Privacy Policy

• Getuser needs very little about you: your email address to sign you in, a few answers about your app, and the files you upload to make videos.
• We use it only to run Getuser for you. We do not sell it, share it for advertising, or use it to train AI. There are no ads, trackers or third-party analytics on Getuser.
• If you connect an Instagram or TikTok account, we keep its basic profile and its access keys (encrypted), and send that platform only the posts you confirm, when you choose. You can disconnect at any time (section 19).
• If you ask Getuser to write a slideshow, a caption, lines or answers about your app, your answers about your app and the post’s text go to an AI provider that writes it for us and may not train on it (section 8).
• Your data is stored in Singapore with Supabase and Railway, which are US companies; some providers may process data in the US or the EU. See Subprocessors.
• You can download everything we hold about you, or delete your account at once, from Settings.
• We keep your uploads while you use them (deleted after 30 days unused on the Free plan, 1 year on paid plans, with a warning first) and finished videos for 30 days, or longer while a scheduled post needs them (section 10).
• When you delete your account, your files and records are deleted straight away and database backups roll off within 7 days. We keep only a one-way fingerprint (hash) of your email as proof, fingerprints that stop the same app or social media account from starting a second free trial, and usage records that can no longer be linked to you.
• We act on your requests within 3 × 24 hours of confirming they come from you, and we will tell you within 3 × 24 hours if we discover a breach affecting your data.
• Getuser is only for people aged 18 or older.
• Questions: privacy@getuser.app.

Getuser is run by Moh Novalidyon Arileone Prayoda, Gresik, Indonesia (“Getuser”, “we”, “us”). For the personal data described in this policy, we are the data controller: the Pengendali Data Pribadi under Law No. 27 of 2022 on Personal Data Protection (UU PDP), and the controller under the EU and UK General Data Protection Regulation (GDPR).

Write to privacy@getuser.app about anything in this policy, and to support@getuser.app for help with the app.

Getuser is run by an individual today. If the operation of Getuser passes to a company (for example a PT set up by its founder), that company will become the controller and continue this policy; we will tell you before that happens.

We have not appointed a data protection officer, because the law does not require one for the processing we do (UU PDP art. 53; GDPR art. 37); the privacy address reaches the person responsible. We have not appointed a representative in the EU or the UK. If we start offering Getuser there in a way that requires one (GDPR art. 27), we will name them here.

We collect only what Getuser needs. Most of it you give us; some is recorded by our systems as you use Getuser; if you sign in with Google, some comes from Google; and if you connect an Instagram or TikTok account, some comes from Meta or TikTok.

• Account: your email address and an account ID. If you sign in with Google, Google gives us your email address, name and profile picture. If you sign in with email, your password, which our sign-in provider Supabase stores only as a salted hash (bcrypt): nobody at Getuser can read it.
• Sign-in and request records: when you sign in or use Getuser, our providers record the time, your IP address and your browser and device type (user agent).
• App profile: your answers about your app (its name, what kind of app it is, who it is for, the problem it solves and where to get it), and your posting times and time zone.
• Uploads: screen recordings, ending clips, your own hook clips, images and music. They may show your face or voice, and whatever is on your screen, including your app’s data and other people’s (section 18).
• What you make: your own lines, saved recipes, videos, image slides and zip files, and a record of how each video was made (the format, the line, which clips were used, and which shots show an AI-generated persona).
• Schedule and results: which videos you marked as posted, and the post links and view counts you type in. Post links can identify your social media accounts.
• Connected accounts (only if you connect Instagram or TikTok): the account’s ID on that platform, its username, display name, profile picture link and account type, the permissions you granted Getuser, and the access keys (tokens) the platform issues, with their expiry dates. TikTok also tells us, each time you open the publish page and again just before a post goes out, your display name and which privacy and interaction settings your account allows; we use that at that moment and do not keep it.
• Posts and captions: the posts you send or schedule through Getuser (the video, the account, the caption and title, the platform settings you chose, the time), their status and a step-by-step history, and, once published, the platform’s post ID and link. Also the captions and caption pieces you save, and how you like captions written (tone, language, hashtags).
• Acceptance records: the version of the terms you accepted, the exact sentence you agreed to (including that you are 18 or older), your browser’s user agent and the time.
• Usage statistics: short records of events in your workspace, with no email, text or file names (section 7).
• Plan and credits: your plan and its dates, your credit balance and the history of every credit in and out (what each action cost, and for AI writing the estimate, the maximum and the real cost), and what each render, AI request and upload cost us.
• Sign-up protection: when you sign up or ask to reset your password, your IP address and the email address you typed, to limit how many attempts can be made. If we switch it on, Cloudflare Turnstile also checks that a person is using your browser (see Subprocessors).
• Free trial records: if you start a free trial, a one-way fingerprint (hash) of your app’s link and of each social media account you connect, so that each app and each account gets one trial.
• Messages: what you write when you email us.
• Error reports: if we switch on error monitoring, technical reports of errors on our servers, set up not to include personal data by default.
• In your browser: a sign-in cookie, the language and theme you pick (if you pick one), a short-lived cookie while you connect an account and, while you edit, your Studio draft (section 20).

