Compliance
Our approach to responsible data processing, NBFI regulatory boundaries, and Indonesian data-protection law.
Hub document
3 sections
Active
01Our Commitment
PT Live Star Indonesia is committed to responsible handling of personal data processed through the Livestar Platform — including data from NBFI clients, Creator Partners, and end-consumers who interact with an AI Sales Talent.
02Regulatory Framework
Our approach considers the applicable Indonesian legal framework, including:
- Undang-Undang Republik Indonesia Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP)
- Related implementing regulations, guidance from the supervisory authority, and channel-specific data-handling terms (Meta, TikTok, WhatsApp)
03Data Protection Principles
- Lawful processing — appropriate legal grounds (consent, contract, legitimate interest, legal obligation)
- Transparency — clarity about who processes what, and why
- Purpose limitation — data is used for the campaign it was collected for
- Data minimization — only the fields needed to route a qualified lead
- Accuracy — corrections propagate to the partner NBFI
- Storage limitation — retention aligned with §07 of the Privacy Policy
- Security — technical & organizational measures (see §07 below)
- Accountability — audit trails, DPIA where required, and demonstrable compliance
04Roles in Data Processing
- NBFI Client: Data controller for customer applications and any post-approval consumer relationship
- Livestar: Data processor for AI Sales operations on behalf of the NBFI; data controller for its own platform operation
- Jobready Indonesia: Data controller for Creator workforce records
- Channel Providers: Independent controllers for their platform data
05AI & Multi-Tenant Data Isolation
Even when one AI Sales Talent serves multiple NBFI clients, each client's product knowledge, prospect list, conversation history, and campaign context are fully isolated. Only the Creator personality layer is shared; the NBFI context layer is walled off per client. The AI is prevented, at the orchestration layer, from citing or acting on data belonging to a different tenant.
06Data Subject Rights
Consumers have rights under UU PDP: access, correction, deletion, objection, portability, and complaint to the supervisory authority. Where Livestar processes the data on behalf of an NBFI, requests are coordinated with that NBFI as data controller. Livestar responds to and supports NBFI clients in handling valid requests within statutory timelines.
07Security Measures
We implement: tenant isolation, role-based access control, encrypted credentials, encrypted personal data at rest and in transit (TLS 1.2+), API authentication, audit logging, access expiration, webhook signature validation, secret management, data retention automation, encrypted backup, and disaster recovery. Privileged access is logged and reviewed.
08Voice Clone & Likeness
A Creator's voice clone or likeness is used only for approved campaigns, under a revocable consent captured in the Creator Studio. Consent revocation triggers deletion of voice samples within 24 hours and disables further AI narration using that voice.
01Livestar's Role
Livestar is technology and distribution infrastructure. Livestar is not a licensed bank, non-bank financial institution, payment services provider, or product issuer. Livestar does not itself extend credit, underwrite insurance, custody funds, or execute regulated financial transactions.
02NBFI Client Categories
Livestar partners with Indonesian Non-Bank Financial Institutions across four main categories:
- Leasing / multifinance — vehicle and consumer-goods finance
- Pinjol (fintech lending) — OJK-registered peer-to-peer lending and cash-loan platforms
- Pegadaian / pawnshops — collateral-based instant financing
- Koperasi (KSP) — savings-and-loan cooperatives with member-based structures
03Regulated Activity Boundary
The following are executed exclusively by the NBFI client, under its own license and OJK supervision:
- KYC / eligibility / credit scoring / underwriting
- Loan agreement issuance, e-signing, and disbursement
- Insurance policy issuance and claims handling
- Collection, restructuring, and dispute resolution
- Compulsory OJK reporting, SLIK, and consumer-protection complaint handling
Livestar's role stops at qualified handover.
04Marketing & Disclosure Guardrails
All AI-generated promotional content is bound by the NBFI client's approved marketing guidelines and disclosure requirements. Where OJK or the NBFI's own policy requires explicit disclosure of interest range, tenor, effective annual rate, registration number, or risk warning, the AI includes it in the applicable slot (visual overlay, verbal script, message footer, or WhatsApp template).
05Anti-Predatory Safeguards
- AI cannot promise approval, guaranteed disbursement, or "no BI-checking" claims
- AI cannot offer terms outside the approved range or waive fees without authorization
- AI cannot target minors or vulnerable groups excluded by the client's policy
- AI cannot solicit personal identifiers (KTP, NPWP, bank account) on open channels — those are collected only inside the NBFI's own secure onboarding flow
06Zero Compliance Risk — Structural, Not a Promise
"Zero compliance risk" refers to the structural reduction of talent-misspeaking risk: content is AI-controlled and reviewable, disclosures are enforced at generation time, and script drift is bounded by system prompts. It is not a legal warranty against every possible violation — final compliance responsibility for regulated activity rests with the licensed NBFI.
07Regulatory Response & Cooperation
Livestar cooperates in good faith with regulators, law enforcement, and NBFI clients responding to supervisory or judicial inquiries. Content archives, conversation logs, and attribution trails are retained per §07 of the Privacy Policy to support these requests.
01Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Livestar ("Processor") and the NBFI client ("Controller"). It reflects the requirements of applicable Indonesian data-protection law (UU PDP) and, where the NBFI serves EU/UK data subjects, comparable Article 28 GDPR obligations.
02Roles
For personal data submitted to or generated through the Livestar services on behalf of the NBFI client, the NBFI is the Controller and Livestar is the Processor acting on documented instructions.
03Scope
- Subject matter: AI Sales Distribution Infrastructure services (content, conversation, qualification, handover, analytics)
- Duration: Term of the master agreement + retention periods in the Privacy Policy
- Nature: Collection, storage, and processing of personal data for social distribution, messaging, AI inference, attribution, and reporting
- Data categories: Contact info, market/city, consent state, conversation transcripts, funnel-stage timestamps
04Processor Obligations
- Process only on documented instructions from the Controller
- Ensure personnel handling personal data are bound by confidentiality
- Implement the security measures in §05
- Engage sub-processors only under §06
- Assist the Controller with data-subject requests within statutory timelines
- Delete or return personal data at the end of services, per Privacy Policy retention
- Make available information necessary to demonstrate compliance
05Security Measures
- Encryption in transit (TLS 1.2+) and at rest
- Role-based access controls and least-privilege enforcement
- Logging of privileged access and change management
- Tenant isolation between NBFI clients
- Regular security assessments and periodic penetration testing
- Employee training on data handling and phishing
- Incident response and breach-notification runbooks
06Sub-Processors
Current sub-processor categories include: cloud infrastructure providers, AI/LLM providers, voice-cloning providers, video-generation providers, channel APIs (Meta, WhatsApp, TikTok, Telegram, X), and Creator payout providers. A named list is available on request and material additions are notified in advance.
07Breach Notification
Livestar will notify the NBFI Controller without undue delay after becoming aware of a personal-data breach, and within 72 hours where feasible, with the information reasonably available at the time and further updates as the investigation progresses.
08Cross-Border Transfers
Where personal data is transferred outside Indonesia (e.g. to AI model providers), Livestar relies on appropriate legal mechanisms permitted by UU PDP and contractual safeguards with the receiving sub-processor.
