Satupack Privacy Policy

The personal data controller is Satupack Karya Indonesia (a provisional name; the limited liability company is being registered), the operator of Satupack. Once the legal entity is registered, we will update its official name in this policy.

Satupack is a platform where buyers, sellers (including Agents and Partners), couriers and shop teams transact and work together. For data that sellers enter about their own customers (for example customers at the shop's cashier), the seller is responsible for that data as a separate controller, and Satupack acts as the system provider.

Contact for everything about privacy: it.support@satupack.com.

The data we collect falls into these groups:

• Account data: name, email address, mobile number, password (stored as a one-way scrambled value by the sign-in system; we cannot read it), profile photo (optional), and your language, appearance and notification choices.
• Address and location: delivery address with a map point (pin). Device location is read only when you use the Use my location button or pick a point on the map. For couriers who consent to GPS tracking, location is read only while delivering an order.
• Transactions: order history, vouchers, payment status and method, delivery, returns and their supporting evidence (photos/videos), reviews, product questions, chat messages with shops, favourite products, followed shops and watched prices. Card and e-wallet data is processed by the payment provider (Midtrans); we do not store your card number.
• Photos and files you upload: product photos, review photos, return and delivery proof photos, and profile photos.
• For sellers, couriers and shop teams only: business data (shop name and profile, products, prices, stock, sales, finances and the customer data you record), payout bank account, and when opening a shop or registering as a courier: national ID number (NIK), ID card photo and a selfie holding the ID card, courier vehicle data, and team member data.
• Technical data: device type, language, pages opened, approximate country and city (without storing the IP address), a random browser identifier for unique-visitor statistics, and security logs and personal-data access logs.

We process personal data only on a lawful basis under the PDP Law:

• Performance of our agreement with you (Terms and Conditions): creating and managing your account, processing orders, payment, delivery, returns and the Resolution Center, and sending order notifications in the app and by email.
• Your consent: reading your location, third-party marketing and analytics trackers (cookies), processing ID card data for verification, and promotional messages if any. You may withdraw consent at any time.
• Legal obligations: recording transactions and finances, lawful requests from authorities, and handling disputes.
• Legitimate interests: keeping accounts and the platform secure, preventing fraud and abuse, improving the service with statistics that do not identify you, and resolving disputes.

We do not sell your personal data. Data is shared only as needed with the following parties:

• Sellers and couriers who fulfil your order: name (first name only for sellers), delivery address, location point, mobile number for delivery, and the contents of the order.
• Supabase: the database, account sign-in, file storage and server functions where Satupack data is stored and processed.
• Vercel: hosting provider for the satupack.com website.
• Midtrans: payment processing (QRIS, e-wallets, cards and others). Satupack receives the payment status, not your card number.
• Cloudflare Turnstile: a check that tells humans from automated programs (CAPTCHA) when signing in and signing up.
• Email provider (Zoho SMTP): sending verification and notification emails. WhatsApp links in the app open WhatsApp on your device; automatic WhatsApp messages are sent only if enabled and will be announced in this policy.
• Map providers: OpenStreetMap (map embedded on the website), and Google Maps (Android) and Apple Maps (iOS) in the app; the point shown may be visible to the map provider.
• Artificial intelligence (AI) providers: translation of page content by admins uses Anthropic, and product photo enhancement uses an AI provider if the seller enables it. Buyer data and other personal data are not sent to AI services.
• Google (Analytics 4, Tag Manager, Google Ads), Meta (Pixel) and TikTok (Pixel): only if you consent to cookies, see section 5.
• Authorities, when required by law or to protect the rights and safety of users and Satupack.

We use storage in your browser for things the site needs to work: your sign-in session, language choice, cart and favourite products, recently viewed products, referral code, your cookie choice, and a random browser identifier for unique-visitor statistics in the admin dashboard. That random identifier is not personal data and contains no IP address.

Third-party trackers are loaded only after you tap Accept on the cookie banner: Google Analytics 4 (with IP anonymisation), Google Tag Manager, Google Ads, Meta Pixel and TikTok Pixel, to the extent enabled by the admin. If you tap Decline, those scripts are not loaded. The banner does not appear if no tracker is enabled.

To change your choice, clear the site data for satupack.com in your browser settings; the banner will appear again. You can also block cookies in your browser settings, though some features (such as signing in) will then not work.

We apply reasonable technical and organisational safeguards to protect personal data:

• Encryption in transit (HTTPS/TLS) between your device and our servers.
• Row-level access restrictions (Row Level Security) in the database: each user can read only their own data, and sensitive tables can be reached only through server functions that check access rights.
• ID card data, ID photos and selfies are stored in private storage, can be viewed only by authorised staff, and every access is permanently logged.
• Masking of personal data on screen and in reports, for example ID numbers, buyer names in reviews and mobile numbers, so people without a need do not see complete data.
• Logging of access to personal data and admin actions, admin rights limited per task, and two-step verification (MFA) for admin accounts.
• CAPTCHA checks, request rate limits in the account sign-in system and detection of unusual activity.
• No system is completely immune. If a personal data protection failure occurs, we notify affected users and the authorities as required by applicable regulations.

Some of our service providers (for example hosting, database and trackers) may process data on servers outside Indonesia. We choose providers that apply adequate data protection and bind them to confidentiality obligations, in line with the PDP Law's provisions on transfers of personal data.

We keep data for as long as needed for the purposes above, then delete or anonymise it:

• Account data: while the account is active. After the account is closed, data that is no longer needed is deleted or anonymised.
• Transaction, payment and financial records: as required by law, generally up to 10 years under company-document and tax rules.
• Return evidence, chats and dispute data: as long as needed to resolve disputes or investigations, then deleted or anonymised.
• ID card data, ID photos and selfies: as long as needed for verification and fraud prevention, then deleted or anonymised as needed and permitted by law.
• Security records and access logs: kept longer as security evidence and cannot be altered.

Under the PDP Law, you have the right to:

• access and obtain a copy of your personal data;
• correct data that is wrong or incomplete (you can change some of it yourself in Account: profile, addresses, photo and settings);
• request deletion of data or closure of your account;
• withdraw consent, and restrict or object to certain processing;
• receive your data in a readable format (portability) and object to decisions made solely by automated means;
• lodge a complaint with us, or with the competent data protection authority.

Deleting your account yourself: open Account > Security > Delete account on the website, or Account > Delete account in the app. You need to type HAPUS and enter your password. An account can be deleted only when there are no unfinished orders, returns, invoices, balance or team members. Personal data (name, email, phone number, photo, addresses, bank account, ID card and selfie, chat text) is deleted or anonymised; transaction history, financial records and logs that we must keep remain in anonymous form, and reviews stay visible without your name. We send a confirmation email.

How to exercise other rights: email it.support@satupack.com from the email address registered to your account, stating the right you wish to exercise. We may ask you to verify your identity and will respond as soon as possible, generally within 14 business days.

We may refuse or delay a deletion request to the extent the data must still be kept by law or is needed to handle disputes, investigations and fraud prevention. We will explain the reason.

Satupack is intended for users aged 18 or over or who are legally competent. Children under 18 may use the service only with the consent and supervision of a parent or guardian. We do not knowingly collect children's data without that consent; if we learn that we have, we delete it.

We may update this policy, for example because of changes to the service, providers or regulations. The version and effective date are at the top of the page. For important changes, we will notify you in the app, on the website or by email before they take effect.

Questions, data-rights requests or privacy complaints: it.support@satupack.com. Customer Care contacts and other guides are on the Help page.