Privacy Policy

1. Who is responsible

Dicky Ibrohim, an independent engineering partner based in Demak, Jawa Tengah, Indonesia, is the data controller for the processing described here ("I", "me"). You can reach me at hello@dickyibrohim.com for anything related to this policy.

2. What this policy covers

This policy applies to three contexts:

• The website www.dickyibrohim.com, including its contact and booking forms.
• Engineering services I deliver to clients (audits, builds, ongoing partnership).
• Platform integrations I operate on Meta platforms — apps registered under the CLEOVA business (WhatsApp Business Platform / Cloud API, Facebook Login, Instagram Graph API). These send transactional messages (one-time passcodes, order and shipping notifications) and, where offered, let you sign in to a store I build and operate.

3. Data I collect

Contact data

Name, email address, phone number, company — when you write to me, book a call, or place an order on a store I operate.

Email quality data

When you submit the website contact form, the email address is checked by a specialist verification service. This website stores a normalized result such as deliverability, quality score, disposable, role-based, catch-all, and mail-server indicators; your message and other contact details are not sent for this check.

Messaging data

Your WhatsApp phone number, message templates delivered to you, delivery/read status, and any reply you send to a business number connected to my integration.

Login data

When you use Facebook Login: your public profile name, profile picture, and email address as permitted by Meta — nothing else is requested.

Technical data

IP address, user agent and request information used for delivery and security. Optional visit and performance statistics run only after permission.

Project data

Information a client shares during an engagement (repositories, logs, credentials granted for the work) — processed only for that engagement.

4. Why I process it (and legal basis)

• To answer your enquiry or deliver a service you requested — performance of a contract or steps at your request.
• To check whether a contact-form email is deliverable and reduce automated, disposable, impersonated, or abusive submissions — legitimate interest in protecting the enquiry channel. If the checker is unavailable, the message is not stored and you can retry later or use the listed direct contact channel.
• To send transactional WhatsApp messages you triggered (verification code, order confirmation, shipping update) — performance of a contract; you can opt out of non-essential updates by replying STOP.
• To authenticate you via Facebook Login when you choose it — your consent, withdrawable at any time by removing the app from your Facebook settings.
• To deliver and secure this website (rate limiting and abuse detection) — legitimate interest. Optional visit and performance statistics — your permission, which can be withdrawn in Privacy choices.
• To comply with legal obligations under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and, where applicable, the GDPR.

5. Who I share data with

I do not sell personal data. Data is shared only with processors needed to run the service:

• Meta Platforms, Inc. — delivers WhatsApp messages and Facebook Login on my behalf under Meta’s own terms and privacy policy.
• Cloudflare, Inc. — hosting, CDN, DNS, and security for this website and related services.
• A specialist email-quality processor — receives only the submitted email address to assess syntax, domain and mail-server availability, deliverability, and common risk indicators. The provider’s brand and credentials are not exposed to the browser.
• Email and calendar providers used to respond to enquiries and schedule calls.
• Clients whose store you interacted with — the store owner is the merchant of record for your order and receives the data needed to fulfil it.
• Authorities, when required by law.

6. How long I keep it

• Enquiries and correspondence: up to 24 months after the last contact.
• The normalized email-quality result: kept with the related enquiry for the same period. This website does not store the checker’s raw upstream response.
• Messaging logs (WhatsApp delivery status, OTP records): up to 90 days, then deleted or anonymised.
• Order-related data held by a store: for the statutory retention period required for tax and accounting in Indonesia.
• Technical logs: up to 30 days.
• Login data: until you remove the app or request deletion.

7. Your rights

Under UU PDP and, where it applies, the GDPR, you may access, correct, port, restrict, object to, or delete personal data I hold about you, and withdraw consent at any time. To exercise a right, email hello@dickyibrohim.com — I respond within 7 days and complete requests within 30 days.

To delete data specifically, follow the steps at https://www.dickyibrohim.com/data-deletion/. If you believe your rights are not respected, you may lodge a complaint with the Indonesian data protection authority or your local supervisory authority.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256-GCM for secrets and sensitive fields). Access is role-based and logged. Passwords, where used, are hashed with Argon2id. Webhooks from Meta are verified with signed payloads before processing.

9. Cookies and tracking

Essential storage supports security, admin login sessions, your selected theme and your privacy choice. The first-party di_privacy cookie remembers your choice for 180 days; it contains a choice and timestamp, not an advertising identifier. Cloudflare may use necessary security and Access cookies to protect the site and admin login.

Optional visit and performance measurement uses Cloudflare Web Analytics, which does not use advertising cookies. Statistics are off until you allow them. Browser Global Privacy Control and Do Not Track signals keep optional statistics off. You can withdraw permission through Privacy choices in the footer; turning off already active statistics refreshes the page. No advertising trackers are installed. Stores I operate describe their own cart, session and optional cookies separately.

10. Children

The website and services are not directed at children under 18. I do not knowingly collect their data; if you believe a child provided data, contact me and it will be removed.

11. International transfers

Processors such as Meta, Cloudflare, and the email-quality processor may process data outside Indonesia. Transfers rely on the processor’s contractual safeguards and equivalent protection required by UU PDP.

12. Changes to this policy

When this policy changes, the effective date at the top is updated. Material changes affecting platform integrations are also announced through the relevant service.