We do not ask for sensitive data, such as health information, religion or government ID numbers; please do not upload it. We do not use face or voice recognition on your uploads and do not process them as biometric data.

Indonesian law (UU PDP art. 20(2)) and the GDPR (art. 6(1)) require a legal basis for every use of personal data. These are ours:

• To create your account and sign you in (by email link, 6-digit code or Google): performing our agreement with you (UU PDP art. 20(2)(b); GDPR art. 6(1)(b)).
• To make your videos and run Getuser’s features: storing and processing your uploads, planning and rendering videos and slides, your library, schedule, calendar file and results, and your plan’s credits and limits: performing our agreement with you.
• To post to Instagram and TikTok when you tell us to: connecting the account you choose, keeping its access keys valid, sending the video or slides you picked with your caption and settings at the time you chose, checking that the post went out and showing you its status, and acting on the platform’s notice that you removed Getuser’s access or asked for your data to be deleted: performing our agreement with you (UU PDP art. 20(2)(b); GDPR art. 6(1)(b)). Each post goes out only because you confirmed it.
• To write slideshow text, captions, lines and answers about your app when you ask: sending your answers about your app (and your replies to its questions), the post’s line or slide text, the lines you already have and the style you picked to an AI provider, and checking its answer before showing it to you: performing our agreement with you. Nothing is sent unless you use these features.
• To send service emails: sign-in links and codes, and notices about your account, changes to our terms or this policy, or security: performing our agreement with you and, where the law requires a notice, our legal obligations (UU PDP art. 20(2)(c); GDPR art. 6(1)(c)).
• To record your acceptance of the terms and your age declaration: our legal obligations for electronic agreements, and our legitimate interest in being able to show what you agreed to and when (UU PDP art. 20(2)(c) and (f); GDPR art. 6(1)(c) and (f)).
• To keep Getuser secure and working: sign-in and request logs, error reports, limiting sign-up attempts, checking for bots, giving each app one free trial, preventing abuse and enforcing the Acceptable Use Policy: our legitimate interest in protecting Getuser, its users and their data (UU PDP art. 20(2)(f); GDPR art. 6(1)(f)), and our legal duty to keep personal data secure.
• To understand how Getuser is used: usage statistics (section 7): our legitimate interest in improving Getuser and reporting overall figures about it.
• To answer you: support messages: performing our agreement with you or, if you have no account, our legitimate interest in replying.
• To handle your privacy requests and show that we did: including the proof of erasure kept after you delete your account: our legal obligations.
• To comply with the law and protect our rights: orders from courts or authorities, and establishing or defending legal claims: our legal obligations, and our legitimate interest in defending claims.
• If Getuser passes to a company or is reorganised: transferring data to the successor that continues the service: our legitimate interest in keeping Getuser running for you. We will tell you first.

Where we rely on legitimate interests, we have weighed them against your rights and what you would reasonably expect, and you can object (section 12). We do not rely on your consent for the core service. We send no marketing emails today; if we ever want to, we will first ask for your separate, opt-in consent (UU PDP art. 20(2)(a); GDPR art. 6(1)(a)), which you can withdraw at any time.

To open an account we need your email address. To make a video we need your app profile answers and at least one screen recording. These are needed to perform our agreement with you: without them we cannot provide Getuser. Everything else (Google sign-in, your own lines, endings, images, music, posting times, results, connected accounts, AI writing) is optional. No law requires you to give us any of it.

