Privacy policy

Who is responsible

This policy follows Indonesia's Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”). PT Kilat Inovasi Cerdas operates KilatBot (“we”). For your account data, we are the data controller: we decide why and how it is used. That covers your sign-in details, workspace, billing and support records.

Your agent may also handle personal data of other people, such as your customers who write to your Telegram bot, your Instagram account or your shop's customer agent. For that data you are the data controller and we are your data processor: we handle it only to run your agent, on your instructions. You are responsible for telling those people how their data is used and for having a lawful reason to use it. The terms set out our duties as your processor.

This policy is published in Indonesian and English. If the two differ, the Indonesian version prevails for users in Indonesia.

Data and purposes

We use account details such as email, authentication information, and workspace records to sign you in and run your account. Google OAuth, when used, supplies profile and email information for authentication. We store service configuration, deployment status, provider and application credentials you supply, wallet balances, payment references, and ledger records to run your agents and services, match payments, manage billing, and resolve support requests.

Your agent processes the content you and your customers put into it. With Kilat AI, that content is sent to the AI model that answers. We keep a usage record of each model request (tokens, cost, model and time, never the text) to bill you and show your usage. With your own API key, your model provider receives the requests under its own terms. PocketBase stores your collections, application user records, and uploaded files on its persistent storage. Operational logs and error reports help troubleshoot failures and protect the service. Support messages are used to answer requests and investigate billing or service issues.

Why we may use your data

UU PDP asks for a lawful basis for each use. Ours are:

• Contract. Creating your account, running your agents and services, Kilat AI, billing, payments, service emails and support. We need this data to provide what you signed up for.
• Consent. Optional homepage tracking, and each app you connect (Google, Threads, Instagram, Telegram, GitHub and others). You can withdraw consent at any time by changing your cookie choice or disconnecting the app.
• Legal obligation. Keeping billing, payment and tax records, and answering lawful requests from authorities.
• Legitimate interest. Keeping the service secure, preventing abuse and fraud, fixing errors, and handling disputes. We keep this use small and do not use it for ads.

We do not sell personal data, and we do not use your content to train AI models.

What your agent stores

Your agent keeps its own data: chat history, memory, files, schedules and settings. This lives on the agent's own encrypted disk on Amazon Web Services in Jakarta. It stays there until you delete the chat, the file or the agent.

When an agent sleeps, we save a checkpoint of its working memory so it wakes up as itself. The last two checkpoints are kept. We also take a daily snapshot of the disk and keep each one for 7 days, so we can recover from a failure. Tokens for the apps Kilat connects for you (Google, Instagram and Threads) are stored encrypted in our database and are never given to your agent. Your agent's own Kilat access token, and the tokens for apps you connect inside the agent (such as Notion), are saved on its encrypted disk, so they are also in its snapshots. When several agents run together on a shared host, each agent's secrets, such as a Telegram bot token or your own model key, are kept in memory only, not on the disk.

What we do not store: Kilat AI's router does not keep your prompts or the model's replies, only the usage record above. Our account database has no table of chat messages. Chat replies pass through it on the way to your browser and are removed within 1 day.

You can delete a chat from the chat list at any time. Deleting an agent deletes its data. Copies in checkpoints and snapshots then expire on the schedule below.

Service providers and storage

Our account, billing and service records are stored in a PostgreSQL database on Amazon Web Services in Jakarta. Amazon Web Services hosts the servers that run KilatBot and your agents. Cloudflare handles DNS and network services, and the bot check on sign-up. Resend delivers transactional emails. Telegram delivers internal account and billing notifications to Kilat staff. Google supports OAuth sign-in. The site's fonts are served from our own servers, so no visitor data goes to Google for fonts. GoPay and ShopeePay QRIS payment services handle payment information needed for payment matching. These providers receive only the data needed for their function.

Kilat AI sends your agent's requests to Google Cloud Vertex AI (Gemini and DeepSeek models). If Vertex AI is unavailable, the request goes to Amazon Bedrock instead. Google may keep requests for a limited time to cache repeated prompts and, where its terms apply, to check for abuse. It does not use them to train models. DeepSeek models are processed by Google Cloud under the same terms. Amazon Bedrock does not use requests to train models. If you use your own API key, your chosen provider processes the requests under its own terms.

Sentry receives error reports when configured. The application disables automatic user/IP collection, cookies, headers, request and response bodies, query parameters, job arguments, breadcrumbs, and performance tracing. Error messages, stack traces, and URL paths can still contain information needed to diagnose failures. This error reporting is separate from optional marketing tracking.

To show prices in your currency (rupiah in Indonesia, US dollars elsewhere), we look up the country of your IP address in a database stored on our own server. Your IP address is not sent to anyone for this, and the country is not stored. IP geolocation by DB-IP, licensed under CC BY 4.0.

