Privacy Policy

Who runs the service

MarkasAI is operated by MarkasDev, legal entity PT. Teknologi Nggoro Pratama, with offices at Gedung The CEO Building Lt. 12, Jl. TB Simatupang No. 18 C, Cilandak Barat, Jakarta Selatan, Indonesia. For privacy questions, contact [email protected].

Data we collect

• Account data: name, email address, and password (stored as a hash, never in plain text).
• Google or Microsoft login: if you choose it, we receive your email address, name, and basic profile information from that provider. We never receive your Google or Microsoft password.
• Facebook login: when available and you choose it, we store only your Facebook user ID to link the login. How to remove it is described in Data deletion.
• Sessions: IP address and browser user agent at login, for security and the list of active sessions in your account.
• API usage logs: time, model, token counts, cost, status, and request ID. Prompt and response content is not stored in these logs.
• Balance and transactions: top-up history, balance deductions, and vouchers in Rupiah.
• API keys: stored as hashes; the full key is shown only once when created.

How we use data

• To provide the service: authentication, forwarding API requests to the model you choose, and computing costs.
• To manage balances, top-ups, and billing.
• To send service emails from [email protected], such as email verification, password resets, and account notices.
• To keep the service secure: preventing abuse, rate limiting, and investigating incidents.
• To meet legal obligations in Indonesia.

We do not sell your personal data and do not use your prompt content to train models.

Request content and AI model providers

To answer a request, the prompt content (including any images or files you send) is forwarded to the third-party provider running the model you chose. Processing on the provider's side is subject to that provider's policies. MarkasAI does not store prompt or response content in usage logs.

The gateway may tidy whitespace in JSON inside prompts to save tokens without changing what the data means; prompt content is still not stored.

Third parties we use

• DOKU: processes top-up payments (QRIS, virtual account, e-wallet). Payment data is processed by DOKU under its own policy; we do not store your card or bank account details.
• Google and Microsoft: when you log in with their accounts.
• Cloudflare: website hosting, network protection, and Turnstile (anti-bot verification on forms).
• AI model providers: process your request content as described above.
• Email provider: sends service emails. [placeholder: SMTP provider name]

Cookies

The dashboard uses a session cookie needed to keep you logged in: HttpOnly, SameSite=Lax, limited to the dashboard host, and valid for up to 30 days or until you log out. Google or Microsoft login also sets a short-lived temporary cookie to secure the login flow. This site uses no advertising or third-party tracking cookies.

Retention and security

Data is kept while your account is active and as long as needed for legal, accounting, and dispute resolution obligations. [placeholder: usage log retention period and server location] We use encryption in transit (HTTPS), hashing for passwords and API keys, and restricted internal access.

Your rights

Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022), you can request access to, correction of, or deletion of your personal data, and withdraw consent. Send requests to the email address above, or follow the data deletion instructions. Some transaction data may be retained where the law requires it.

Changes to this policy

We may update this policy. Significant changes will be announced in the dashboard or by email. See also the Terms of Service.