• We do not sell your personal data, and we do not share it for targeted or cross-context behavioural advertising.
• We show no ads and use no advertising, tracking or third-party analytics tools.
• We do not use your uploads, lines, captions or videos to train any AI model, and we do not give them to anyone to do so. The AI providers that write text for us may not train on what we send them (section 8).
• We do not use your uploads or videos in Getuser’s own marketing without your separate permission.
• We never post on our own initiative. We post to a connected Instagram or TikTok account only what you confirmed, to the account you chose, and we add no ads and no “made with Getuser” mark to your posts. We do not read your messages, comments or followers. To confirm that a post went out, we may look up the IDs and links of the account’s most recent posts and keep only the one we published. If you have not connected an account, we have no access to it.
• We make no decisions about you by automated means that have legal or similarly significant effects, and we do not profile you (UU PDP art. 10; GDPR art. 22). Getuser’s planner picks clips and lines for your videos automatically, and the app warns you about some risky claims in lines, but neither is a decision about you.

Our database writes a short record when certain things happen in a workspace: for example, that it was created, that an upload finished, that a video was rendered or marked as posted, or that results were saved. Each record holds a random workspace ID, the name of the event, the time, and a few numbers or labels such as the video format or the view count you typed in. It never holds your email address, any text you wrote, or file names.

We use these records to understand how Getuser is used as a whole (for example, how many new users make a video on their first day) and to improve it. They stay in our own database; no analytics company receives them. Our legal basis is our legitimate interest.

While your account exists, the records are pseudonymous: we could link them to your workspace. When you delete your account, the workspace they point to is deleted and nothing links them back to you, so they remain only as anonymous rows for overall statistics (once backups have rolled off, within 7 days).

You can object (section 12). If you do, we will delete the records for your workspace and stop using them for statistics.

We share personal data only with:

• Our service providers (subprocessors), who host, store or send data for us under written agreements and only on our instructions. Today these are Supabase (database, sign-in and file storage) and Railway (app and render servers) and, only when you ask Getuser to write a slideshow, a caption, lines or answers about your app, OpenRouter, which passes the request to OpenAI’s GPT-6 Luna model. They may not use what we send to train their models. The full list, including planned providers, is on the Subprocessors page.
• Instagram (Meta) and TikTok, when you tell us to. When you connect an account, the platform learns that you use Getuser. When you post or schedule through Getuser, we send that platform the video or slides, caption, title and settings you chose for that post, at the time you chose, and nothing else. Meta and TikTok use what they receive under their own terms and privacy policies, as you agreed with them; they are not our subprocessors (section 19).
• Google, only if you choose to sign in with Google. Google then knows that you signed in to Getuser.
• Courts and authorities, when the law requires it, for example under a valid order from a court or from the Ministry of Communication and Digital Affairs (Komdigi). Where we are allowed to, we will tell you first.
• Professional advisers, such as lawyers and accountants, when needed and under a duty of confidentiality.
• A successor, if the operation of Getuser passes to a company or is reorganised. The successor must respect this policy, and we will tell you before it happens.

We send nothing to TikTok, Instagram, YouTube or any other platform unless you connect an account and post to it through Getuser. Otherwise you download your videos and post them yourself.

Your data is stored in Singapore: the database, sign-in and files with Supabase on Amazon Web Services (region ap-southeast-1), and the app and render servers with Railway in its Southeast Asia (Singapore) region. Supabase and Railway are US companies, and their staff may access data from other countries to support and secure their services.

When we start using the providers marked as planned on the Subprocessors page, some data will also be processed in the US or the EU: sign-in emails by our email provider (US), error reports by Sentry (US or EU), and, by Cloudflare, DNS lookups, the bot check when you sign up, and file storage once your uploads and videos move to Cloudflare R2. We will state the location of that storage on the Subprocessors page before any file moves. If you sign in with Google, Google processes your sign-in under its own terms.

When you ask Getuser to write a slideshow, a caption, lines or answers about your app, the request is processed by OpenRouter and OpenAI, in the US or wherever OpenAI runs the model. When you post to Instagram or TikTok through Getuser, the platform receives your post in its own systems around the world, because you asked us to send it there.

For people in Indonesia, this is a transfer of Personal Data outside the jurisdiction of the Republic of Indonesia (UU PDP art. 56). Until the Indonesian personal data protection authority decides which countries offer equal or higher protection, we do not rely on such a finding. We rely instead on adequate and binding safeguards (art. 56(3)): each provider’s data processing agreement, which binds it to protect the data and use it only on our instructions, and which includes the European Commission’s standard contractual clauses. What we send to Instagram or TikTok goes there with your consent, which you give for each post when you confirm it (art. 56(4)); you can stop at any time by not posting or by disconnecting.

For people in the EU and the UK, transfers to Singapore and the US rely on the same standard contractual clauses (GDPR art. 46(2)(c)), with the UK addendum for UK data; what you post to Instagram or TikTok goes there because you ask us to send it (art. 49(1)(b)). You can ask for a copy of these safeguards at privacy@getuser.app.

