Privacy Policy

Last updated: October 20, 2026

PT Fandy Group Indonesia ("we", "us", or "our") operates the Saji application and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

Account Information: When you create an account, we collect your name, email address, and any other information you choose to provide.

Social Media Credentials: To connect your social media accounts, we use OAuth authentication. We store the resulting access tokens in encrypted form. We do not store your social media passwords.

Content Data: We process the content you create and schedule through our Service, including text, images, and videos.

Usage Data: We may collect information about how you access and use the Service, including device information, log data, and analytics. See section 6 for what is stored on your device or browser.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process and complete your scheduled posts
• Communicate with you about updates and support
• Analyze usage patterns to enhance user experience
• Protect against unauthorized access and abuse

3. Data Storage and Security

Your social media authentication tokens are stored in encrypted form using industry-standard encryption. We implement appropriate technical and organizational measures to protect your personal information.

4. Third-Party Services

Our Service integrates with third-party platforms including:

• Facebook (Meta Platforms, Inc.)
• Instagram (Meta Platforms, Inc.)
• YouTube (Google LLC)
• Threads (Meta Platforms, Inc.)
• LinkedIn (LinkedIn Corporation)

Your use of these platforms is governed by their respective privacy policies. We encourage you to review those policies.

LinkedIn

When you connect LinkedIn, you sign in on LinkedIn's own page and approve Saji's request for these permissions: openid, profile and email (Sign In with LinkedIn using OpenID Connect) and w_member_social (Share on LinkedIn). Saji uses them only to post to your personal LinkedIn profile on your behalf:

• LinkedIn member ID — identifies you as the author of the posts you publish through Saji.
• Name and profile picture — shown on your connected accounts and in post previews inside Saji.
• Email address — provided by LinkedIn as part of sign-in. Saji does not store it and does not use it to contact you.
• Posting on your behalf — Saji publishes only the text, photos and videos that you create in Saji and choose to publish or schedule to LinkedIn, at the time you choose, with Public visibility. Your photos and videos are uploaded to LinkedIn when the post is published. Saji keeps the link to each published post so you can open it from your post history. Saji never posts on its own, and does not read your feed, connections or messages.

What we store: your member ID, name, profile picture link, and the LinkedIn access token with its expiry date, stored encrypted (AES-256-GCM) on our servers. LinkedIn access lasts 60 days; after that you reconnect LinkedIn to keep publishing. We do not sell LinkedIn data, use it for advertising, or share it with third parties except as needed to provide these features or as required by law.

Revoking access: you can disconnect LinkedIn at any time from the Accounts page in Saji, which deletes the stored token. You can also remove Saji's access in LinkedIn under Settings & Privacy → Data privacy → Permitted services, or directly at https://www.linkedin.com/psettings/permitted-services. LinkedIn's handling of your data is described in the LinkedIn Privacy Policy. To delete all of your Saji data, see our Data Deletion page.

5. YouTube and Google User Data

When you connect a YouTube channel, Saji uses YouTube API Services. By connecting, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Saji requests two YouTube permissions and uses them only for the features you use:

• youtube.upload — to upload the videos you schedule or publish in Saji to your own YouTube channel, with the title, description and privacy setting you choose. Saji uploads only when you create a post and select your YouTube channel.
• youtube.readonly — to show your channel's name and picture on your connected accounts, and to display your channel and video statistics (views, likes, comments, subscribers) on Saji's Analytics page.

What we store: your channel ID, channel name and picture, and the OAuth access and refresh tokens needed to perform the actions above, stored encrypted on our servers. Tokens are encrypted with AES-256-GCM. Analytics numbers are fetched when you open Analytics and may be cached briefly to keep the page fast. Channel name and picture are refreshed from YouTube at least every 30 days; if Saji's access has been revoked, the stored tokens and channel data are deleted. Cached YouTube analytics are deleted after at most 30 days. When you disconnect the channel or delete your Saji account, the stored tokens are deleted immediately and any remaining cached YouTube data within 30 days. We do not store the contents of your YouTube account beyond what is needed to provide these features.

