Markaz Afiliator Privacy Policy

This is an English translation of the Indonesian version (Bahasa Indonesia). If the two versions differ, the Indonesian version prevails.

This policy explains what data the Markaz Afiliator app (the "App") collects, what the data is used for, who can see it, and how you can delete it. The App is developed and operated by Ahmad Rosida, the Personal Data Controller under Indonesian Law No. 27 of 2022 on Personal Data Protection ("Developer"; called Admin inside the App).

The App is a tool for recording affiliate promotion tasks between Boss accounts (who give tasks) and Worker accounts (who carry out tasks), including proof of task work, salary records, and Boss account subscriptions.

1. Data we collect

• The official site markazafiliator.com (APK download page outside Google Play and installation tutorial) does not ask for or store any data. Official downloads and updates of the app come only from this site (or Google Play). IP addresses are used only briefly by the server provider to limit excessive downloads and are not stored by the Developer. The language of the site, Privacy Policy, Delete Account, and SME Shop shop & order pages (Indonesian or English) follows your browser language or the ID/EN buttons on the page; the choice is only carried in the page address (no cookies) and is not stored. The site's main page also shows the same ticker as the App's login screen (see section 3), fetched from the App's server.
• Account data: name, phone number (used as the login ID; the number is not verified at registration), role (Boss/Worker), and password. Passwords are not stored in their original form but hashed (salted PBKDF2), so they cannot be read, including by the Developer. The server also records which version of the Terms of Service you accepted (including your statement that you are 18 or older) and when, as proof of consent.
• App language choice (Indonesian or English): stored on your phone and in your account so the same language is used on other phones. The initial language follows the phone language.
• In-App chat: text message content, sender, recipient, time sent, number of unread messages, the list of accounts you block, and message reports you send (containing a copy of the reported message and the reason). Chat is only possible with the Admin, and between a Boss and the Workers in their team or Workers currently applying to their team. Chat is also used to request and receive verification tokens for name/password changes issued by the Admin.
• Forgot-password tickets (without login): the account number, the name and notes you type, question-and-answer messages with the Admin, and indicators for the Admin of whether the device and network used have ever successfully logged in to that account and whether the typed name matches. The device that creates the ticket stores a secret ticket code so that only that device receives the token from the Admin. With the ticket, the server stores a random fingerprint (hash) of the creating device's key, so that a new request from the same phone replaces its old ticket, while requests from other phones do not cancel your ticket (at most 3 active tickets per number, each valid for 24 hours).
• Team work data: team membership, tasks published by the Boss (title, promotional text, product link, product image), task share time records, task reports, approval status (including approval time, whether one by one or via Bulk Approve by the Boss), commission rates, bonuses, salary payment history, and Boss account settings. This also includes tasks a Worker removes from their work list, the list of Workers the Boss excludes from a task, and Workers' answers (reject or accept) when the Boss wants to delete a task in progress or a completed task report (reports with 2 proof photos are only deleted by the Boss if the Worker agrees).
• Salary payment data (Boss to Worker): the payout amount requested by the Worker, the amount paid by the Boss, the transfer proof screenshot uploaded by the Boss, notes, request/payment times, the Worker's answer (accepted or rejected) with the rejection reason and the DANA transaction history screenshot the Worker must attach when rejecting (for comparison with the Boss's proof), reminder times, and the Admin's decision in case of a dispute. The App does not move money; transfers are made by the Boss directly to the Worker's DANA.
• Photos you upload: task proof photos/screenshots, product images, subscription payment transfer proof photos, salary payment proof screenshots, and DANA history screenshots when rejecting salary payment proof. Task proof photos are timestamped (watermarked) by the App.
• Boss subscription plan: the active plan (Free, Affiliate Micro, Small, Medium, PRO, SME Small, or SME Medium), its end date, and the count of the Boss team's task reports for the current day (for the plan's daily quota; previous days' counts are deleted automatically after 00:00 WIB). To keep the free service free, the server also records the total number of requests from all Free plan users per month; this number is not linked to any particular account. Visits to Free plan shop pages are counted once per random fingerprint (hash) of the network per page per hour; this record exists only in server memory and disappears after at most 1 hour. The server also records total usage figures (number of requests, database rows written, database size, number and size of photos, number of chat messages) to monitor server capacity and costs; these figures are also not linked to any particular account.
• Subscription payment data: the chosen plan, the sender's DANA account name, notes you fill in, and the transfer proof photo. The App does not process payments and does not access your DANA account or bank account; transfers are made by the users themselves. Payment by DANA transfer is only available in the app installed outside Google Play; the Google Play version uses Google Play billing for subscription plans (coming soon; until then the Google Play version uses the Free Plan).
• SME Shop (commission per sale; every plan has a shop with daily product & order quotas according to the plan, including the Free plan):
  • If the plan goes down (e.g. it ends and returns to the Free plan), products above the plan quota are hidden from the shop page, not deleted, and appear again when the plan is upgraded. Free plan shops are also limited by the monthly free service quota.
