Legal Dokumen Terakhir diperbarui: 13 Oktober 2026

Kebijakan Privasi

Platform Toko Online Mandiri — RepeatOrder.id (repeatorder.id)

1. Komitmen Privasi Kami

Privasi Anda dan keamanan data bisnis Anda adalah prioritas utama di RepeatOrder.id (repeatorder.id). Kebijakan Privasi ini menjelaskan bagaimana kami mengumpulkan, menggunakan, menyimpan, membagikan, melindungi, dan menghapus data pribadi merchant maupun pembeli sesuai dengan Undang-Undang Republik Indonesia No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) serta kebijakan perlindungan data global termasuk kebijakan layanan Google.

2. Data yang Kami Kumpulkan

Untuk menunjang operasional toko online Anda, kami mengumpulkan kategori data berikut:

Data Akun Pemilik Toko: Nama lengkap, alamat surel (email), nomor telepon/WhatsApp, dan nama toko.
Data Pengguna Google (Google OAuth): Nama lengkap, alamat email, foto profil publik, dan Google ID saat Anda memilih login/daftar menggunakan Google.
Data Katalog & Pengaturan Toko: Informasi nama produk, foto, harga, deskripsi, varian, dan rekening bank tujuan pembayaran.
Data Transaksi Pembeli Toko: Nama penerima pesanan, nomor telepon penerima, alamat tujuan kirim barang, rincian produk yang dipesan, dan nomor resi pengiriman kurir.

3. Jaminan Kepemilikan Database Pelanggan

Prinsip Inti RepeatOrder.id: Data pembeli yang melakukan pemesanan di toko Anda adalah 100% hak milik Anda sebagai merchant.

Kami tidak akan pernah menjual, menyewakan, meminjamkan, atau memanfaatkan nomor telepon dan data pembeli Anda untuk tujuan kampanye pemasaran pihak lain ataupun mempromosikan produk dari toko kompetitor.

4. Tujuan Penggunaan Data

Informasi yang diproses hanya digunakan untuk keperluan sah berikut:

Menyediakan infrastruktur katalog produk dan form pesanan belanja daring.
Autentikasi akun pengguna dan proses masuk (login) yang aman.
Melakukan estimasi kalkulasi tarif ongkos kirim melalui API resmi pihak ketiga.
Mengirimkan notifikasi ringkasan pesanan ke WhatsApp/email pembeli dan pengelola toko.
Mencegah aktivitas spam, percobaan intrusi peretasan, dan menjaga stabilitas server.

5. Larangan Penjualan Data & Periklanan Pihak Ketiga

Kami memberlakukan kebijakan tanpa kompromi mengenai transfer data:

Kami TIDAK PERNAH menjual atau mentransfer data pengguna kepada broker data atau penjual ulang informasi.
Kami TIDAK PERNAH menggunakan data pribadi atau data akun Google untuk penargetan iklan (*targeted advertising*), iklan yang dipersonalisasi (*personalized ads*), atau iklan retargeting.
Kami TIDAK PERNAH menggunakan data pengguna untuk menilai kelayakan kredit (*credit-worthiness*) atau keperluan pinjaman (*lending*).
Kami TIDAK PERNAH menggunakan data pengguna Google untuk melatih model kecerdasan buatan (*AI/ML*) non-personal atau umum.

6. Keamanan & Penyimpanan Data

Kami menerapkan mekanisme keamanan multi-tenant yang ketat dengan isolasi data antar toko (tenant isolation), enkripsi kata sandi berbasis hashing kriptografi modern (Bcrypt/Argon2), komunikasi jaringan aman terenkripsi (HTTPS / SSL TLS 1.3), penandatanganan sesi menggunakan HMAC-SHA256, serta pencadangan basis data secara berkala.

7. Retensi & Penghapusan Data (Data Retention & Deletion)

Kami hanya menyimpan data pribadi pengguna selama akun pengguna aktif dan diperlukan untuk operasional toko atau pemenuhan kewajiban hukum.

Hak Penghapusan Data: Pengguna dapat mengajukan penghapusan akun beserta seluruh data pribadi yang tersimpan kapan saja dengan menghubungi kami di [email protected] atau [email protected] dengan subjek "Permohonan Penghapusan Data Akun". Permintaan Anda akan diproses dan data akan dihapus permanen dalam waktu selambat-lambatnya 30 hari.