We do not ask you to consent to these transfers as a condition of using Getuser.

We keep personal data only as long as its purpose needs it (UU PDP art. 16(2); GDPR art. 5(1)(e)), then delete it:

• Account (email, and your Google profile if you used Google sign-in): while your account exists; deleted at once when you delete it.
• Sign-in and request logs (IP address, user agent): Supabase’s log system keeps them for up to 7 days, and Railway keeps app logs for the short period its plan sets, after which they are deleted. Sign-in records attached to your account are deleted with your account, where our provider allows.
• App profile, posting times, time zone, own lines, recipes and results: while your account exists, or until you delete them.
• Uploads: the original file is deleted as soon as it has been processed. The processed copy is kept while you use it: once it has gone unused for your plan’s period (30 days on the Free plan; 1 year on paid plans, during a trial and during the beta), it is deleted, with a warning 7 days before. An upload that a waiting video or a scheduled post still needs is kept. Uploads that never finish are deleted after 24 hours, and rejected uploads after 7 days.
• Videos, slides and zip files: 30 days after they are made, or longer while a scheduled post needs them. Then the files are deleted, and the video’s record stays with your account so that you can render it again for free while its uploads are kept.
• Deleting a video, an upload or your account removes its files at once.
• Failed renders: 30 days.
• Connected accounts (profile and permissions): while the account is connected. Deleted at once when you disconnect it, when you delete your Getuser account, or when Meta tells us you asked for your data to be deleted. If you remove Getuser in Instagram’s or TikTok’s settings, or the platform ends our access, we delete the access keys at once and keep the profile only so that the account shows as disconnected, until you reconnect or remove it.
• Access keys (tokens): stored encrypted until you disconnect, the platform ends our access, or you delete your Getuser account, and deleted then. They also stop working on their own: Instagram’s after 60 days unless renewed while the account is in use, TikTok’s after 24 hours (renewable for up to a year).
• Posts you sent or scheduled through Getuser (caption, settings, status, the platform’s post ID and link): while your Getuser account exists, so that you can see what went out; a post’s link to a disconnected account is removed. Deleted with your account.
• A post’s step-by-step history: 90 days.
• Saved captions and caption pieces, and your caption style: while your account exists, or until you delete them.
• Plan and credits (your plan, balance and credit history): while your account exists; deleted with it. The cost records of renders, AI requests and uploads lose their link to you when you delete your account and remain only as anonymous rows.
• Sign-up protection (the IP address and email address typed at sign-up or a password reset): 1 day.
• Free trial records (fingerprints of an app link or a social media account): kept after you delete your account, for as long as we offer free trials, so that the same app or account cannot start a second trial.
• Acceptance records: while your account exists; deleted with it.
• Proof of erasure (a one-way SHA-256 hash of your email address and the date you deleted your account): 5 years, so that we can show we deleted your account and apply the deletion again if a backup is ever restored.
• Usage statistics: pseudonymous while your account exists; afterwards kept only as anonymous rows for overall statistics (section 7).
• Error reports (only if switched on): 30 days.
• Temporary files on the render server: only for the length of one render job.
• Emails you send us: as long as we need to deal with your message and, for privacy requests, to keep a record that we handled them.
• Database backups: daily backups are kept for up to 7 days, so deleted data disappears from backups within 7 days. Backups cover the database, not files: deleted files are gone at once. If we ever restore a backup, we apply again every deletion made since it was taken.
• Studio draft in your browser: on your own device; Getuser offers it back for up to 7 days (see the Cookie Notice).

We take no payments today. Before we do, we will update this policy, including how long billing records must be kept under tax law.

In Settings you can, at any time:

• Download my data: one JSON file with everything our database holds about you and your workspace, with links to download your files. The links work for 7 days.
• Delete account: deletes your account at once, with no waiting period. Queued renders stop, Getuser gives back its access to every connected Instagram and TikTok account, every upload and video is removed from storage, your records are deleted and your account is closed. It cannot be undone, so download your data first if you want to keep it.

After deletion we keep only the proof of erasure and the anonymous usage records described in section 10, and backups roll off within 7 days. Videos you have already downloaded or posted are not affected, including posts Getuser published for you: remove them from each platform yourself. Getuser cannot delete them for you (Instagram does not let apps delete posts).

To stop Getuser posting to one account and delete what came with it, without deleting your Getuser account, use Disconnect on the Accounts page (section 19).