  • Seller (Boss) data: shop name (the Boss account name), the business city/address and optional seller contact entered by the Boss as seller identity and shown on product & shop pages, products (name, photo, description, price, stock, shipping fee, Worker commission per item), and payment info entered by the Boss (for example a DANA/bank account number and the owner's name). Product pages and shop pages can be opened by anyone who has the link; payment info is only shown on the buyer's order page.
  • Worker link code: a random 6-letter code in the link shared by a Worker, to record which Worker is entitled to the commission. This code does not contain the Worker's name or phone number.
  • Buyer data (buyers do not need an account): recipient name, phone/WhatsApp number, shipping address, notes, quantity, transfer proof photo, order time, order status, courier and tracking number recorded by the seller, confirmation that the package was received, and the complaint content if the buyer reports a problem (read by the Admin to decide together with the seller). To prevent fake orders, the server records the number of orders and uploads per random fingerprint (hash) of the IP address for at most about 2 hours, and the order form may be checked by the anti-bot service Cloudflare Turnstile.
  • On the buyer's device: the shop page stores in the buyer's browser the list of orders made from that device (order codes and links) and the last Worker link code opened for that shop with its click time (in local storage and a browser cookie, valid for 7 days). This code is sent with the order so the commission is recorded for the right Worker; after 7 days the code is no longer valid. This data is deleted if the buyer clears the browser data.
  Buyers pay directly to the seller's bank account/DANA. The App does not receive, hold, or forward buyers' money. When an order is completed (the buyer confirms the package was received, or automatically 7 days after shipping without a complaint), the Worker's commission is recorded in their salary balance with the selling Boss.
• Reports and complaints: violation reports against other users with their reasons, and app problem complaints you send. Buyers can report a product from the product page (without an account): the reason and the reporter's contact if given (optional) are read by the Admin and deleted after the report is handled; to prevent fake reports, the number of reports per random fingerprint (hash) of the IP address is limited.
• Security technical data: to prevent guessing and abuse, the server records the number of login attempts (including per IP address), the number of new account registrations and forgot-password tickets per random fingerprint (hash) of the IP address, the number of wrong License Token attempts, and the number of photos you upload and chat messages you send per minute/hour/day. IP addresses are not stored in their original form. Login attempt records for your number are deleted when you log in successfully; other records are deleted automatically after at most about 2 hours (photo upload counts: about 1 day). In addition, random fingerprints (hashes) of at most the last 10 IP addresses from which you successfully logged in are stored for up to 60 days, so that your account is not locked when someone else tries to guess your password from another network. These records are deleted when the password is changed/reset or the account is deleted. The App also creates a random device key once per phone; when you log in or register, a random fingerprint (hash) of that key is stored for your account (at most 5 devices, for up to 60 days) as an identifier when you request a password reset. The device key contains no data about your phone (not the IMEI, serial number, or advertising ID). The server provider (Cloudflare) may process IP addresses as part of its network service, including to limit the number of requests. Anti-robot check: when you register an account or create a forgot-password ticket, your phone automatically solves a short computational puzzle (±1–2 seconds). The server records the random code of each used puzzle, without personal data, until that puzzle expires (±10 minutes), so one answer cannot be reused. The server also counts the total number of registrations and forgot-password tickets per hour from all users (without personal data), and temporarily counts spikes in failed logins, registrations, and shop orders in server memory to warn the Developer.
• Last active time: the last time your account opened the App (recorded at most once every 12 hours) and the inactive-account warning stage, for the automatic deletion of accounts inactive for 60 days (see section 5). This data is not shown to other users; the Admin sees the list of accounts to be deleted within 15 days, with the last active time and the reason if an account is on hold.
• Error log (diagnostics): when an error occurs on the server or in the App on your phone, the server records the error message, code trace (stack), code location/route, App version, device & browser type (user agent), time, number of occurrences, and the number of the logged-in account (if any), so the Admin and Developer can find and fix the problem. Form contents, passwords, and photos are not sent; tokens and phone numbers carried in error messages are masked. The log is only seen by the Admin, and is deleted automatically 14 days after being marked resolved or 30 days after the error last occurred.
• Notifications: notices for your account (title, short text, group, time, read/unread), for example new tasks, approved reports, salary transfers, shop orders, chat messages (message preview), plans about to end, Admin announcements, and new app versions. They appear in the 🔔 Notification Center and are kept for at most 30 days (max. 100 latest per account). If you allow notifications on your phone (app version 2.3 or later), the server stores a Firebase Cloud Messaging device token (a random code from Google used to deliver notifications to your phone, not your phone number or advertising ID) and the notification groups you turned off. The token is deleted when you log out, delete your account, or if it is not refreshed for 60 days.
• Data on your device: the login session token (valid for up to 180 days) and a copy of the display data are stored in the App's storage on your phone so the App stays fast and can be used with a weak signal. The session token is deleted when you log out; the copy of the display data is deleted when you uninstall the App or clear the App data in the phone settings. The App also records on the phone that you have read the Privacy Policy change notice, so the same notice does not appear repeatedly, as well as the device key above and the code of a forgot-password ticket in progress.

