Privacy Policy
Last updated: October 29, 2026
This Privacy Policy explains how PT Cazh Teknologi Inovasi ("we", "us"), the company behind Kalea Chat ("Kalea"), handles personal data when you use kalea.chat and the Kalea application at app.kalea.chat (the "Service"). Questions: hello@kalea.chat.
Our two roles
- Controller — for your own account, billing and usage data (you as our customer), and for visitors to our website.
- Processor — for the content you bring into Kalea: your customers' and leads' messages, names, phone numbers, emails and files ("Customer Data"). You (the business) decide why and how it is used; we process it only on your behalf to run the Service. If you are a person who chatted with a business that uses Kalea, that business is responsible for your data — please contact it first.
Data we collect
- Account data: name, email, phone number, company name, role, a password (stored only as a salted hash), language and regional settings.
- Billing data: plan, invoices and payment status. Card and wallet details are handled by our payment providers (Paddle, Xendit); we do not store full card numbers.
- Customer Data you connect: WhatsApp conversations (text, images, documents, voice notes), website chat messages, contact and lead details, notes, tags, pipeline stages, files you upload, and the settings, knowledge base and products you give the AI.
- Usage and technical data: IP address, browser/device information, pages and features used, error logs, AI usage and token counts.
- Website visitors: if you use the chat widget on a Kalea customer's site, the widget keeps a session token and the details you enter in the pre-chat form.
How we use data
To provide and secure the Service (including delivering messages and running the AI Agent); to bill you and prevent fraud and abuse; to provide support; to improve and troubleshoot the product; to send service and security emails, and onboarding or billing reminders; and to comply with law. We do not sell personal data, and we do not use Customer Data to train AI models.
AI processing
When the AI Agent, copilot, classification or document reading is used, the relevant message content and the instructions/knowledge you configured are sent to an AI provider to generate the result. By default this is Anthropic (Claude). If you add your own API key you may choose OpenAI, Google (Gemini) or xAI (Grok), in which case your data is subject to that provider's terms. Providers process data to return the response under their API terms.
Who we share data with (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Hostinger | Server hosting and database | Indonesia |
| Cloudflare (R2) | File and backup storage (when enabled) | Asia Pacific |
| Vercel | Hosting of the marketing website | Global |
| Anthropic and, if you choose, OpenAI, Google, xAI | AI features | United States |
| Paddle.com | Payments, tax and invoicing (Merchant of Record) | United Kingdom / United States |
| Xendit | Local payment methods | Indonesia / Southeast Asia |
| Resend | Transactional email (verification, invoices, notices) | United States |
| Meta / WhatsApp | Message delivery through the WhatsApp connection you link | — |
We also share data when required by law, to protect rights and safety, or in a business transfer (with notice to you).
International transfers
Our own servers are in Indonesia, while several of our providers (for example AI, email and payment services) operate in other countries such as the United States and the United Kingdom. By using the Service you understand that data may be transferred to and processed in countries whose data-protection laws differ from yours. We rely on contractual commitments and the safeguards offered by our providers.
Retention
We keep account and Customer Data while your account is active. After you close your account we keep your data for up to 30 days so you can request an export, then delete it; backups are overwritten on a rolling basis. We keep invoices and tax records for as long as the law requires. You can delete individual contacts and conversations at any time inside the application.
Security
We use HTTPS for data in transit, per-company data isolation in the database (row-level security), encrypted storage of provider keys and secrets, access controls by role, and regular backups. No system is perfectly secure; tell us immediately about any suspected incident at hello@kalea.chat.
Cookies and local storage
We use only what is needed to run the Service: a login token and preferences stored in your browser (local storage), a language-preference cookie (kalea_lang) on kalea.chat, and the session token of the chat widget. We do not use advertising cookies. The Paddle checkout may set its own cookies to process your payment.
Your rights
Depending on where you live (including under Indonesia's Personal Data Protection Law and the GDPR), you may have the right to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent. Email hello@kalea.chat from your account email; we respond within 30 days. You may also complain to your local data-protection authority.
Children
The Service is for businesses and is not directed to children under 18. We do not knowingly collect their personal data.
Changes
We will update this page when our practices change and, for material changes, notify you by email or in the application. The date at the top shows the latest version.
Contact
PT Cazh Teknologi Inovasi
Owner and operator of Kalea Chat
Perumahan Kedungwringin Gg X No A94, Patikraja, Kabupaten Banyumas, Jawa Tengah, Indonesia
Email: hello@kalea.chat