You can also ask us to do either by email (section 13).

As a Personal Data Subject (Subjek Data Pribadi) under UU PDP, and as a data subject under the GDPR, you have the rights below. We give them to every user, wherever you live:

• To be informed about who processes your data, why, on what basis and how (UU PDP art. 5; GDPR arts. 13-14). That is this policy.
• To access your data and get a copy (UU PDP art. 7; GDPR art. 15): use Download my data, or ask us.
• To correct or complete it (UU PDP art. 6; GDPR art. 16): edit it in the app, or ask us.
• To end its processing, and have it deleted or destroyed (UU PDP art. 8; GDPR art. 17): use Delete account, or ask us.
• To delay or restrict processing (UU PDP art. 11; GDPR art. 18).
• To object to processing based on our legitimate interests, such as usage statistics (GDPR art. 21).
• To withdraw consent where we rely on it (UU PDP art. 9; GDPR art. 7(3)), without affecting what was done before.
• Not to be subject to automated decisions, including profiling, with legal or similarly significant effects (UU PDP art. 10; GDPR art. 22). We make none.
• To receive your data in a commonly used, machine-readable format and send it to another service (UU PDP art. 13; GDPR art. 20). The export is a JSON file.
• To claim compensation for a breach of the rules on processing your data (UU PDP art. 12; GDPR art. 82).
• To complain to a data protection authority (section 21).

Some rights have limits set by law (UU PDP art. 15; GDPR art. 23), for example where we must keep data to meet a legal duty or to defend a claim. If we cannot fully meet a request, we will tell you why.

Use Settings, or email privacy@getuser.app from the email address of your Getuser account. If you write from another address, we may ask you to confirm the request from your account’s address, so that we never hand your data to someone else. Requests are free.

We act on your request within 3 × 24 hours of confirming that it comes from you, the time Indonesian law sets (UU PDP and its implementing regulation, PP 33/2026). If a request is unusually complex and the law that applies to you allows more time, we will tell you within those 3 × 24 hours, explain why, and finish within one month.

If you appear in someone else’s uploads and ask about your data, see section 18.

Some US state privacy laws, such as the California Consumer Privacy Act as amended by the CPRA, may not apply to a service of Getuser’s size. We give everyone the same information and rights anyway:

• Categories we have collected in the last 12 months: identifiers (email address, account ID, IP address, and the ID and username of any social media account you connect); internet or other electronic network activity (sign-in and request logs, usage statistics, the history of your posts); audio and visual information (uploads that may show your face or voice); information about your business (your app profile, captions). We draw no inferences about you.
• Sources: you, your browser or device, Google if you sign in with it, and Meta or TikTok if you connect an account.
• Purposes: those in section 4. We disclose these categories only to the service providers in section 8, for those purposes, and to Instagram or TikTok when you direct us to post there.
• No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information to infer characteristics about you.
• Your rights: to know what we hold and access it, to delete it, to correct it, and to get a portable copy. You may use an authorised agent; we may ask the agent for proof of authority and confirm the request with you by email.
• No discrimination: we will not deny you the service, charge you a different price or give you a different quality of service because you used these rights.
• Do Not Track and Global Privacy Control: Getuser does not track you across other sites or services, so these signals have nothing to switch off. We treat every visitor the same way, whether or not their browser sends them.

Retention is described in section 10, and how to make a request in section 13.

• Each customer’s data is kept apart by database rules (row-level security) on every table, checked by automated tests.
• All files are private and can be reached only through short-lived signed links: 1 hour for downloads, and 7 days for the links in a data export.
• Connections are encrypted (HTTPS), and our providers encrypt the data they store.
• Service keys have only the access they need, our servers run without administrator privileges, and the site sends security headers.
• Passwords are stored only as salted hashes, must be at least 12 characters with letters and numbers, and a new account confirms its email before it can be used.
• The access keys of connected Instagram and TikTok accounts are encrypted (AES-256-GCM) before they are stored, can be read only by our servers (not through the app, not even by you), and are kept out of logs and error messages.

No system is perfectly secure. If you find a security problem, please tell us at privacy@getuser.app.

If a personal data breach (kegagalan Pelindungan Data Pribadi) affects your data, we will tell you, and the Indonesian personal data protection authority, in writing within 3 × 24 hours of discovering it (UU PDP art. 46): what data was affected, when and how it happened, and what we are doing to contain it and recover. Until that authority is operating, we notify the Ministry of Communication and Digital Affairs (Komdigi).

