Nasky Privacy Policy

About Nasky

Nasky is a software service that helps a business answer part of its WhatsApp conversations. Depending on how that business configures the service, Nasky may:

reply to WhatsApp messages using the hours, prices, services and rules the business has provided;
answer routine questions and give information about those services;
help with an appointment request, and suggest a time where availability has been configured;
record a request to change or cancel an appointment, for the business team to confirm;
hand the same conversation to a person at the business when a human decision is needed;
answer outside the business's ordinary opening hours, still within the rules that business has set.

A suggested time is a request. The business team confirms it. Nasky does not write into every calendar automatically. Where a calendar or diary is not connected, Nasky uses the availability information the business has given it.

Nasky is a tool for the business. It is not a doctor, a lawyer, a financial adviser, or another regulated professional. It does not diagnose, prescribe, or send laboratory results on WhatsApp.

Two groups of people are involved. Business customers subscribe to Nasky. End users are the people who message those businesses on WhatsApp. This policy speaks to both, and says which role applies.

Who operates this website

The service and this website are offered under the name Nasky. The legal entity, registered address and country of establishment are not published on this page yet. They will be added here when Nasky publishes them. Do not treat the name below as a registered company name.

Name on this website: Nasky
Website: https://nasky.fr
Privacy email: contact@nasky.fr
Legal entity: Not published yet
Registered address: Not published yet
Country of establishment: Not published yet

Scope of this Privacy Policy

This policy covers personal data Nasky processes to provide the service, to run nasky.fr, and to manage its own business customers and enquiries.

It does not replace the privacy notice of a business that uses Nasky. If you message a clinic, a hotel, or another business on WhatsApp, that business decides why it handles your conversation. Read that business's own notice as well.

It also does not control what Meta, WhatsApp or OpenAI do with data on their own systems. Those providers publish their own policies. Links are in the sections below.

Roles of Nasky and Its Business Customers

Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) distinguishes the party that determines the purposes and means of processing (the data controller, pengendali data pribadi) from the party that processes data on that controller's instructions (the data processor, prosesor data pribadi).

The role depends on the data:

For the end users of a business customer, that business is generally the controller. It decides why those conversations exist. Nasky processes that data as a processor, to provide the assistant the business has configured.
The business customer remains responsible for the purposes and means of its own customer data while Nasky acts as processor.
Nasky is the controller for data it collects for its own purposes: enquiries sent through nasky.fr, account and contract details of its business customers, billing records it keeps, and technical data needed to secure and operate its own website and service.

Nasky is not the controller of every personal data item that passes through the service.

Personal Data We May Process

Nasky may process the categories below where they are needed for the service or for this website, and where the configuration makes them available. Nasky does not claim to collect every item for every user.

Identification and contact

name;
phone number and WhatsApp number;
email address;
company or business information;
account information of a business customer, where an account exists.

Conversation data

WhatsApp messages;
message times;
conversation history needed to continue the thread;
questions and requests;
information a person chooses to write;
images, audio, or documents sent on WhatsApp, where that type of file is enabled for the business.

Appointment information

requested date and time;
service requested;
booking details the person provides;
a request to cancel or move an appointment;
other details needed to handle that request.

Technical information

Where collected for operation or security:

IP address;
browser type, device type and operating system, as ordinary server or application logs may record them;
logs, error logs and timestamps;
authentication and security events for the business console;
technical identifiers needed to deliver a message or keep a session.

Website and contact information

If you use the contact form on nasky.fr, the form asks for a first name, a last name, a company name, an email address, a phone number if you choose to give one, a subject, and your message. A hidden field exists only to reject automated spam. It is not a question for you.

Sensitive personal data

UU PDP treats some data as specific personal data. That can include health information, biometric data, genetic data, criminal records, data of a child, personal financial data, and other categories the law names.

Nasky is not designed to ask for that data as a standard part of the service. An end user may still type it into a WhatsApp conversation. A business customer must not ask for or send specific personal data through Nasky unless that processing is necessary and the business has a lawful ground and the safeguards the law requires.

Nasky does not claim a right to process every category of specific personal data. Health questions, where they arise, stay within the limits the business has set. Nasky does not diagnose and does not replace a qualified person.

How We Use Personal Data

Nasky uses personal data to:

provide and operate the service;
process WhatsApp conversations for the business customer;
generate an AI-assisted reply;
answer questions from the knowledge the business has supplied;
manage appointment requests, including a change or a cancellation request;
support handover to a person at the business;
keep the service reliable, and to investigate faults;
protect the service against misuse;
authenticate access to the business console;
support the business customer;
administer the account, the contract and invoices;
reply to a message sent through nasky.fr;
meet a legal obligation that applies to Nasky;
enforce the contract;
protect Nasky, its customers and the people who use the service.

Nasky does not use personal data for a purpose that is incompatible with the purpose for which it was collected, except where the law allows a further use.

Nasky does not run an automated marketing email programme from this website. If Nasky later sends a commercial message, it will do so as the applicable law requires, and with consent where that law requires consent.

Legal Bases for Processing

UU PDP does not use one ground for every act of processing. Depending on the data and the role, the ground may be:

consent that is freely given, specific, informed and recorded, where consent is the ground relied on;
performance of a contract with the business customer, or steps taken at that customer's request before the contract;
compliance with a legal obligation;
a legitimate purpose recognised by UU PDP, where that ground applies and the balance the law requires has been considered;
another ground UU PDP recognises for that processing.

When Nasky is a processor, the business customer is responsible for having a lawful ground for its own customer data. Nasky processes that data on the customer's instructions and the contract.

When Nasky is the controller, for example for a contact form or its own customer account, Nasky relies on the ground that fits that activity. Consent is not claimed for every activity.

WhatsApp and Meta

Nasky uses the WhatsApp Business Platform, operated by Meta, so that a business customer can exchange messages with its users. Nasky does not own WhatsApp or Meta.

Messages travel through WhatsApp and Meta infrastructure. Meta may process data under its own terms and privacy notices. Nasky does not control processing that Meta carries out for its own purposes.

Nasky uses the access the business customer authorises, on the WhatsApp account that customer connects. A dedicated guest number is used for the assistant. Nasky does not move the business's existing wall or reception number onto the platform as part of the standard setup.

Please also read:

Artificial Intelligence and OpenAI

Nasky uses the OpenAI API to draft some automated replies. What is sent depends on the configuration and on the message. It may include the incoming message, the conversation context needed for a reply, relevant extracts from the business's knowledge, and the details of the request. Nasky does not state that every conversation, in full, is sent to OpenAI in every case.

OpenAI processes that API data under its own terms and policies. Under OpenAI's API data usage terms, inputs and outputs submitted through the API are not used by default to train or improve OpenAI models. That default can depend on the product, the settings and the contract in force. Some technical logs may still be kept by OpenAI for security, abuse detection and operation of the API, as its policies describe.

Nasky does not control OpenAI's own systems. Read:

Hosting and Infrastructure

Nasky's own application server is a virtual private server supplied by Hostinger and located in Jakarta, Indonesia. Personal data that Nasky stores on that server is stored in Indonesia.

That infrastructure may be used to host the application, to store data the service needs, to process conversations, to keep data for the retention period that applies, and to run the technical service, including backups.

This does not mean that every processing step in the wider service happens only in Indonesia. Meta, WhatsApp and OpenAI may process data outside Indonesia. See the next section.

Hostinger's own notice: Hostinger Privacy Policy.

International Data Transfers

Data stored on Nasky's own VPS is hosted in Jakarta, Indonesia.

Some providers used to deliver the service may be established or may operate outside Indonesia. That includes OpenAI and Meta/WhatsApp, and any later provider Nasky adds for the same kind of role. If a provider is added, this policy will be updated.

Where personal data is transferred out of Indonesia, Nasky takes the measures UU PDP requires for a cross-border transfer. Those measures depend on the recipient, the data, and the ground that applies. This policy does not declare a particular transfer lawful or unlawful in the abstract. The assessment follows the law in force at the time of the transfer, including Article 56 of UU PDP and any implementing rule that applies.

Data Retention

Nasky does not publish a single retention period for every record. Retention follows the category:

Account and contract information of a business customer: for the customer relationship, and afterwards for as long as a legitimate business or legal need remains.
Conversation data: according to the business customer's configuration and what the service needs to operate that account.
Technical logs: for as long as reasonably needed for security, troubleshooting and operation, then deleted or reduced.
Contact requests sent through nasky.fr: for as long as reasonably needed to reply and to keep a business record of the enquiry.
Billing and accounting records: for the period applicable accounting and legal rules require.

Where Nasky processes personal data on behalf of a customer, the customer's instructions and the contract may set the retention period.

When data is no longer needed, Nasky deletes it or anonymises it, unless the law requires it to be kept.

Data Security

Nasky uses measures that match the service as it is actually run. They include, where they apply:

access control on the business console, with a separate administrator role and a business role;
authentication for that console;
restricted administrative access to the server;
HTTPS for nasky.fr and for the service address;
API credentials kept off the public website;
the application database not exposed on the public internet;
checks on the signature of WhatsApp webhooks;
server logging and backups for operation and recovery.

Nasky does not claim a certification on this page, and does not claim that any system is completely secure. No computer system can guarantee absolute security.

Personal Data Breaches

If Nasky becomes aware of a personal data breach affecting data it controls, or of an incident it must escalate as processor, it will detect and contain the incident as far as it can, investigate, assess the risk, and remediate.

Notice to affected people and to the competent institution is given when the law requires it, by the party that has that duty. Under Article 46 of UU PDP, a controller that must notify does so no later than 3 times 24 hours after becoming aware, subject to the conditions of that article. Nasky does not replace the business customer's own duty when the business customer is the controller. As processor, Nasky informs that customer so the customer can meet its own duty.

