Privacy Policy

1. Who we are

Account Monitor is an internal analytics application operated by Promedia Teknologi (part of Promedia Group) at igstats.promediateknologi.id. In this policy, “we” means Promedia Teknologi, and “you” means the partner who owns or is authorised to manage the Instagram account connected to this application.

We act as the data controller for the data described on this page. Our registered offices and official contact details are in the contact section below.

2. Who this service is for

This is not a public application. Account Monitor is not open to general sign-up. An Instagram account can only be connected if its owner is an official Promedia Teknologi partner — a media publisher, creator, or influencer already under a partnership arrangement with us — and the connection always starts from an invitation link we issue for that specific partner.

This matters to you in a practical way: because we already know every partner and have a direct line of communication with them, any request about your data — including a deletion request — can be verified and acted on directly, without you having to prove your identity through a cumbersome process.

3. Data we collect from Instagram

When you approve the connection, Instagram grants us permission to read the data below through Meta's Instagram Graph API. The application fetches it on a recurring schedule so that the figures in your reports stay current.

Category	What we store	Why
Account profile	Instagram user ID, username, display name, profile picture URL	To identify your account within reports
Access token	The token issued by Meta, its expiry, and the permissions attached to it	The only way the app can read your data. Stored encrypted
Content you publish	Media ID, media type (image, carousel, reels, story), caption, permalink, thumbnail URL, publish time	To show which content performs well
Content metrics	Views, reach, likes, comment counts, saves and shares — per post and per day	Content performance analysis and top-content ranking
Account metrics	Follower count, profile visits, website clicks, daily follows and unfollows	Growth charts and benchmarking across partner accounts
Audience demographics (aggregated)	Age-range and gender distribution, location distribution, and follower active hours — all as percentages or aggregate figures	To identify the best posting times and understand the audience profile
Raw API responses	A copy of Instagram's raw response to our requests, with the time it was fetched	Auditing and troubleshooting when a figure looks wrong

What we never receive: the list of your followers, the identity of people who like or comment on your content, direct message content, comment text, payment details, or your Instagram password. The “Comments” figure in the dashboard comes from the counter Instagram already provides, not from reading individual comments. Audience demographics arrive already aggregated by Meta, so we are technically unable to trace them back to any particular follower.

4. Instagram permissions we request

We request exactly two permissions, and both are genuinely used by features you can see for yourself in the application. We deliberately do not request permissions we do not use.

Permission	Why it is needed
`instagram_business_basic`	Reads the account profile and the list of content you publish, including like and comment counters
`instagram_business_manage_insights`	Reads insights figures: reach, views, profile visits, website clicks, follower growth, and aggregated audience demographics

We do not request permission to manage comments, send messages, or publish content. If we ever need an additional permission, you will be asked to authorise it explicitly — a new permission cannot silently apply to an existing connection.

5. Other data we process

5.1 Dashboard users (our team)

For Promedia Teknologi staff who access the dashboard, we store the name, email address, password as a one-way hash (it cannot be reversed into the original password), the time and IP address of the last login, and a record of actions taken in the system. This is required for security and so that any action affecting your data can be traced to a specific person.

5.2 Tracked-link visitors

If you use the tracked-link (shortlink) feature, each click records the click time, IP address, browser type, and referring page. These records are used purely to count clicks and where they came from — we do not use them to build individual profiles, do not link them to anyone's identity, and do not share them with advertising networks.

5.3 Notifications from Meta

The application exposes one endpoint that receives automated event notifications (webhooks) from Meta for connected accounts. Incoming notifications are stored temporarily for processing. Because we do not request the comment-management permission, notifications containing comment text are not delivered to us.

6. What we use this data for

All of the above is used only for the following purposes:

Producing performance reports for your Instagram account and content.
Benchmarking performance across partner accounts in the Promedia Group network to identify best practices.
Recommending posting times and content types based on audience behaviour.
Generating visual summaries (infographics) from those figures.
Keeping the system secure, preventing misuse, and meeting legal obligations.

