Privacy Policy

1.Who is responsible

Dicky Ibrohim, an independent engineering partner based in Demak, Jawa Tengah, Indonesia, is the data controller for the processing described here ("I", "me"). You can reach me at hello@dickyibrohim.com for anything related to this policy.

2.What this policy covers

This policy applies to three contexts:

• The website www.dickyibrohim.com, including its contact and booking forms.
• Engineering services I deliver to clients (audits, builds, ongoing partnership).
• Platform integrations I operate on Meta platforms — apps registered under the CLEOVA business (WhatsApp Business Platform / Cloud API, Facebook Login, Instagram Graph API). These send transactional messages (one-time passcodes, order and shipping notifications) and, where offered, let you sign in to a store I build and operate.

3.Data I collect

Contact data

Name, email address, phone number, company — when you write to me, book a call, or place an order on a store I operate.

Messaging data

Your WhatsApp phone number, message templates delivered to you, delivery/read status, and any reply you send to a business number connected to my integration.

Login data

When you use Facebook Login: your public profile name, profile picture, and email address as permitted by Meta — nothing else is requested.

Technical data

IP address, user agent, referrer, pages viewed, and anonymous Web Vitals metrics collected by a first-party beacon on this website.

Project data

Information a client shares during an engagement (repositories, logs, credentials granted for the work) — processed only for that engagement.

4.Why I process it (and legal basis)

• To answer your enquiry or deliver a service you requested — performance of a contract or steps at your request.
• To send transactional WhatsApp messages you triggered (verification code, order confirmation, shipping update) — performance of a contract; you can opt out of non-essential updates by replying STOP.
• To authenticate you via Facebook Login when you choose it — your consent, withdrawable at any time by removing the app from your Facebook settings.
• To keep this website fast and secure (rate limiting, abuse detection, performance monitoring) — legitimate interest.
• To comply with legal obligations under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and, where applicable, the GDPR.

5.Who I share data with

I do not sell personal data. Data is shared only with processors needed to run the service:

• Meta Platforms, Inc. — delivers WhatsApp messages and Facebook Login on my behalf under Meta’s own terms and privacy policy.
• Cloudflare, Inc. — hosting, CDN, DNS, and security for this website and related services.
• Email and calendar providers used to respond to enquiries and schedule calls.
• Clients whose store you interacted with — the store owner is the merchant of record for your order and receives the data needed to fulfil it.
• Authorities, when required by law.

6.How long I keep it

• Enquiries and correspondence: up to 24 months after the last contact.
• Messaging logs (WhatsApp delivery status, OTP records): up to 90 days, then deleted or anonymised.
• Order-related data held by a store: for the statutory retention period required for tax and accounting in Indonesia.
• Technical logs: up to 30 days.
• Login data: until you remove the app or request deletion.

7.Your rights

Under UU PDP and, where it applies, the GDPR, you may access, correct, port, restrict, object to, or delete personal data I hold about you, and withdraw consent at any time. To exercise a right, email hello@dickyibrohim.com — I respond within 7 days and complete requests within 30 days.

To delete data specifically, follow the steps at https://www.dickyibrohim.com/data-deletion/. If you believe your rights are not respected, you may lodge a complaint with the Indonesian data protection authority or your local supervisory authority.

8.Security

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256-GCM for secrets and sensitive fields). Access is role-based and logged. Passwords, where used, are hashed with Argon2id. Webhooks from Meta are verified with signed payloads before processing.

9.Cookies and tracking

This website sets no advertising or third-party tracking cookies. A first-party performance beacon records anonymous Web Vitals. Stores I operate use strictly necessary cookies for cart and session, and describe any additional cookies in their own notice.

10.Children

The website and services are not directed at children under 18. I do not knowingly collect their data; if you believe a child provided data, contact me and it will be removed.

11.International transfers

Processors such as Meta and Cloudflare may process data outside Indonesia. Transfers rely on the processor’s standard contractual safeguards and equivalent protection required by UU PDP.

12.Changes to this policy

When this policy changes, the effective date at the top is updated. Material changes affecting platform integrations are also announced through the relevant service.