Untuk pengguna akun Google, Anda juga dapat mencabut izin aplikasi RepeatOrder.id secara mandiri kapan saja melalui Pengaturan Izin Akun Google.

Official English Policy Effective Date: October 13, 2026

Google User Data Privacy Policy

Application: RepeatOrder - Platform Toko Online (https://repeatorder.id)

1. Introduction & Scope

This Privacy Policy explains how RepeatOrder.id ("we", "us", or "our", accessible at https://repeatorder.id) collects, uses, protects, and discloses personal data when you use our multi-tenant e-commerce platform, including when you sign in or register using your Google Account ("Sign in with Google").

2. What Google User Data Is Accessed

When you choose to authenticate with Google, our application requests access solely to basic, non-sensitive profile scopes (openid, email, and profile). Specifically, we access:

Google User ID (sub): A unique numeric identifier provided by Google to identify your account across sessions.
Full Name: To populate your user display name on our platform.
Email Address: To verify your account, send transactional receipts, and facilitate account recovery without requiring a manual password.
Profile Picture URL: To display your user avatar within your store or customer profile.

*We DO NOT request or access any sensitive or restricted scopes, such as Google Drive files, Gmail messages, Google Contacts, Google Calendar, or location data.

3. How We Use Google User Data

We process your Google user data strictly for user-facing features and operational functionality:

Account Creation & Authentication: To create your merchant or buyer account and securely log you into the platform without manual password entry.
Transactional Notifications: To send order confirmation summaries, checkout receipts, and shipping status updates to your verified email address.
Account Management: To maintain your profile settings and store ownership records.

4. Data Sharing, Transfer, and Third-Party Disclosures

We do NOT sell, rent, lease, or trade Google user data to any third parties.

We do not transfer or disclose your Google user data to third parties except strictly as necessary to provide our core services (such as our secure cloud hosting provider under strict confidentiality agreements), or if required by applicable law.

5. Prohibited Uses: Advertising, Data Resale, and AI Training

In strict adherence to Google Trust & Safety rules, RepeatOrder.id affirms that Google user data will NEVER be used for:

Targeted or Personalized Advertising: We do not use Google user data for targeted advertising, personalized ads, retargeted ads, or interest-based marketing.
Data Brokers & Resale: We do not sell or provide Google user data to data brokers, advertising networks, or information resellers.
Creditworthiness or Lending: We do not use Google user data to evaluate creditworthiness or for any lending purposes.
AI / Machine Learning Model Training: We DO NOT use Google user data or Google API data to develop, train, or fine-tune generalized or non-personalized Artificial Intelligence (AI) or Machine Learning (ML) models.

6. Data Security and Protection Mechanisms

We implement comprehensive technical and organizational safeguards to protect your personal information:

Encryption in Transit: All communications between your browser, Google OAuth servers, and our platform are encrypted using modern Transport Layer Security (HTTPS / TLS 1.3).
Encryption at Rest: Database records are hosted in secured, firewalled server environments with restricted access control.
Session Integrity: OAuth states and session tokens are signed with cryptographic HMAC-SHA256 nonces and secured with HttpOnly, SameSite, and Secure cookie attributes.
Tenant Data Isolation: Strict multi-tenant boundaries ensure customer and store data are isolated and inaccessible to other users.

7. Data Retention and Deletion Policy

Retention Period: We retain your personal information (including data obtained via Google OAuth) only for as long as your account remains active or as needed to provide you with the e-commerce services requested, unless a longer retention period is mandated by law.

User Deletion Rights: You have the right to request the permanent deletion of your account and all associated Google user data at any time.

How to Request Deletion: Send an email to [email protected] or [email protected] with the subject line "Data Deletion Request" from your registered Google email address. Our privacy team will confirm your request and permanently delete your personal data within 30 days.
Revoking Access: You can also immediately revoke RepeatOrder.id's access to your Google account at any time by visiting your Google Account Security Permissions page.

8. Google API Services User Data Policy Compliance

Limited Use Disclosure:
RepeatOrder.id's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Privacy Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

Platform: RepeatOrder.id (repeatorder.id)

Lead Developer & Founder: [email protected] / [email protected]

WhatsApp Support: +62 812-8362-6359

Official Website: https://repeatorder.id

Privacy Policy URL: https://repeatorder.id/privacy