Privacy Policy

Version 2.1 · effective 1 November 2026

1. Who we are

This policy covers the Ezkielyna services:

Ezkielyna Store: the ezkielyna.store website, the Telegram bot and the Mini App;
Ezkielyna API: the AI model gateway at api.ezkielyna.store;
Ezkielyna Studio: studio.ezkielyna.store;
Partner API.

Ezkielyna is the controller of the personal data described here. Privacy contact: [email protected], WhatsApp +62 857-1099-9204, Telegram @EzkielynaStore_Bot, or the Support Center after you sign in.

2. Data we collect

Ezkielyna Store (website, Telegram bot, Mini App)

Account: Telegram ID, name and username; email, WhatsApp number and password (stored hashed) if you provide them; Google identity (email, name, Google ID) if you sign in with Google.
Transactions: product, quantity, price and payment method; payment reference or proof (QRIS, e-wallet, crypto); wallet balance and history; voucher or redeem codes you use.
Delivery: the digital goods we deliver to you (for example accounts or codes), kept so you can see them again in your order history and for warranty.
Interaction: support tickets, warranty claims, reviews, community posts and referral data.
Technical: IP address and user agent in server logs; session and security cookies; page analytics (anonymous ID, device type, pages viewed) kept without IP and without email.

Ezkielyna API

Account: email, username, password (hashed), 2FA settings and API tokens.
Per-request usage: time, model, token counts, cost, duration, token name and status, plus the IP address of the request to detect abuse (always for Flash and Luna plan keys; for other accounts when abuse checks require it).
Security: login sessions and audit logs (IP, user agent).
Billing: top-up and redeem history.
Abuse prevention: When you sign in or register on the API site, we record a device identifier (a random ID stored in your browser and a hash of technical device/browser characteristics) with your IP address to prevent abuse of free credit; kept up to 60 days.
We do not store prompt or response content in the gateway logs. That content is processed while the request runs and forwarded to model providers (section 4).

Ezkielyna Studio

Conversations, attachments and generated media, stored on our servers until you delete them. Encrypted backups are kept for up to 14 days.
Sign-in uses your Ezkielyna Store account (SSO). Usage cost is recorded and charged to your balance.

Partner API: partner details (name, contact, API key) and the orders created through the API.

3. Why we use your data

To provide the service you asked for: account, orders, delivery, top-ups, API and Studio.
To process payments and to prevent fraud and abuse (rate limits, duplicate-account and free-credit checks, access audits).
For support, warranty claims and refunds, including the first-response acknowledgement of a support ticket.
For service emails: verification, receipts, payment reminders, low-balance notices and service changes.
For promotions by email or Telegram broadcast. You can stop them at any time (section 8).
To improve the service with aggregate analytics.
To meet legal obligations, such as transaction and tax records.

Our legal bases are: performance of the contract with you (account, orders, payments, delivery, API, Studio, support); your consent (promotions and optional data such as your WhatsApp number or Google Sign-In, which you can withdraw); our legitimate interest in security, fraud prevention and minimal analytics; and legal obligations.

4. Who receives data, and transfers outside Indonesia

We do not sell personal data. The parties below process data only as far as needed:

Cloudflare: Data: CDN, security and Turnstile captcha: IP, request headers, security cookies; Location: Global, including the United States

Resend: Data: Email delivery: your email address and the content of service or promotional emails; Location: United States

Telegram: Data: Bot, login and notifications: Telegram ID and your messages to the bot; Location: Global

Google: Data: Only if you use Sign in with Google; Location: United States

Payment providers (QRIS, e-wallet) and crypto networks: Data: Payment data. Crypto transactions are public on the blockchain; Location: Indonesia and the networks themselves

Third-party AI model providers and their intermediaries: Data: Prompt content, attachments and request parameters from the API and Studio, without your account name or email. These providers may process and retain data under their own policies; Location: Outside Indonesia, including the United States, China and other countries

Digital goods suppliers: Data: The order data needed to fulfil your order; Location: Depends on the supplier

Server and backup providers: Data: All of the above. Backups are encrypted; Location: Depends on the provider

Recipient	Data	Location
Cloudflare	CDN, security and Turnstile captcha: IP, request headers, security cookies	Global, including the United States
Resend	Email delivery: your email address and the content of service or promotional emails	United States
Telegram	Bot, login and notifications: Telegram ID and your messages to the bot	Global
Google	Only if you use Sign in with Google	United States
Payment providers (QRIS, e-wallet) and crypto networks	Payment data. Crypto transactions are public on the blockchain	Indonesia and the networks themselves
Third-party AI model providers and their intermediaries	Prompt content, attachments and request parameters from the API and Studio, without your account name or email. These providers may process and retain data under their own policies	Outside Indonesia, including the United States, China and other countries
Digital goods suppliers	The order data needed to fulfil your order	Depends on the supplier
Server and backup providers	All of the above. Backups are encrypted	Depends on the provider

Because some recipients are outside Indonesia, your personal data is transferred outside Indonesian jurisdiction. We choose providers with adequate safeguards. Do not send sensitive data (health or financial data, other people's official IDs) to AI models unless you need to.

5. How long we keep data

We keep data only as long as needed for the purposes above: while your account is active, and afterwards as needed for accounting, security, disputes and legal duties. Some periods are fixed:

Device identifier and the IP address recorded with it on the API site: up to 60 days.
Web server access logs (IP address, user agent): about 14 days.
Studio encrypted backups: up to 14 days.
Orders, payments and wallet records: as long as accounting and legal duties require.

You can ask us to delete your data or close your account (section 6). A remaining balance and record-keeping duties may limit deletion; if so, we will explain why.

6. Your rights

You have the right to be informed about the processing; to access your data and get a copy; to correct inaccurate data; to delete your data or close your account; to withdraw consent; to restrict or suspend processing; to object to automated decisions; to port your data; and to complain or claim compensation.

How to ask: write to [email protected], WhatsApp +62 857-1099-9204, Telegram @EzkielynaStore_Bot, or the Support Center after you sign in, state your account (Telegram ID or email) and your request. We may ask you to verify your identity so that data is not given to someone else. We aim to reply within 3 days of a complete request.

7. Security and incidents

HTTPS everywhere;
admin access with 2FA and restricted server access;
encrypted backups and monitoring.

If a personal data protection failure occurs, we notify you and the competent authority within 3 days of becoming aware of it, by email, Telegram or a notice on the website. The notice states the data affected, when and how it happened, and what we are doing to handle and recover from it.

8. Stopping promotional messages

Ask us at any time ([email protected], WhatsApp +62 857-1099-9204, Telegram @EzkielynaStore_Bot, or the Support Center after you sign in) to stop promotional emails or Telegram broadcasts and we will honour it. Required service messages (receipts, security, service changes) are still sent while your account is active.

9. Cookies and similar technologies

Necessary cookies and browser storage: session, CSRF, language and display preferences, and the browser part of the device identifier described in section 2;
Cloudflare security cookies;
Google cookies if you use Sign in with Google.

We do not use third-party advertising cookies.

10. Children

The services are intended for users aged 18 or over, or younger users with the consent of a parent or guardian.

11. Changes

We announce material changes on the website and in the bot at least 7 days before they take effect. The version and date are shown at the top of this page.