Privacy Policy

1. Information We Collect

We collect information that identifies, relates to, describes, or could reasonably be linked to you.

• Google Account DataWhen you sign in using Google Single Sign-On (SSO), we collect your name, email address, and profile picture. This is the only Google data we collect from users who are not photographers.
• User-Generated Content (Users)To facilitate our core service, you may upload reference photos of yourself, your identifying features, and your visual characteristics.
• User-Generated Content (Photographers)Event photos uploaded for sale on the platform.
• Google Drive Files (Photographers only)If you opt into "Photographer Mode," we request the https://www.googleapis.com/auth/drive.file scope. We only access the specific files you manually select using the Google Drive Picker. We do not have read access to your entire Google Drive, and we never browse, list, or search your Drive. Users who do not opt into Photographer Mode are never asked for Drive access.
• Financial InformationPayments and payouts are processed securely by our third-party payment gateway, Xendit. We do not directly collect or store your credit card numbers or bank account routing details on our servers.

2. How We Use Your Information

The data we collect is used exclusively to provide and improve our core marketplace services:

• AI-Powered MatchingThe Platform leverages advanced third-party artificial intelligence and machine learning algorithms to automatically match Users to photos based on visual attributes and unique characteristics.
• Processing TransactionsTo facilitate the buying and selling of high-resolution images.
• CommunicationTo send you purchase receipts, payout notifications, and critical account updates.

3. Google API Limited Use Disclosure

Cekrek's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we commit that:

• We limit our use of Google user data to providing or improving user-facing features that are prominent in the Cekrek interface.
• We do not transfer Google user data to others except as necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with user notice and consent.
• We do not use Google user data for serving personalized, re-targeted, or interest-based advertisements, and we do not sell it to data brokers or any other third party.
• We do not allow humans to read your Google user data unless we have your affirmative agreement for specific files, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data has been aggregated and anonymized.

4. Retention and Deletion of Google Data

We keep Google data only as long as it is needed for the feature you enabled:

• Drive authorization tokensIf you connect Google Drive as a photographer, your OAuth refresh token is stored server-side, encrypted at rest, and is used solely to read the files you select. It is deleted immediately when you disconnect Drive or delete your Cekrek account.
• Selected Drive filesFiles you pick in the Google Drive Picker are streamed once into our processing pipeline. We retain only the resulting listing images and derived matching data — we do not keep a mirror of your Drive, and we do not re-read files you have not selected.
• Profile dataYour name, email address, and profile picture are retained for as long as your account exists, and are deleted when you delete your account.

You can revoke Cekrek's access to your Google Account at any time at https://myaccount.google.com/permissions.

5. Data Sharing and Disclosure

We do not sell your personal data. We only share information with authorized third-party service providers who assist us in operating our platform:

• Cloud Infrastructure & AI ProcessingEnterprise-grade cloud hosting and artificial intelligence service providers used strictly to host our database and process the visual matching algorithms.
• Payment ProcessingXendit (for handling Indonesian local payments and disbursements).
• Legal ComplianceWe may disclose your data if required to do so by Indonesian law or in response to valid requests by public authorities.

6. Your Rights Under Indonesian PDP Law (UU No. 27/2022)

As an Indonesian user, you possess full rights over your personal data:

• Right to Access & RectificationYou may access and update your profile information and reference photos at any time within your account settings.
• Right to Erasure (Right to be Forgotten)You have the right to request the complete deletion of your account, your reference photos, and associated metadata. You can exercise this right instantly via the "Delete Account" button in your Profile Settings, or by contacting our support team.
• Right to Withdraw ConsentYou may disconnect your Google Drive access from within Cekrek, or revoke your SSO and Drive permissions directly at https://myaccount.google.com/permissions, at any time.

7. Data Security and Breach Notification

We implement robust, industry-standard security measures to protect your data. In the unlikely event of a data breach that compromises your personal information, we will notify you and the relevant Indonesian authorities within 72 hours of discovering the breach, as mandated by law.

8. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact our Data Protection Officer at: privacy@cekrek.co.id.