Last updated: October 12, 2026. Version: 1.1 This is an English translation for convenience. If there is any difference between this translation and the Indonesian version (Kebijakan Privasi Hepifun), the Indonesian version prevails (Law No. 24 of 2009).
This policy explains how Asep (individual seller) ("Hepifun", "we"), located at Mojokerto, East Java, Indonesia, acts as the Personal Data Controller for your data on hepifun.com, in line with Law No. 27 of 2022 on Personal Data Protection ("PDP Law") and related regulations.
1. Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account | name, email, password (stored as a hash, not plain text), avatar | You |
| Google account data (if you log in with Google) | Google account ID, name, email address, profile photo, email verification status. We request only basic scopes (openid, email, profile) and do not access Gmail, Drive, contacts or other Google data | |
| Content | prompts, reference images/video/audio you upload (which may contain people's faces and voices, which may count as biometric/specific personal data), resulting videos/images, characters, films, job history | You and the system |
| Transactions | top-up package/amount, payment status, gateway reference, payment method (we do not store card or account numbers), token history | You and payment providers |
| Technical and security | IP address, device/browser type, session cookies, access logs, activity and login-attempt logs, audit trail | Automatic |
| Bonus/promo abuse prevention | (a) a random device ID that we create and store in your browser; (b) normalised email or Google account ID (sub); (c) IP address; (d) browser fingerprint, i.e. a hash computed in your browser from the user agent, platform, language, time zone, screen size, number of CPU cores, device memory, number of touch points, and canvas/WebGL rendering output. On our servers, all of these signals are stored only as an HMAC-SHA256 using a secret server key, not as raw values (see Sections 2, 4 and 7) | Automatic and your account |
| Usage analytics (Google Analytics 4) | pages visited, device and browser, operating system, language, approximate location (city/region level, not precise location), traffic source, on-page interactions, the _ga cookie identifier | Automatic (Google Analytics) |
| Communications | messages to support, content reports | You |
We do not knowingly collect data from children under 18. The service is not for them.
2. Purposes and Legal Bases
| Purpose | Legal basis (Article 20 PDP Law) |
|---|---|
| Creating and managing accounts, authentication, password reset | Performance of a contract |
| Processing video/image generation jobs (sending Input to the AI provider) | Performance of a contract; explicit consent for Input containing specific personal data (e.g. faces) |
| Processing top-ups, tokens, receipts, refunds, reconciliation | Performance of a contract; legal obligation (bookkeeping, tax) |
| Security, fraud and abuse prevention, content moderation, enforcing the Content Policy | Legitimate interests; legal obligation |
| Ensuring the sign-up token bonus and the first-generation promo price are given only once per person, and detecting mass account creation (device signals, email/Google ID, IP, and browser fingerprint; see the explanation below this table) | Legitimate interests (fraud and abuse prevention); performance of a contract (promo terms, i.e. once per person). We do not rely on consent for this processing |
| Responding to requests from authorities | Legal obligation |
| Service notifications (job finished, top-up successful) | Performance of a contract |
| Service improvement (aggregate statistics), including site and studio usage analytics via Google Analytics to understand which pages are used, performance, and traffic sources | Legitimate interests (you can opt out, see Section 7) |
| Marketing (if any) | Consent, which may be withdrawn at any time |
Bonus/promo abuse prevention. The random device ID and the normalised email/Google account ID are used to refuse the sign-up bonus or promo price on a second account from the same device or identity; that is the only automatic consequence. The IP address and browser fingerprint are only flags for admin review and never refuse a bonus/promo or close an account automatically. Admins can see "related accounts" (same device, same IP, same fingerprint, or equivalent email) without seeing the raw IP, and can suspend an account manually after assessment. There is no other automated decision. If you believe a bonus/promo was refused in error (e.g. you share a device with a family member), contact us (Section 10) for manual review. This data is not sold and is not used for advertising or cross-site tracking.
When you upload images/video/audio that contain people, you warrant that you have obtained their consent (see the Content Policy). We ask for your explicit consent at the time of upload/registration for this processing. We treat images and voices of people as personal data needing extra protection and do not use them to identify people or to create biometric templates. You can withdraw consent by deleting the Input or your account (see Section 5).
3. Third Parties and Cross-Border Transfers
We share data only as needed with the following Processors/recipients:
| Party | Role | Data | Location |
|---|---|---|---|
| Alibaba Cloud (Model Studio), Singapore region | AI processing: generating video/images/text and moderation | Prompts, reference Input, Output | Singapore (and per Alibaba's infrastructure) |
| MySibayar / iPaymu (payment gateway) | Payment processing | Amount, order ID, name/email, payment data you enter on their pages | Indonesia and/or per the provider's infrastructure |
| Resend | Sending email (password reset, transaction notices) | Email, name, email content | United States |
| Login with Google | Basic profile data described above | Global/US | |
| Third-party VPS provider | Server hosting | All data | May be outside Indonesia |
| Wasabi Technologies | Media storage (uploads and outputs) and encrypted backups | Your media, encrypted backup copies | Singapore |
| Cloudflare | Site CDN and DNS; anti-bot protection (Turnstile) at registration if enabled | IP, request metadata, browser signals | Global |
| Google LLC (Google Analytics 4) | Processor of site and studio usage analytics | Pages visited, device/browser, approximate location, _ga cookie identifier, traffic source | United States and/or other Google data centers worldwide |
Transfers of data outside Indonesia are made in line with Article 56 of the PDP Law: we ensure the destination country has an equal or higher level of protection; if not, we ensure adequate and binding protection exists, or ask for your consent. By using the related features, you agree to these transfers to the extent necessary. We do not sell your personal data. We may also disclose data to authorities based on valid legal grounds and procedure.