Limited Use: Saji's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell YouTube or Google user data, do not use it for advertising, do not transfer it to third parties except as needed to provide the features above or as required by law, and do not allow humans to read it except with your consent, for security purposes, or to comply with applicable law.

Revoking access: you can disconnect YouTube at any time from the Accounts page in Saji, which deletes the stored tokens. You can also revoke Saji's access at any time via the Google security settings page at https://security.google.com/settings/security/permissions. To delete all of your Saji data, see our Data Deletion page or contact us at [email protected].

6. Cookies and Similar Technologies

This section explains what Saji, and third parties whose services Saji uses, store on or read from your device or browser, including cookies and similar technologies such as your browser's local storage.

Local storage used by the Saji web app. The Saji web app (appsaji.haramaintour.com) uses your browser's local storage (not cookies) to keep you signed in and to remember your settings. These items stay on your device and are only read by Saji:

• Login session: a random session token (auth_token) and the basic profile of the signed-in user (user_info: user ID, name and email). The token lets Saji's server recognise your requests; it expires on the server after 30 days at the latest. A temporary marker (pending_auth_provider) remembers which platform you are connecting while you are on the platform's sign-in page.
• Preferences: theme (light/dark), collapsed sidebar, notification preferences, whether you have completed the welcome tour, and which notices or banners you have dismissed.
• Local copies for speed: your list of connected channels, dashboard figures, recent notifications and publishing status, and recently used Instagram collaborator usernames, so pages load quickly before fresh data arrives from our server.

Other app data that Saji loads (for example analytics figures) is kept in memory only while the page is open. Saji does not use local storage for advertising, profiling or tracking you across other websites.

Cookies set by Saji. Saji itself does not set any cookies, on the web app or on this website.

Cookies and technologies of third parties.

• Cloudflare (security and performance): our websites are delivered through Cloudflare, Inc. To protect the service against bots and attacks, Cloudflare may place strictly necessary cookies such as __cf_bm (bot management, expires after 30 minutes) or cf_clearance (set only after you pass a security check). Cloudflare also adds its Web Analytics script (beacon.min.js), which measures page visits and page-load performance without using cookies or local storage, and, on this website, a script that protects email addresses from spam bots. See the Cloudflare Privacy Policy and Cloudflare cookie information.
• Sign-in and connected platforms: when you sign in with Google, or connect a YouTube, Facebook, Instagram, Threads, TikTok or LinkedIn account, you are taken to that provider's own page (for example accounts.google.com or facebook.com). Those providers set and read their own cookies there, under their own privacy policies. Saji cannot access those cookies.
• Content from platforms: profile pictures, video thumbnails and the embedded YouTube player (used when you watch a published video inside Saji) are loaded from the platforms' servers, such as YouTube and Facebook. These providers receive your IP address and browser information, and the YouTube player may set YouTube/Google cookies, as described in the Google Privacy Policy.
• Fonts on this website: pages of saji.haramaintour.com load fonts from Google Fonts, which receives your IP address and browser information but does not set cookies. The Saji web app uses fonts hosted by Saji itself.

Your choices. You can view, delete or block cookies and site data (including local storage) at any time in your browser's settings, for example "Clear browsing data" or the site settings for appsaji.haramaintour.com and saji.haramaintour.com. Signing out of Saji removes the login session token and your profile details from the browser and ends the session on our server; clearing the site data removes all remaining Saji items. If you block local storage, you will not be able to stay signed in to the Saji web app. Blocking Cloudflare's security cookies may cause additional security checks.

7. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your consent
• To comply with legal obligations
• To protect our rights and safety
• With service providers who assist in operating our Service (under strict confidentiality)

8. Data Retention

We retain your information for as long as your account is active or as needed to provide you with our Service. You may request deletion of your data at any time by contacting us.

9. Your Rights

You have the right to:

• Access and receive a copy of your personal data
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict processing of your data
• Withdraw consent at any time

10. Children's Privacy

Our Service is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: