This policy explains how Kaifunds LLC ("Suarga", "we") handles personal data when you visit suarga.app or use the Suarga app, API and MCP server. For data you put into Suarga about other people, such as your clients' content, you are the controller and we are your processor; our Data Processing Addendumcovers that.
Who is responsible
The controller for account and billing data is Kaifunds LLC, a New Mexico limited liability company, 444 Alaska Avenue, Torrance, CA 90503, United States. Privacy questions: privacy@suarga.app.
Suarga is developed and operated for us by PT Karia Nata Group, a limited liability company incorporated in Indonesia, Dukuh Runting RT.1/RW.2, Desa Tambaharjo, Kecamatan Pati, Pati, Central Java 59119, Indonesia. It also owns the Suarga app registered with Meta that you approve when you connect Instagram, Facebook or Threads. It processes personal data only on our behalf, under a written agreement, and is listed with our other sub-processors below.
What we collect
- Account data: name, email, Google sign-in identifier if you use it, workspace and team membership. We sign you in with email links or Google, so we never hold a password.
- Connected account data: identifiers, names and profile images of the social accounts you connect, and the access granted to our connection provider.
- Content: the posts, media, schedules, rundowns, campaigns and approval comments you create.
- Post statistics: views and engagement for posts published through Suarga, used for canary releases, evergreen scores and reports.
- Billing data: billing name, address and tax ID. Card details are collected and held by Stripe, not by us.
- Technical data: IP address, browser type and request logs, kept for security and debugging.
The marketing site does not use analytics cookies, advertising pixels or tracking scripts.
Why we use it, and the legal basis
- To provide the Service you signed up for, including publishing your posts (contract).
- To bill you and meet tax and accounting rules (contract, legal obligation).
- To keep the Service secure and prevent abuse (legitimate interests).
- To send service emails such as sign-in links, approvals, failure alerts and reports (contract).
- To send product news, only if you opt in (consent, which you can withdraw at any time).
We do not sell personal data, and we do not use your content to train AI models.
Who processes data for us
We use the following sub-processors. Your content and connected account details pass through our social publishing provider when posts are published.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| PT Karia Nata Group | Develops, operates and supports the Service, including our official integrations with Instagram, Facebook and Threads | All service data, only as needed to run, secure and support the Service | Indonesia |
| Social publishing provider | Connects your social accounts and publishes the posts you schedule | Post content and media, social account identifiers, publishing status and post statistics | Indonesia |
| Cloudflare, Inc. | Hosting, application runtime, file storage, bot protection | All service data in transit and at rest, request metadata | Global edge network, United States |
| Neon | Managed Postgres database | Account, workspace, schedule and post data | United States |
| Stripe, Inc. | Payments, invoicing and sales tax | Billing name, email, address, payment details (held by Stripe, not by us) | United States |
| Resend, Inc. | Transactional email (sign-in links, approvals, reports, alerts) | Email address, email content | United States |
| Google LLC | Optional sign-in with Google | Name, email address, profile picture | United States |
Social platforms (Instagram, Facebook, Threads, TikTok, LinkedIn, X, YouTube and others) receive your posts because you ask us to publish there. Their own privacy policies apply to what they do with it.
International transfers
Some sub-processors are outside the European Economic Area and the UK. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on an adequacy decision.
How long we keep it
- Account and content data: while your workspace is active. After you close it, you can export for 30 days; then it is deleted within a further 30 days.
- Backups: overwritten within 30 days.
- Billing records: as long as tax law requires, usually up to 10 years.
- Security logs: up to 90 days.
Details are on the data deletion page.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict some processing, and withdraw consent. Write to privacy@suarga.app; we answer within 30 days. You can also complain to your local data protection authority.
Security
Data is encrypted in transit and at rest. Access tokens for connected accounts are held by our connection provider, not stored in plain text by us. Staff access is limited to what is needed to run and support the Service.
Children
Suarga is not meant for anyone under 18, and we don't knowingly collect their data.
Changes
We will post updates here and email account owners about material changes before they take effect.