Messages to your agent's Telegram bot can pass through KilatBot's message inbox on Amazon Web Services in Jakarta, so they can wake a sleeping agent. They're encrypted, never logged, and deleted once delivered. If delivery fails they're kept for up to 24 hours, then up to 4 more days for troubleshooting, before deletion.

Apps you connect yourself, such as Google, Meta (Instagram and Threads), Telegram, GitHub, Notion, Airtable and Cloudflare, receive what you or your agent send them, under their own terms.

Data sent outside Indonesia

Your account records and your agent's data are stored in Jakarta. Some providers process data in other countries:

• Google Cloud Vertex AI. Kilat AI requests, including the text, images and voice notes your agent sends to the model. Google's global endpoint chooses the location, so processing can happen outside Indonesia. Google may keep requests for a limited time, as described above.
• Amazon Web Services. The Bedrock fallback answers text in Jakarta; its image model can run in other AWS regions. The live browser your agent can use runs in Singapore.
• Cloudflare. Network data such as your IP address, on its global network.
• Resend. Your email address and the emails we send you.
• Sentry. Error reports, stored in the United States.
• Google and Meta. Sign-in with Google, optional homepage tracking, and the Google and Meta apps you connect.
• Telegram. Messages to and from your bot, and approval messages you choose to receive there.

We send data abroad only as far as needed to provide the service. Each provider handles it under its own published data protection and security terms. AI providers do not train on your requests. When you use Kilat AI or connect an app, the data it needs goes to that provider. We do not promise that processing stays in Indonesia. If you need that, do not use Kilat AI: use your own model key from a provider you choose, or contact us first.

Cookies and optional tracking

Authentication and security use necessary session mechanisms. The homepage may offer optional Google Analytics, Google Tag Manager and Meta Pixel measurement only when configured. These providers load only after you accept optional tracking. They measure homepage visits and signup-link clicks; a click is not a completed signup. Application events do not send your email, account ID, or form content, but the providers can receive network/device information and set cookies.

Accept or reject in “Cookie preferences” in the homepage footer, which opens on your first visit. Open it again at any time to change or withdraw your choice. Consent choice is saved in browser local storage; unavailable storage defaults to no tracking on the next visit. Global Privacy Control prevents optional tracking. Withdrawal stops future page tracking after reload; existing provider cookies can be removed in browser settings. Optional Google/Meta tracking is not installed on legal, account, or dashboard pages.

AI assistant connections (MCP)

You can connect an AI assistant, such as Claude or ChatGPT, to your workspace through KilatBot MCP. You approve each app on a KilatBot consent screen. With read access it can see your agents, websites, plan and settings, and list your backends and their schemas. It can change things, read backend records or wake a sleeping agent (which uses your plan's awake time) only if you also allow that. It cannot pay for anything or change your plan.

KilatBot receives only the tool calls the assistant makes and their inputs, never your chat history or the assistant's memory. Tool inputs are not written to our request logs. Files, notes and instructions you send through tools become your agent's data and are kept like the rest of it. Backend records the assistant reads or writes may include your own customers' personal data. We store the app's name and return address, and its tokens in hashed form: an access token expires after an hour, and a refresh token lets the app renew it until you disconnect. Changes record that they came through MCP. What the assistant does with the results is governed by its provider's own policy.

Request logs are kept for up to 90 days. Disconnect an app at any time under Account, then MCP: its tokens stop working at once, and its connection records are deleted 30 days later. Apps no workspace is using are removed after 30 days.

Google Drive, Docs, Sheets, Slides, Calendar, Gmail, Tasks and Search Console

When you connect Google, we store your Google account email and your access and refresh tokens, encrypted. Your agent never sees the tokens. You add each Google feature on its own, and KilatBot asks only for that feature’s permission. For Drive, Docs, Sheets and Slides it asks for drive.file: it can open files you choose in Google’s file picker and files your agent creates, and nothing else in your Drive. We keep a short log of which file each write touched, not the file’s content.

We use this only to read, create and update those files when you or your agent ask. The text your agent reads is processed by the AI model that runs your agent (Amazon Bedrock or Google Vertex AI) to answer you, and is not used to train models. KilatBot’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The same applies to the features below, each only when you add it:

• Calendar (calendar.events): your agent reads your events to find free time, and adds or changes events on your primary calendar. An event with other people on it is only created, changed or cancelled after you approve it, because Google emails those people.
• Gmail send (gmail.send): send only. KilatBot can’t read your inbox or any email you received. Your agent can only ask to send a plain-text email, and every email waits for you or an admin to approve the exact recipients, subject and text before it is sent from your account.
• Tasks (tasks): your agent reads, adds, changes and completes tasks in your Google Tasks lists.
• Search Console (webmasters.readonly): read only. Your agent reads search data, indexing status and sitemaps for the sites your Google account can see in Search Console, only to answer you. KilatBot can’t add, remove or change sites or sitemaps. This data is not used for ads or to train models.

