BAIK Digital Sign in

Privacy Policy

Effective date: 2026-10-28

Ringkasan: Kebijakan ini menjelaskan data apa yang dikumpulkan aplikasi di aplikasi.baikdigital.id (BAIK Ads OS, Baik Helper, dan Creative Workspace), untuk apa dipakai, dengan siapa dibagikan, berapa lama disimpan, dan cara meminta penghapusan. Versi bahasa Inggris di bawah adalah teks acuan.

1. Who we are

PT. Berkarya Anugerah Inovasi Kreatif ("BAIK Digital", "we") operates the applications at https://aplikasi.baikdigital.id: BAIK Ads OS, an internal advertising operations application used by our staff, and the Creative Workspace, prompt tools available to our customers. Registered address: Komplek Diamond Residence no 8C, Medan Estate, Deli Serdang, Sumatera Utara. Privacy contact: baikcorporate@gmail.com.

This policy also covers Baik Helper, our Meta developer application and the authorized staff integrations operated under that name. Baik Helper and BAIK Digital refer to the same operator, PT. Berkarya Anugerah Inovasi Kreatif.

2. Information we collect

Accounts (all users)

  • E-mail address, profile name where provided, and authentication information handled by our sign-in provider.
  • Roles and access grants, for example which tools a customer may use or which clients a staff member is assigned to.
  • Authentication activity and rate-limit records used to protect sign-in.

Creative Workspace

  • The prompt tools keep your saved work and form inputs in your own browser's local storage. They are not sent to our servers.

BAIK Ads OS: data from TikTok API for Business

Only for advertiser accounts whose owners authorized BAIK Ads OS, and only within the permissions they granted:

  • Advertiser account ID, name, currency, time zone and account status.
  • Campaign IDs, names, objectives, budget settings and operation status.
  • Daily campaign-level performance metrics: spend, impressions, clicks, CTR, CPC and CPM.
  • The access token issued by TikTok and the list of granted permission scopes. The token is stored encrypted and is never shown to users or sent to the browser.

We do not request advertiser contact details (e-mail, phone, address), we do not access lead or form data, and we do not access personal data of people who view the ads.

Baik Helper: data from Meta

When a Meta connection is authorized and enabled, the requested workflow may process:

  • Business Portfolio, ad account and Page identifiers, names, assigned access, account currency, time zone and status.
  • Campaign, ad set and ad identifiers, names, delivery settings, budgets and creative references; aggregate advertising performance such as spend, impressions, reach, clicks and available conversion metrics.
  • Content published by authorized Pages, including post and video identifiers, captions, media references and engagement totals, for creative review and Page management. Media access depends on the asset owner's authorization and the relevant Meta endpoint and permission.
  • Access credentials, granted scopes and token validity information, used privately by the operator's integration runtime to make authorized API requests.

Access is limited to the permissions actually granted and assets the business or client has authorized. An unconnected workflow does not collect Meta data. We do not request private messages, leads, contact lists or personal profiles of advertising audiences through these workflows. Reading unrelated public Pages requires a separately permitted use case and the relevant Meta access.

Service workspaces and activation

The application includes workspaces for creative assets, audiences, catalogs, Business Center, measurement, stores, TikTok accounts and creator collaborations. An unconnected service does not collect TikTok data. Activating additional data collection requires the relevant account authorization, service permissions, and an updated disclosure of the data categories and purposes before collection begins. These workspaces do not currently accept customer-list uploads or transmit conversion events.

BAIK Ads OS: operational records

  • Change proposals, approvals and rejections, execution results, and an audit log of who did what and when.
  • Short-lived authorization state records (stored only as hashes) used to protect the TikTok authorization flow.
  • Cached copies of recently read campaign lists and report metadata, used to show when data was last fetched.

Technical data

  • Our hosting provider processes request data such as IP address, browser type and request time in order to deliver the site.

3. How we use information

  • To operate the applications and authenticate users.
  • To show each advertiser account's data only to staff assigned to the client it is mapped to.
  • To prepare, review, approve and carry out changes to campaigns that authorized staff approve. Changes are sent to TikTok only after approval and only when the operator has enabled live changes.
  • To keep an audit trail, investigate problems and protect the service.
  • To respond to support and deletion requests.

We do not sell personal data. We use TikTok and Meta data only to provide reporting, creative review and account operations for the business or client that authorized access, not to build unrelated personal profiles or share one client's data with another.

