required (UU PDP Art. 56; GDPR Chapter V), we rely on adequacy, appropriate safeguards such as standard contractual clauses, and/or your explicit consent. By using the Service and connecting accounts, you consent to these international transfers.

08. Data Retention

• Account and content data: retained while your account is active and deleted within 30 days after account deletion, unless we must retain it longer for legal, tax, security, fraud-prevention, or dispute-resolution purposes.
• Access / refresh tokens: retained until you disconnect the integration, after which they are deleted; where supported, we revoke them with the provider.
• Advertising metrics: retained to provide historical dashboards until you delete the connection or account.
• Logs and usage data: retained for up to 90 days for security and debugging, then purged or anonymized.
• Aggregated / de-identified data: may be retained indefinitely, as it does not identify you.

09. Security

We apply measures appropriate to the risk, including TLS/HTTPS in transit, AES-256-GCM encryption of stored access tokens, isolated per-application databases, row-level security, scoped service credentials, and least-privilege access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. To the maximum extent permitted by law, we are not liable for unauthorized access or loss that occurs despite reasonable safeguards or that results from factors beyond our reasonable control, including your own acts, your credentials or tokens, or third-party services. You are responsible for safeguarding your credentials and for the scope of any token you provide.

10. Your Rights

Subject to applicable law and verification of your identity, you may have the right to: access your personal data; correct or update it; erase it; restrict or object to certain processing; withdraw consent; receive a portable copy; and lodge a complaint with a competent supervisory authority (in Indonesia, the authority designated under the UU PDP; in the EU/UK, your local data-protection authority). California residents may have rights to know, delete, correct, and to opt out of "sale"/"sharing" (we do not sell or share personal information as defined), and not to be discriminated against for exercising these rights.

To exercise any right, email dam@modulus1.co (you may also use your account settings). You may also disconnect any platform from the analytics page and delete your account from settings. We will respond within the timeframe required by applicable law. We may decline or charge a reasonable fee for manifestly unfounded, excessive, or repetitive requests, to the extent permitted.

11. Your Responsibilities

You are responsible for, and represent and warrant that you have, all rights, authority, and consents necessary to: (a) upload and analyze the assets and content you submit, including any third-party likeness, brand, or copyrighted material; and (b) connect any advertising or social account and provide any access token, including where the account or data belongs to a client or third party. Where you act for clients, you are their controller and we are your processor; you are responsible for your own privacy notices and lawful basis toward them. You will indemnify us for breaches of these responsibilities as set out in the Terms.

12. Cookies & Local Storage

We use strictly necessary cookies and browser local storage for authentication, sessions, security, and preferences. Because these are essential to the Service, they are used on the basis of our legitimate interest in providing a functioning, secure product. We do not use advertising or cross-site tracking cookies. You can clear or block storage in your browser, but the Service may not function correctly without it.

13. Children

The Service is a business tool and is not directed to, or intended for use by, children. We do not knowingly collect personal data from a child (a person under 18 years of age and unmarried, as defined under Indonesian law) without verified parental or guardian consent. If you believe a child has provided us data, contact dam@modulus1.co and we will take appropriate steps to delete it.

14. Third-Party Platforms

When you connect TikTok, your use of TikTok data through the Service is also governed by TikTok's Privacy Policy; you can revoke access in your TikTok settings under Manage app permissions. When you connect Meta/Instagram, your use is also governed by Meta's Privacy Policy; you can revoke access in your Facebook Business Integrations settings. We are not responsible for third parties' privacy practices.

15. Changes to This Policy

We may update this Policy at any time. We will post the updated Policy with a new effective date and, for material changes, take reasonable steps to notify you. Changes take effect when posted or on the stated effective date. Your continued use of the Service after changes take effect constitutes acceptance, except where applicable law requires fresh consent.

16. Limitation

This Policy describes our practices but does not expand our liability. To the maximum extent permitted by applicable law, our liability in connection with the processing of personal data is subject to the disclaimers and limitations of liability in our Terms of Service, except for rights and remedies that mandatory data-protection law does not permit to be limited.

17. Contact

For privacy questions, requests, or complaints:

PT. Modulus One Indonesia
Email: dam@modulus1.co
Website: https://assetry.cc