The App asks for notification permission (Android 13 and later) to show notices on your phone; you can refuse it or turn it off at any time in your phone settings or the account menu. The App does not access your contacts, location, microphone, or other files on your phone other than photos you choose yourself to upload. The App does not show ads, does not use third-party analytics/trackers, and does not sell your data.

2. What the data is used for

• Creating and securing your account, including password resets and name/password changes. Verification tokens for password resets and name/password changes are issued only by the Admin (Bosses cannot issue them), after the Admin checks your request in chat or a forgot-password ticket. Tokens are valid once and for 15 minutes.
• Providing chat between users and the Admin, and between a Boss and their team's Workers, including following up on reported messages.
• Running the main features: publishing and sharing tasks, uploading and checking proof, calculating commissions, bonuses, and salaries, and recording salary requests, payments, and confirmations between Bosses and Workers. If a Worker rejects payment proof, tasks from that Boss are temporarily frozen on that Worker's account until the dispute is resolved (the Boss sends new proof or the Admin decides). The App sends automatic messages in the Boss and Worker chat when payment proof is sent, rejected, or accepted, as well as a reminder to the Worker one day before the payment proof is automatically considered accepted.
• Processing Boss account subscriptions (the Developer checks transfer proof manually) and applying plan quotas: number of active tasks, number of team reports per day, number of team members, number of unpaid team reports, and automatic sync interval. If the free service quota for the current month/day is full, Free plan teams temporarily cannot create new tasks or reports until the next period. To keep server capacity, the number of active and pending paid plans is counted (without personal data); if full, certain plans temporarily cannot be chosen and this is shown on the plans page.
• Preventing fraud and abuse, following up on violation reports, and suspending accounts that violate the Community Standards.
• Responding to complaints and giving important announcements to users.

Legal basis (Indonesian Law No. 27 of 2022 on Personal Data Protection): performance of our agreement with you (the Terms) to run the App's features; your consent at registration and when accepting policy updates; legitimate interests in security and fraud prevention; and compliance with legal obligations. You can withdraw consent by deleting your account.

Financial data such as DANA/bank account numbers, transfer proof screenshots, and DANA history screenshots is specific personal data. It is only shown to the parties listed in section 3, kept in private storage, and deleted automatically as described in section 5. Please upload only the part of the screen that is needed (cover balances or other transactions if not needed).