We process account information to provide the service you request, advertiser information under the authorization granted by the account owner, and limited security records to protect the service and meet legal obligations. When processing relies on consent, you may withdraw that consent through the contact below.

4. AI-assisted work

TikTok

BAIK Ads OS includes a restricted internal interface for agents operated by BAIK Digital. An agent can read data of the clients assigned to it and create change proposals. It cannot approve or execute changes, change settings, or obtain TikTok credentials. The application does not send TikTok data to third-party AI model providers or use it to train AI models. Any material change to this processing will require an updated policy and any necessary authorization.

Meta and staff assistants

Authorized staff may use Claude Code (Anthropic) or Codex (OpenAI) to assist with technical integration, reporting and analysis. If this involves Meta data, only the minimum client-authorized information necessary for that task may be processed by the selected provider. This requires a business service configuration and contractual terms that limit processing to providing the requested service and exclude use for the provider's own model training. Without those conditions, staff must use synthetic examples or non-client technical information.

Access tokens and app secrets must remain in the private integration runtime, not in prompts, screenshots or assistant responses. Staff must review and explicitly approve any proposed change to a live Meta advertising account before it is executed. We do not use Meta platform data to train general-purpose AI models or permit assistants to bypass Meta permissions.

5. Sharing

We share information only with service providers that run the applications on our behalf, and as required by law:

  • Cloudflare Workers and D1: application hosting, authentication and database.
  • Meta: authorized Graph API and Marketing API requests for the relevant business assets.
  • Anthropic and OpenAI: only for the limited, staff-initiated Meta assistance described in section 4 and subject to its restrictions. TikTok data is excluded.
  • TikTok: requests are sent to TikTok API for Business on behalf of authorized advertisers, for example to read campaigns or apply an approved change.

These providers may process information outside Indonesia. We use providers under their applicable data-processing terms and require safeguards for international transfers as required by Indonesian law.

6. Security measures

  • TikTok access tokens are encrypted with AES-256-GCM using keys held only by our server environment.
  • BAIK Ads OS database access is mediated by our server. Meta integration credentials are kept in private runtime configuration, excluded from source control and public browser builds.
  • In BAIK Ads OS, per-client access checks run on the server for every request; one advertiser account can be mapped to only one client at a time.
  • Actions are recorded in an audit log that cannot be edited through the application.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If a personal-data incident requires notification, we will notify affected people and the relevant authorities within the applicable legal deadlines, describing the impact and protective steps. You can report a suspected incident to baikcorporate@gmail.com.

7. Retention

  • When a TikTok connection is disconnected, its stored access token is deleted immediately, its advertiser mappings are removed, and we request revocation at TikTok when that option is selected.
  • When an advertiser account is unmapped from a client, cached reads for that client and account are deleted and open proposals are cancelled.
  • For Meta workflows, credentials are retained only while the authorized connection is needed. On a verified withdrawal or deletion request, our team stops the relevant access, removes locally held credentials and deletes related content, report exports and cached records under our control when they are no longer needed for the authorized purpose. Providers processing that data on our behalf are included in the request.
  • Account data is kept while the account is active and deleted on a verified request.
  • Audit log entries are kept for up to 12 months from the recorded activity, unless earlier deletion is required by law or a specific legal obligation requires limited longer retention. They never contain tokens or secrets.

Deletion requests are handled by our support team. We aim to complete verified deletion requests promptly and within 30 calendar days, or sooner where applicable law requires. We notify you when the request is completed or explain any lawful exception and the information affected.

8. Your choices

You can request access, a copy, correction, deletion, restriction of processing, or withdrawal of consent for your personal data. You may also request a structured, commonly used, machine-readable copy where applicable, object to processing on the grounds available under applicable law, and raise a privacy complaint with us or the competent authority. Advertisers can also ask us to disconnect their accounts. We may request proportionate information to verify your identity and authority before handling a request. Applicable statutory response periods take priority over our general service timelines. See Data deletion or contact baikcorporate@gmail.com.

9. Cookies and browser storage

  • Sign-in: the application stores your authentication session in your browser's local storage so you can remain signed in. Sign out when using a shared device.
  • Preferences and saved work: browser storage keeps your chosen workspace language and work saved by the Creative Workspace tools.
  • Authorization security: a short-lived, secure, HttpOnly cookie binds a TikTok connection attempt to the browser that started it. It expires automatically and is cleared when the callback is processed.

