Privacy policy

Last updated 27 October 2026 · version 2026-10-27

WRSS (wrss.app) is run by Wirasesa Digital, Indonesia (“we”, “us”). WRSS gives businesses a website and business tools under one login. This policy explains what personal data we collect, why, who we share it with, how long we keep it and what you can ask us to do with it. We follow Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”), the EU and UK GDPR, and US state privacy laws where they apply.

The short version

• We collect what we need to run your account and your websites, and nothing for advertising.
• We don’t sell or share your personal information (as California law defines “sell” and “share”), and we don’t use advertising trackers.
• You can download your data, change your email choices and delete your account yourself in Settings → Privacy & data.

What we collect

• Account details: name, email, optional username, phone, job title and time zone, and your password stored only as a one-way hash.
• Google sign-in: if you choose it, Google shares your name, email and profile picture. We never get your Google password.
• Security data: IP address, browser and device details of your sessions, sign-in and security events, and your two-step settings.
• Business details: business name, address on the web, industry, country, team size and the emails of team members you invite.
• Your content: website text, pages, photos and files you add.
• Billing: plan, billing interval, invoices, billing name, address and tax ID, and the brand and last 4 digits of your card. Full card numbers are handled by our payment provider, never by us.
• Support: your messages and attachments when you contact us.
• Records of consent: which version of our terms, privacy policy and other agreements you accepted, when, and from which IP address and browser.

Your website’s visitors. When someone sends a message or job application through your WRSS website, we store it and email it to you. For that data, your business is the controller and we process it for you under our data processing agreement. Visitors should contact that business first.

Why we use it, and on what basis

• To provide WRSS (account, websites, tools, billing, support): needed for our contract with you.
• To keep WRSS secure and prevent fraud and abuse: our legitimate interest in a safe service.
• To send account emails (codes, security alerts, invoices, renewal reminders, important changes): contract and legal obligation.
• To send product news and tips: only with your consent, which you can withdraw any time in Settings → Privacy & data or from any such email.
• To meet legal duties such as tax records and answering lawful requests: legal obligation.

Selling, sharing and Global Privacy Control

We don’t sell personal information, don’t share it for cross-context behavioural advertising and don’t run third-party advertising or analytics trackers on WRSS. We honour Global Privacy Control (GPC) browser signals as a request to opt out of selling and sharing; since we do neither, there’s nothing further you need to do.

Cookies

We use only cookies that WRSS needs to work: to keep you signed in, to protect sign-in and two-step verification, and to remember what you agreed to while you create an account. Cloudflare may set a security cookie when it checks for bots. These can’t be switched off, and we don’t use advertising cookies.

Who we share it with

We use a small number of service providers (sub-processors) for hosting, security, email, sign-in and, soon, payments and domains. Each only gets what it needs. The full list, with what each does and where, is on our sub-processors page. We may also disclose data when the law requires it, or to protect the rights and safety of people or of WRSS. If WRSS is ever sold or merged, your data would move with it under this policy, and we’d tell you first.

International transfers

We’re based in Indonesia and our providers operate in several countries, including the United States and Japan. When data from the EU, EEA, UK or Switzerland leaves those regions, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. Transfers out of Indonesia follow UU PDP Article 56.

How long we keep it

• Your account and content: while your account is open. When you delete your account, we wait 14 days (so you can change your mind), then delete it and every business you own.
• Website enquiries: for the period the business chooses (90 days to 2 years; 1 year by default), then deleted automatically.
• Invoices and payment records: as long as tax law requires (up to 10 years), even after you delete your account.
• Records of consent: at least 3 years after the last change, to show what was agreed.
• Security logs: IP addresses and browser details are removed after 12 months.
• Data download files: 7 days.
• Backups: deleted data leaves our backups within 30 days.

How we protect it

All connections use HTTPS. Passwords are hashed, two-step verification is available, each business can only see its own data, and access to our servers is limited to the people who run WRSS. If a breach puts your data at risk, we’ll tell you and the authorities as the law requires.

Your rights

Depending on where you live, you can ask us to:

• tell you what data we hold and give you a copy (access and portability);
• correct data that’s wrong or incomplete;
• delete your data or your account;
• restrict or object to how we use it, or withdraw consent you gave (without affecting what happened before);
• not be subject to decisions made only by automated means (we don’t make any);
• opt out of selling or sharing (we don’t do either), and not be treated differently for using these rights.

Indonesia (UU PDP). You have the rights in Articles 5–13 of the law: to information about why and how your data is processed, to complete, update and correct it, to access and get a copy, to end processing and have it deleted or destroyed, to withdraw consent, to object to automated decisions, to restrict processing, to portability, and to claim compensation for a breach of your data.

How to use them. Most rights are self-service in Settings → Privacy & data: download your data, turn product emails off, see what you agreed to and delete your account. You can edit your details in your profile. For anything else, email [email protected] from your account’s address.We reply as quickly as we can, and within the time the law sets (one month under GDPR, and the shorter periods under UU PDP where they apply). An authorised agent can make a request for you with your signed permission.

If you’re unhappy with our answer, you can complain to your data protection authority: in Indonesia the personal data protection agency, in the EU your local supervisory authority, in the UK the ICO, or in California the California Privacy Protection Agency.

EU and UK representatives

EU representative: [EU representative — to be appointed]. UK representative: [UK representative — to be appointed].

Children

WRSS is for businesses. You must be 18 or older to create an account, and we don’t knowingly collect data from children.

Changes to this policy

When we change this policy we update the date and version at the top. For significant changes we email you before they take effect and, where needed, ask you to agree again when you next log in.

Contact

Wirasesa Digital, Indonesia. Privacy questions and requests: [email protected].