3. Who can see your data

• Your team's Boss can see the name, phone number, task reports, task proof photos, and salary data of their team members, including which Workers removed/did not do their tasks and Workers' answers to task deletion or report deletion requests. Workers can see the data of the Boss they work for and the tasks published by that Boss. Salary payment data (including transfer proof screenshots) can only be seen by the Boss and Worker concerned and the Admin. DANA history screenshots attached by a Worker when rejecting payment proof can only be seen by that Worker and the Admin (not by the Boss).
• Chat: messages are only shown to their sender and recipient. Chats between Bosses and Workers are not shown to the Admin, except reported messages (the Admin receives a copy of that message). Verification tokens in chat are only visible to the account owner and the Admin. Messages are stored on servers managed by the Developer and may be disclosed if required by law.
• SME Shop orders: buyer data (name, phone number, address, notes, transfer proof) can only be seen by the buyer themselves through their secret order link, the selling Boss, and the Admin. The Worker whose link was used only sees the product, quantity, status, and their commission, without the buyer's name, phone number, or address. Keep your order page link secret.
• Other users can see your basic profile for the job board and leaderboard: name, role, team status, rank/reputation, number of approved tasks, and total recorded earnings. The contents of task reports (task title, Boss, wage, payment status, share time), task proof photos, and your salary details are not shown to users who have no working relationship with you. Workers' phone numbers are not shown to users with no working relationship with them (replaced by a pseudonymous code); the real number is visible to their team's Boss, Bosses they have worked with, Bosses they applied to, and the Admin. Bosses' phone numbers can be seen by other users because they form the team code (BOS-number) on the Job Board.
• The ticker on the login screen (visible to anyone who opens the App without login, and on the main page of the markazafiliator.com site) shows activity from the last 24 hours as short sentences, for example "Sya*** is working on a task from Boss Rud***", "Dew*** has received their salary", "Boss Bud*** is giving bonuses to their workers", new account registrations, or new shop orders. Names are always masked (only the first few letters of the first name), without phone numbers and without money amounts. You can hide your name from the ticker at any time with the "Hide my activity" option in the account menu; your activity is then shown without a name (for example "A worker has received their salary"). The ticker is not stored separately: its sentences are rebuilt from existing data.
• The Developer (Admin) can see all data except the content of chats between users that were not reported, for management, security, and handling reports, including monitoring all salary transactions between Bosses and Workers and deciding salary payment disputes.
• Service providers that store and process data on behalf of the Developer:
  • Cloudflare (Workers & Durable Objects), the App's server and the App's data storage (since 6 November 2026). Before each server update, a backup copy of the App's data is stored in private Cloudflare R2 storage and deleted automatically after 30 days (since 8 November 2026);
  • Cloudflare R2, storage for uploaded photos since 6 November 2026. Photos are stored in private storage with random names, together with the photo type, upload time, and a hashed code of the uploader's account, without a name or phone number. Photos can only be opened in the App through signed links that the server gives to authorized users;
  • Google Firebase Cloud Messaging (FCM), Google's service for sending notifications to Android phones. Google receives the device token and the notification's title and short text in order to deliver it;
  • Cloudflare R2 also stores the App's update files (since 7 November 2026). These files contain no user data;
  • Google Firebase (Realtime Database) only stores a copy of the App's update file for devices still using an old version, without user data; Firebase may log the IP address of the devices that download it. Firebase previously also stored App data; that old copy of the data was deleted on 7 November 2026;
  • Telegram, storage for photos uploaded before 6 November 2026, and a backup when Cloudflare R2 storage is disrupted. These photos are stored in a private channel owned by the Developer (photos before 6 November 2026 have a caption with the uploader's name and phone number; backup photos since 7 November 2026 only carry a random account code, without name or phone number), and can also only be opened through signed links. The same Telegram bot also sends server technical disruption notices to the Developer (type of disruption, time, and error message); the same bot also sends warnings when server usage approaches the quota limit, and warnings about suspicious activity spikes such as mass registrations or many failed logins (totals only). These notices do not contain your name, phone number, or data.
• Data may be disclosed if required by law or by a lawful order of the authorities.

When you share a task or product link to WhatsApp or social media, the task text and image are sent through the destination app you choose and are subject to that app's policy.

Transfers outside Indonesia: Cloudflare (Workers, Durable Objects, R2) and Telegram are global services, so App data may be stored and processed in data centres outside Indonesia (the App's main storage is requested in the Asia-Pacific region). The Developer chooses providers that apply encryption and data protection agreements, limits the data sent to Telegram, and does not sell data to anyone. By using the App, you consent to these transfers as provided for in the Personal Data Protection Law.