These items support the requested functionality and security; they are not used for behavioral advertising. You can remove cookies and site storage through your browser settings. Doing so may sign you out, reset preferences, erase locally saved work or interrupt an authorization in progress.

10. Children

The applications are business tools and are not directed to children.

11. Changes

We will update this page when our practices change and revise the effective date above. For material changes affecting existing users, we will provide an appropriate notice through the service or the account contact before the new processing begins, unless an immediate change is required by law or security needs. If a change requires consent or platform authorization, we obtain it before that processing begins.

BAIK Drive Sheets Docs dan Rclone Backup

Google application disclosure last updated: 2026-10-01

Ringkasan: Akses Drive penuh mencakup file yang sudah ada, bukan hanya file yang dibuat aplikasi. Data diproses sesuai pekerjaan yang Anda izinkan; workflow AI dan backup rutin memiliki tujuan berbeda. Backup lokal dikonfigurasi 3 hari dan backup Drive 30 hari. Mencabut OAuth menghentikan akses berikutnya, tetapi penghapusan salinan tersimpan perlu diminta kepada pengelola.

Operator and scope

BAIK Drive Sheets Docs is operated by BAIK Digital / PT. Berkarya Anugerah Inovasi Kreatif for the operator and specifically authorized users. Server-side workflows use rclone and Google Drive, Sheets, and Docs APIs. The Desktop OAuth clients BAIK AI Team - Drive Sheets Docs and Rclone Backup support AI-assisted work and routine backups respectively. This Google section describes those workflows separately from the existing TikTok, Meta and Creative Workspace services above.

Google data accessed

  • Google account identity needed to verify the connection and identify the account granting access.
  • Drive file and folder metadata, and the contents of files processed for an authorized task or backup.
  • The contents of Google Sheets and Google Docs related to the task.
  • OAuth access and refresh tokens issued for the authorized connection, where applicable.

Purposes, permissions and actions on your behalf

We use this data to organize existing files and folders, read, create and update Sheets and Docs, upload and download files, prepare reports and documents, store work assets, and run backups. Files or backup copies may be deleted when required by the authorized task or the configured backup retention.

Full Drive permission is required to manage existing files and perform backups. It is not limited to files created by this application. The permission can cover files available to the connected Google account; our use remains limited to the work you authorize and the disclosed backup purpose.

Storage and retention

Working copies, completed work, reports, operational documents, backups and OAuth tokens may be stored on systems operated by the operator. Tokens support subsequent authorized Google API access.

Configured BAIK backup retention: local copies 3 days; Drive copies 30 days. These periods apply to routine backup copies. They do not set a retention limit for every working file, report or operational document. Other operational copies are retained while needed for the authorized purpose or an applicable legal obligation; deletion requests can be made using the contact below.

Service providers and AI-assisted processing

Google receives API requests for the connected account. Hosting, storage and other service providers may process data needed to run the authorized service. For an AI workflow, relevant material may also be sent to the AI service provider used for that workflow, with the user's authorization, to process the material and prepare the requested result.

AI-assisted processing and routine rclone backups are distinct purposes. A routine backup copies and stores data; the AI workflow processes task material to produce work results. Only information needed for the authorized workflow may be shared for that purpose.

Google user data access, use and transfer are subject to the Google API Services User Data Policy, including its Limited Use requirements. The existing TikTok and Meta disclosures above continue to apply to their respective services.

Revoking access

Open Google Account third-party connections, select the relevant application connection and remove its access or connection. Revocation stops subsequent Google API access through that authorization. It does not automatically delete working copies, completed work or backups already stored by the operator.

Requesting deletion of stored copies

E-mail baikcorporate@gmail.com with the subject BAIK Drive Sheets Docs data deletion. Identify the Google account and the relevant copies or work so we can verify your authority and handle the request. Do not send a password or OAuth token. The operator handles verified deletion requests for copies under its control; revoking Google access and requesting deletion of stored copies are separate actions.

Contact and developer support: baikcorporate@gmail.com. Operator: BAIK Digital / PT. Berkarya Anugerah Inovasi Kreatif.

Google Ads API integration is a future feature and is not activated by these information pages. An authorized future workflow may process advertiser account identifiers, campaign or ad information, settings, and aggregate performance reports for the approved advertising task. Before access begins, we will disclose the actual permissions, available operations and retention, obtain the advertiser owner's authorization, and update this policy where needed. This description does not authorize a live campaign or budget change.