Nasky does not sell personal data.

Nasky may share personal data with:

service providers that host or support the service, including Hostinger;
Meta / WhatsApp, to deliver messages;
OpenAI, to generate a reply where the API is used;
professional advisers bound to confidentiality, where Nasky needs legal or accounting advice;
a public authority, where the law requires disclosure;
a buyer or successor, if the business is sold, merged or reorganised, where the law allows that transfer and the recipient is bound to protect the data.

The main providers today are:

Meta / WhatsApp Business Platform. Role: messaging channel. Data: message content and the identifiers WhatsApp needs to deliver it. Reason: so the business customer's number can send and receive WhatsApp messages. Policies: WhatsApp, Meta.
OpenAI. Role: API used to draft replies. Data: the message context needed for that reply, as described above. Reason: to produce the assistant's text. Policies: how API data is used, privacy policy.
Hostinger. Role: supplies the VPS in Jakarta on which Nasky hosts the application. Data: data stored on that server. Reason: to run the service. Policy: Hostinger Privacy Policy.

Nasky may add a technical provider later if the service needs it, and will update this policy when that changes the description above.

Your Rights

UU PDP gives a data subject rights that include, where they apply to the processing:

the right to information about the processing;
the right to access personal data and to obtain a copy;
the right to correct inaccurate data and to complete incomplete data;
the right to delete personal data, and to end processing, where the law provides it;
the right to withdraw consent, where processing is based on consent;
the right to delay or restrict processing, where the law provides it;
the right to object to processing, including to automated decision-making that produces a legal effect or a significant effect, where Article 10 applies;
the right to obtain and use personal data, and to transmit it to another controller, where the law provides that right;
the right to claim compensation, where the law provides it.

These rights are not absolute. The law sets exceptions, for example where keeping or disclosing data would harm another person's rights, or where a legal duty requires the data to be kept.

If Nasky is only the processor, Nasky will direct you to the business you messaged, or will help that business respond, because that business decides the processing of its customer data.

How to Exercise Your Rights

Write to contact@nasky.fr. Say what you are asking for, and give enough detail for Nasky to find the data, such as the WhatsApp number or the email you used. Nasky may ask for further information to check, reasonably, that the request comes from you or from someone entitled to act for you, before it discloses or changes personal data.

Nasky will answer within the time the applicable law requires. This page does not promise a shorter or a different deadline.

Questions about a conversation with a particular business should also be sent to that business. Nasky cannot decide that business's customer data on its own.

The contact page of this website is at nasky.fr/contact. This policy does not add a second contact form.

Responsibilities of Nasky Customers

A business that uses Nasky remains responsible for:

having a lawful basis for its own processing;
the personal data it collects from its users;
its own privacy notice to those users;
consent, where consent is required;
how it configures Nasky, including hours, prices and handover rules;
the accuracy of the knowledge it loads;
not sending Nasky data it is not allowed to process;
WhatsApp Business and Meta rules that apply to its account.

Nasky provides the tool. It does not take over the business customer's legal duties.

Children and Minors

Nasky is not aimed at children. The website and the service are offered to businesses.

A business customer whose own service involves minors must take the steps Indonesian law requires before personal data of a child is processed. Data of a child can be specific personal data under UU PDP. Nasky does not set an extra age limit on this page beyond what that law already requires.

Cookies and Similar Technologies

As of the date of this policy, the public pages of nasky.fr do not use Google Analytics, a Meta Pixel, advertising cookies, or another third-party tracker.

The onboarding form and the Meta setup guide may keep a draft in the browser's local storage so a person can continue on the same device. That storage is not used for advertising. It stays in the browser until it is cleared.

The host of nasky.fr may keep ordinary server logs, such as IP address, time and the page requested, for security and operation. Those logs are not an advertising profile.

AI-Assisted Responses and Automated Processing

Nasky uses AI to draft replies and to help the business handle routine messages. The business can take over the same chat.

An AI reply can be wrong or incomplete. The business customer should check anything that matters, including price, medical scope and a confirmed time. Nasky does not make a legally binding decision, and it does not make a medical decision, for the end user.

If a message needs a qualified person, the conversation is handed to the business team's human staff. Nasky is not a doctor, a lawyer, or another regulated adviser.

Data Accuracy

Nasky aims to process the data it receives without altering the meaning of what the person wrote or what the business supplied. The business customer is responsible for the accuracy of the prices, hours and other knowledge it gives the system. A person may ask for correction of their personal data as described under Your Rights.

Changes to This Privacy Policy

Nasky may update this policy when the law changes, when a regulator's rules change, when the service changes, when the infrastructure changes, or when a provider is added or removed. The date at the top of this page is the date of the current version. The date is edited in the page source when the text changes.