While an email or invite waits for approval, we store its recipients, subject, text and event details encrypted, so you can review them. Once Google is disconnected, we keep only a short record of each one (when, who approved it, and Google’s id for it), not its content.

To delete it, tap Disconnect under Integrations, then Google. We revoke the access at Google, delete the tokens, and clear the recipients, subjects, text and event details of every email and invite your agents asked to send. You can also remove KilatBot in your Google Account, under Security, then Third-party connections.

Threads

When you connect Threads, we store your Threads user ID and username, and your access token, encrypted. Your agent never sees the token. We also store the text of each post, reply or delete your agent asks for, and its status. A reply card can quote the reply it answers, including that person's username and words. Search results are not stored.

We use this only to post, reply, delete, show insights and search when you ask or approve. Posts go to Meta, which runs Threads, under its own terms. Our records are stored like the rest of your account, on Amazon Web Services.

To delete it, tap Disconnect under Integrations, then Threads. Or remove Kilat Threads in Threads, under Settings, then Website permissions. Either way, we delete the token and the text, usernames and links of your Threads posts and requests. We keep only their status, dates and a one-way fingerprint of the text, so an auto-reply never repeats.

Instagram

When you connect an Instagram Business or Creator account, we store its Instagram account ID and username, the Meta user ID of the connection, and the access token, encrypted. Your agent never sees the token. KilatBot can then read your profile, your own posts, comments and mentions on your posts, direct messages sent to your account, and your account and post insights. We store the comments and direct messages (with the sender’s username), the posts and replies your agent drafts, and their status.

We use this only to help you run your own account through your agent. Every post, reply, hidden or deleted comment, and direct message waits for you or an admin to approve it, except comment auto-replies that you turn on yourself. The text your agent reads is processed by the AI model that runs your agent (Amazon Bedrock on Amazon Web Services, or Google Cloud Vertex AI) to answer you. Our records are stored on Amazon Web Services. If you choose Telegram approvals, the approval message quotes the comment or message and the sender’s username in your own Telegram chat. This data is not used for ads, sold, or used to train models. Posts and replies go to Meta, which runs Instagram, under its own terms.

We keep comments and direct messages for 30 days, then delete them. Requests to reply to a comment or message keep their text for up to 30 days. Post drafts and posted captions are kept until you disconnect. Content your agent already read can stay in that agent’s chat history until you delete the chat or the agent.

To delete it, tap Disconnect under Integrations, then Instagram. We ask Meta to revoke the access, delete the token, and delete the account’s comments and messages and the text of its drafts and approvals. You can also remove Kilat Social in Facebook, under Settings, then Business integrations, or ask Meta to delete your data: we then do the same. Or email support@kilat.host.

How long we keep data

Deleting an agent or service does not delete billing records, or copies in snapshots and backups before they expire. Records held by a provider follow that provider's schedule. Avoid placing secrets or personal information in public service names or URLs.

Your rights and requests

Under UU PDP you can ask us to:

• tell you what data we hold about you and how it is used, and give you a copy;
• complete, update or correct it;
• stop using it, delete it or destroy it;
• withdraw a consent you gave;
• delay or limit how it is used;
• send it to you or another service in a common format;
• review a decision made only by automated processing that seriously affects you.

Some steps are automatic: a service is suspended when its renewal is not paid, and usage and abuse limits apply on their own. You can ask a person to review any of these by writing to support. We make no other decisions about you by automated means alone. Your agent's replies are produced automatically; you decide how to use them.

You can do much of this yourself: delete chats, files, agents and services in the dashboard, and disconnect Google, Threads or Instagram to delete their data as described above. For anything else, write to the support email below from your account email. We may need to verify that you own the account first. Within 3 × 24 hours of a request we can verify, we confirm it and act on requests to see, correct, or limit the use of your data, and on a withdrawn consent. We complete deletion and other requests within 30 days. Copies in snapshots and backups then expire on the schedule above. If we cannot do what you ask, for example because a record must be kept for billing, disputes, security or the law, we tell you why.

If you are a customer of a business that uses KilatBot, ask that business first: it controls your data. We help it answer you. You can also report a concern to the Indonesian authority responsible for personal data protection, and you have the right to claim compensation under UU PDP.

If data is exposed

If we fail to protect personal data, we notify the affected account owners and the authority in writing within 3 × 24 hours of becoming aware. The notice says what data was exposed, when and how, and what we are doing about it. Where the data belongs to your customers, we notify you without undue delay and within 3 × 24 hours, so you can inform them and the authority.

Children

KilatBot is for businesses and adults. It is not intended for anyone under 18, and we do not knowingly collect their data. If we learn that someone under 18 has an account, we close it and delete its data. If you believe a child has an account, contact us.