Alibaba Cloud processes data under its own service agreements and policies, which may change and which you can read on the Alibaba Cloud website. We do not use Your Content to train our own models.
4. Retention
| Data | Kept |
|---|---|
| Account and profile | While the account is active; deleted/anonymised within 30 days after account deletion |
| Input and Output (assets, gallery, characters) | Media is kept while your account is active, until you delete it or the account is closed; temporary media at the AI provider follows their policy (usually short-term) |
| Transaction data, receipts, token ledger | 10 years for bookkeeping and tax obligations (may be kept even if the account is deleted, with minimum data) |
| Security and access logs | 6 to 12 months; electronic-system log retention obligations are subject to regulation |
| Content reports and evidence of violations | As long as needed for enforcement and legal proceedings |
| Backups | Rotated: 14 daily and 8 weekly backups |
| IP and browser-fingerprint signals for abuse prevention (in HMAC form) | 90 days, then deleted automatically |
| Bonus/promo claim signals (device ID, normalised email/Google ID, in HMAC form, with the claim record) | While the account is active, and for up to 12 months after the account is deleted (then deleted automatically), so that deleting an account and re-registering does not grant the bonus/promo again. Only the HMAC values and the claim record are kept, without your name or content |
| Google Analytics data | 14 months (our Google Analytics data retention setting); automatically deleted by Google afterwards. The _ga cookie lasts up to 2 years from your last activity and is renewed when you visit again |
5. Your Rights
Under Articles 5 to 15 of the PDP Law you have the right to: obtain information about processing; access and obtain a copy of your data; complete/update/correct your data; end processing, delete and/or destroy your data; withdraw consent; object to decisions based solely on automated processing; delay or restrict processing; sue and receive compensation for violations; and obtain/use your data in a common format (portability). Some can be done directly in the app (edit profile, delete assets, delete account). For the others, send a request to ciggurich@gmail.com. We respond within at most 3x24 hours to confirm and 30 days to resolve, and may ask for identity verification. Rights may be excepted as provided by the PDP Law (e.g. legal obligations, law enforcement). For bonus/promo claim signals specifically, a request to delete your account or data does not delete the HMAC signals and claim record we need to prevent repeat claims (see Section 4), because of the legitimate interest in preventing abuse; this data is not used for any other purpose. You can still request access, correction, or objection to a refused bonus/promo, and we will review it manually. Withdrawing consent may make some features unusable.
6. Security
We apply reasonable technical and organisational measures: HTTPS and HSTS, hashed passwords, Secure/HttpOnly cookies, access restrictions and per-user data isolation, signed media, rate limits and anti-abuse protection, encrypted system secrets, mandatory 2FA for admins, audit trails, and regular backups. No system is fully secure; keep your password confidential. If a personal data protection failure occurs, we will give written notice to you and the competent authority no later than 3x24 hours under Article 46 of the PDP Law, including the data exposed, the time, and the response measures.
7. Cookies
Necessary cookies. We use cookies that are necessary for login sessions and security (CSRF), and the device ID cookie described below.
Cookie and local storage for abuse prevention. We store a random device ID in the __Host-hf_did cookie (HttpOnly, Secure; valid for up to 2 years and renewed when you visit again). A backup copy is stored in your browser's localStorage/IndexedDB under the key hf_did, so the device is still recognised if the cookie is deleted. It is used for bonus/promo abuse prevention (Section 2), not for advertising or cross-site tracking. The browser fingerprint is computed in your browser into a SHA-256 hash before it is sent to us. You can delete cookies and site data in your browser settings, but this does not delete claim records already stored on our servers (Section 4), and blocking them may result in the bonus/promo not being granted or the account being reviewed by an admin.
Analytics cookies. On public pages and the studio (/app), we use Google Analytics 4 from Google LLC. Google Analytics sets the _ga cookie (and derived _ga_* cookies) in your browser to recognise repeat visits pseudonymously. We do not run Google Analytics on admin pages or the password reset page. The page addresses sent to Google exclude the query string, except campaign parameters (utm_*, gclid, fbclid), so tokens or emails in URLs are not sent. Google Analytics 4 does not log or store your full IP address. We do not send your name, email, prompts or media to Google Analytics. We do not use this data for advertising and have not enabled advertising or ad personalisation features. Google processes this data on our behalf and under its own terms and privacy policy.
How to opt out or control. You can (a) block or delete cookies in your browser settings, (b) install the Google Analytics Opt-out Browser Add-on so your visit data is not sent to Google Analytics, or (c) use Do Not Track, a tracker blocker, or your browser's private mode. Opting out of analytics does not reduce service features. Deleting session cookies may log you out. For other rights over analytics data, contact us (Sections 5 and 10).
We do not use advertising cookies. If we add them later, we will update this policy and ask for your consent first.
8. Children
The service is for ages 18 and over. If we learn that a child's data has been collected without valid parental/guardian consent, we will delete it.
9. Changes
We notify material changes by email or in-app banner before they take effect. The update date is shown above.
10. Contact
Data protection officer or privacy contact: Asep (owner), email ciggurich@gmail.com, Mojokerto, East Java, Indonesia. You may also complain to the competent personal data protection authority once it has been established and is functioning.