4. Data security

• All communication between the App and the server uses an encrypted connection (HTTPS).
• The database is closed to public access; only the App's server can read and write data.
• Passwords are hashed; login attempts, registrations, forgot-password tickets, License Tokens, photo uploads, and chat messages are limited; and App updates over the internet are digitally signed by the Developer.

No system is completely risk-free. Keep your password secret and do not install the App from unofficial sources.

If a personal data breach occurs, the Developer notifies affected users and the data protection authority within 3 × 24 hours of becoming aware of it, via Admin chat in the App, an in-App announcement, and/or the markazafiliator.com site, stating the data affected, when and how it happened, and the handling and recovery steps.

5. Data retention and deletion

• Data is kept as long as your account is active.
• Accounts inactive for 60 days are deleted automatically. An account is considered inactive if it is not opened (no login or sync) for 60 days; for accounts created before 7 November 2026, the count starts on that date. On day 45 and day 55, the Admin sends a warning in the App chat with the deletion date; for a Worker account, their team's Boss is also notified so they can contact that Worker. Opening the App before that date cancels the deletion. Automatic deletion follows the same rules as Delete Account (see the Delete Account page), and is not done while: the account is suspended, the Boss's paid plan is still active (the count starts when the plan ends), the Boss still has unpaid salaries, unfinished salary payments or reports, unfinished shop orders, or pending plan payment proof, or the Worker still has a salary/bonus balance, a payout in progress, or task reports awaiting approval. Accounts on hold are shown to the Admin. If a Boss account is deleted, the Workers in their team are released from the team and notified in chat; if a Worker account is deleted, their team's Boss is notified.
• Task reports whose salaries have been paid and accepted are deleted from the database; only a summary of the salary payment history is kept (name, WA number, amount, time, status, and a task summary, without proof photos).
• Salary payment transactions (including transfer proof screenshots, rejection reasons, and rejection DANA history screenshots) are deleted automatically 7 days after they close: accepted by the Worker, cancelled, decided by the Admin, or automatically accepted. Payment proof not answered by the Worker within 3 days is considered accepted (proof sent before 7 November 2026 remains 7 days). Requests still pending or in dispute are kept until resolved.
• SME Shop orders: orders not paid within 24 hours are cancelled automatically. Cancelled orders and their buyer data are deleted automatically 30 days after cancellation. Paid orders (buyer data, shipping, and complaints) are deleted automatically 14 days after the payment is confirmed if the order is completed, at the earliest 3 days after completion; unfinished orders (for example not yet shipped or under complaint) are kept until completed or cancelled. Buyers can request earlier deletion through the Developer's contact.
• Notifications are deleted automatically 30 days after being created (or sooner beyond 100 notifications per account); device tokens for phone notifications are deleted if not refreshed for 60 days.
• Chat is deleted automatically 90 days after being sent. Forgot-password tickets are valid for 24 hours; ticket messages are deleted after 90 days. Message reports are kept until handled by the Admin. When an account is deleted, all of that account's conversations (including the other party's messages in those conversations), block lists, and related reports are deleted too.
• You can delete your account at any time. How to do it and the details of what data is deleted or kept are explained on the Delete Account page.

6. Your rights

You have the right to information about the processing, to access and obtain a copy of your data, to correct it, to delete it, to withdraw consent, to restrict or suspend processing, and to object. How:

• Copy of your data: the "📥 Download My Data" button in the account menu creates a JSON file with your account, tasks, reports, salaries, shop orders, and chats (the download link is valid for 10 minutes; photos are links valid for several days).
• Correction: your name and password can be changed from the account settings menu with a token from the Admin.
• Deletion / withdrawing consent: via Delete Account (see section 5).
• Other requests: contact the Admin via chat in the App or the contact below. Requests are answered within 3 × 24 hours.

7. Age limit

The App is intended for users aged 18 and over; at registration, users must state that they are 18 or older. The App includes chat with other users and money records, so it is not intended for children. If you know of a minor using the App, contact the Developer so the account can be deleted.

8. Policy changes

This policy may be updated at any time, including whenever a new feature changes the data collected or shown. Every update changes the "Effective from" date above, and the App will show a one-time notice with a link to the latest policy.

9. Contact

If you contact the Developer by email, your email address and message content are only used to answer and follow up on that request.