AE Social

Privacy Policy

Last updated: 17 August 2026

This Privacy Policy explains how PT Alexander Elena Consulting ("AE Social", "we", "us") collects, uses, stores, and protects information when you use our services, including data accessed from your connected Facebook Pages and the Instagram accounts linked to them.

1. Who we are

AE Social is operated by PT Alexander Elena Consulting, registered in Indonesia, with a registered address at Pantai Kedonganan No. 6B, Desa/Kelurahan Tuban, Kec. Kuta; Desa/Kelurahan Seminyak, Kec. Kuta, Kab. Badung, Provinsi Bali, Indonesia 80361. For any privacy question you can reach us by email.

2. Information we access and process

When you connect your Facebook Pages and the Instagram accounts linked to them through Meta's official platform, and only with the permissions you grant, we may access and process:

  • Incoming content on your Pages and connected Instagram accounts: comments, mentions, posts and stories that reference you, and reactions.
  • Your connected Instagram account's profile and its own posts, with their engagement counts, as provided by Meta.
  • Messages sent to your Page (Messenger) and to your connected Instagram account (Instagram Direct), so they can be shown to you and included in the analysis.
  • Public profile information of accounts that interact with your content, as provided by Meta.
  • Engagement signals on your content, such as counts of reactions and comments, and account-level Instagram metrics, as provided by Meta.
  • The goals and preferences you configure with us so we can tailor the analysis.
  • Basic account and contact details you provide to us directly.

We request only the permissions needed to deliver the service. We do not collect data from your accounts beyond what is described here.

3. How we use the information

  • To analyze incoming social content against the goals you set and generate insights.
  • To produce reports and recommendations for you.
  • To operate, maintain, secure, and improve our services.
  • To communicate with you about your account and support requests.

We do not sell your data. We do not use the content of your accounts for advertising.

4. Legal basis for processing

We process personal data under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and any other applicable law. We rely primarily on your consent, and additionally on the performance of our contract with you, compliance with our legal obligations, and our legitimate interests in operating, securing, and improving the service.

5. Sharing and third parties

We share data only as needed to run the service:

  • Meta Platforms. We access your data through Meta's APIs in accordance with the Meta Platform Terms and Developer Policies.
  • Service providers. Hosting, infrastructure, and analytics vendors that process data on our behalf under appropriate agreements. Our current key sub-processors are Cloudflare, Inc. (website hosting, DNS, CDN, security, and media storage: copies of images and videos from your connected accounts are stored in Cloudflare R2), Google Cloud Platform (application infrastructure and storage), and Google (Gemini API) for automated analysis of your connected content to generate insights, on API terms under which your data is not used to train their models.
  • Legal. Where required by law or to protect our rights and users.

6. Data retention

We retain data only as long as needed to provide the service and for the periods required by law. We keep the content and insights associated with your connected accounts for as long as your account is active, and delete them within 30 days of account closure or a verified deletion request. If you disconnect our app, Meta immediately revokes our access and the stored token stops working, so we can no longer read your data; we remove the stored credential together with your data on account closure or a verified deletion request. We also track the source: when a post, comment, or mention we have stored is deleted on Facebook or Instagram, we delete our stored copy (including any cached media) - immediately when Meta notifies us, and otherwise on our next verification against the source, at most 14 days later. Limited billing and legal-compliance records may be kept for as long as applicable law requires. When data is no longer needed, or when you request deletion, we remove it as described in our Data Deletion Instructions.

7. Your rights

Depending on your location, you may have the right to access, correct, export, restrict, or delete your personal data, and to withdraw consent. To exercise any of these rights, contact us by email. You can disconnect AE Social at any time from your Facebook settings, which revokes our ongoing access.

8. Data security

We host data on Google Cloud Platform; media files (images and videos) from connected accounts are stored in Cloudflare R2. Data is encrypted in transit using TLS and encrypted at rest (AES-256). Access to connected-account data is restricted to authorized personnel under least-privilege controls, with multi-factor authentication required, and the database is not exposed to the public internet. We maintain a documented incident-response process and will notify affected users and Meta of any confirmed data breach without undue delay. No method of transmission or storage is completely secure, but we work to safeguard your information.

9. International transfers

Your data may be processed in countries other than your own. As permitted under Indonesia's Personal Data Protection Law, such transfers are made only where the receiving country provides an adequate level of protection, or under contractual safeguards (including data-processing agreements with standard contractual clauses) with our providers, or with your consent.

10. Children

Our services are intended for businesses and are not directed at children.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the date above.

12. Contact

Questions about this policy or your data: contact us.