Where the GDPR applies, we notify the competent supervisory authority within 72 hours (art. 33), and you without undue delay if the risk to you is high (art. 34). Where a US state law applies, we notify you as it requires.

Getuser is for founders and businesses promoting their own app, and only for people aged 18 or older; everyone confirms this before using Getuser. It is not designed for children, and we do not knowingly collect children’s data. If we learn that an account belongs to someone under 18, we delete it. If you believe a child has an account, tell us at privacy@getuser.app.

Your uploads may show other people’s data, such as names, emails or photos on your screen, or people in your footage. For that data you decide why and how it is used, so you are its controller and Getuser is your processor (Prosesor Data Pribadi under UU PDP arts. 51-52; processor under GDPR art. 28).

We process it only to provide Getuser to you, on your instructions as set out in the processing terms in the Terms of Service: we keep it confidential and secure, use only the providers on the Subprocessors page, tell you without undue delay if a breach affects it, and delete it when you delete the upload or your account.

You must have a legal basis to include such data, and should leave it out or blur it where you can. If someone asks us about their data in your uploads, we will refer them to you and help you respond.

Connecting an account is optional. You connect it on the Accounts page, through Instagram’s or TikTok’s own consent screen, where you see and approve the permissions Getuser asks for: on Instagram, to read the account’s basic profile and to publish content; on TikTok, to read your basic profile and to post content. Instagram allows only professional (Business or Creator) accounts.

What we receive: the account’s ID, username, display name, profile picture link and account type, the permissions you granted and the access keys. We do not receive your password, and we do not collect your messages, comments, followers or other posts.

What we send, and when: only the posts you confirm on the publish page, each with the video or slides, caption, title and platform settings you chose, at the time you chose (“now” or a scheduled time, up to 180 days ahead). A scheduled post goes out automatically at its time because you confirmed it; you can change or cancel it until Getuser starts sending it. For videos that show an AI-generated persona, Getuser switches on the platform’s AI label.

The platforms’ role: Meta (for Instagram) and TikTok decide what they do with your posts and your account under their own terms and privacy policies (Meta Privacy Policy, TikTok Privacy Policy). We use the data they give us only to provide auto-posting to you, as their developer terms require, and never sell it or use it for advertising.

How to stop:

• Disconnect the account on the Accounts page: we give back our access where the platform allows it, cancel the posts still waiting for that account, and delete the account’s profile and access keys at once. The posts you sent stay in your history, without the account.
• Remove Getuser in the platform’s settings (on Instagram, under apps and websites; on TikTok, under the apps you gave access to). The platform tells us, we delete the access keys, and posts waiting for that account will not go out.
• Ask for deletion through Meta: if you ask Instagram to have Getuser delete your data, we delete the connected account and its keys and cancel its waiting posts. You can check the request on our data deletion page, which also explains these steps.
• Delete your Getuser account, which does all of the above for every connected account.

Posts that were already published stay on Instagram or TikTok until you delete them there. Getuser cannot delete them for you.

Getuser uses only what it needs to work: a sign-in cookie from Supabase, a cookie that remembers whether you ticked “Remember me”, two cookies that remember the language and theme you choose (set only when you click the switch), a cookie that lives for ten minutes while you connect an Instagram or TikTok account, and a copy of your unsaved Studio draft kept in your own browser. There are no analytics, advertising or tracking cookies, and our fonts are served from our own site. The details, and why there is no cookie banner, are in the Cookie Notice.

Please contact us first at privacy@getuser.app, so that we can try to put things right. You can also complain to a data protection authority:

• Indonesia: the personal data protection authority set up under UU PDP (art. 58) once it is operating; until then, the Ministry of Communication and Digital Affairs (Komdigi).
• European Union: the data protection authority of the country where you live or work, or where the issue arose (list of EU authorities).
• United Kingdom: the Information Commissioner’s Office (ico.org.uk).

You can also go to court, including to claim compensation (section 12).

We update this policy when Getuser or the law changes. The date at the top shows when it last changed (version 2026-10-19).

If a change matters for how we handle your data, such as a new purpose or a new kind of provider, we will tell you by email or in the app at least 30 days before it takes effect and, where needed, ask you to accept it again. If you disagree, you can download your data and delete your account before the change applies. We will never start using your data for a purpose that needs your consent without asking first.

Earlier versions are available on request.

• Privacy questions and requests: privacy@getuser.app
• Help with the app: support@getuser.app
• Legal notices: legal@getuser.app
• Operator: Moh Novalidyon Arileone Prayoda, Gresik, Indonesia