What we do not do. We do not sell your data. We do not trade or rent it. We do not share it with data brokers or advertising networks. We do not use it to target ads at your followers. We also do not use your data to train third-party artificial intelligence models.

7. Basis for processing

We process your data on the basis of the consent you give yourself through Instagram's official authorisation screen, and in order to perform the partnership agreement between you and Promedia Teknologi. You may withdraw that consent at any time by revoking the app's access from your Instagram settings — no reason and no approval from us is required.

This processing is carried out with reference to Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection.

8. Storage and security

Encrypted access tokens. Your Instagram token is stored encrypted, never in plain text, and is deleted as soon as the account is disconnected.
Encrypted transport. All access to the application goes over HTTPS.
Role-based access. Not every staff member can see everything; privileges are limited per role.
Audit trail. Significant actions on account data are recorded with the actor, the time, and the IP address.
Account protection. Two-factor authentication and login attempt limiting are available.

Data is stored on DigitalOcean, LLC infrastructure in the Singapore region. This means your data is processed and stored outside Indonesia; by connecting your account, you consent to that transfer. We use a provider that applies industry-standard data-centre safeguards.

We apply reasonable, industry-standard safeguards. Even so, no system can be guaranteed completely impenetrable. We cannot guarantee absolute security, but we commit to notifying you without undue delay if a data breach occurs that affects you, in accordance with applicable law.

9. Sharing data with others

Your data can reach a third party only in the following circumstances:

Infrastructure providers — the server and network providers that run this application, limited to what is technically necessary to operate it.
Meta Platforms — since the data originates from Instagram, exchanging data with Meta is inherent to the service.
Legal obligations — where required by law, a court order, or a lawful request from law enforcement.
Corporate changes — in the event of a merger or transfer of business, on condition that the receiving party is bound by an equivalent privacy policy.

Outside these circumstances, your account data is not shared with anyone.

10. How long we keep data

Access tokens — deleted immediately when the account is disconnected or when you revoke permission from Instagram.
Profile, content, and metric data — kept for as long as the partnership is active, because performance reporting is inherently historical and loses its meaning if the series is broken.
After a deletion request — all of your account data is deleted within 48 hours. See How to Delete Your Data.
Audit records and security logs — may be kept longer on a limited basis where required by law or needed to resolve a dispute, no longer containing your Instagram data.

11. Your rights

As the owner of the data, you have the right to:

Know what data we hold about you, and obtain a copy of it.
Request correction of inaccurate data.
Request deletion of your data.
Withdraw consent at any time by revoking the app's access from Instagram.
Object to, or request restriction of, particular processing.
Lodge a complaint with the competent data protection authority.

Any of these requests can simply be sent to [email protected]. We respond within 48 hours of the request being verified.

12. Revoking access and deleting data

You can disconnect the app yourself at any time through your Instagram settings — you do not need our permission to do so. The full steps, including how to request deletion of data already stored, are on the How to Delete Your Data page.

13. Age restriction

This service is intended for business use and is only used by partners with legal capacity. We do not knowingly collect data from children. If we learn that a connected account is managed by someone without legal capacity and without lawful supervision, we will disconnect that account and delete its data.

14. Compliance with Meta's terms

Use of data originating from Instagram is also subject to the Meta Platform Terms and Developer Policies. We use platform data only to provide the features described on this page, do not combine it with data from other sources to build profiles of individuals, and delete it as set out in the retention section.

15. Changes to this policy

We may update this policy, for example when features change or Meta's terms change. The effective date at the top of this page always reflects the current version. For changes that materially affect your rights, we will notify you directly through the existing partnership communication channel.

16. Governing law

This policy is governed by and construed in accordance with the laws of the Republic of Indonesia. The Indonesian version is the binding version; this English translation is provided for convenience, and in the event of any discrepancy in interpretation, the Indonesian version prevails.

In short