Privacy Policy

Data controller

PT Aku Percaya Diri operates Gloopi Indonesia and is responsible for personal data processing in this store service. Use the published contact details on this page for personal data questions or requests.

Data we collect

Account data includes name, email, telephone number, a hashed password, account type, and language. Business accounts include company name, tax number (NPWP), company address, and review status. We also store delivery addresses, order and payment details, quotation requests and conversations, and the tax identity and tax invoice requests you provide. Tax identity may include a 16-digit NIK/NPWP and a 22-digit NITKU where applicable. Business accounts may also include business segment and employee-count range. For first-party analytics, we process random visitor and session identifiers, viewed pages and products, search terms, cart and checkout actions, language, device category, referral sources and campaign parameters, and approximate country, region, and city from the request. Transaction events record values and quantities; IP addresses are not stored as analytics data.

Purposes and processing grounds

Data is used to create and secure accounts, answer requests, prepare quotations, process payments, ship orders, provide transaction and tax documents, and handle complaints. Grounds include performing transactions or taking steps you request, legal obligations including taxation, legitimate service-security interests balanced against your rights, and consent where required. Public document verification shows limited transaction information with masked company identity, not delivery addresses, personal contact details, or tax-document contents. First-party analytics helps us understand store usage, searches with no results, purchasing journeys, and sources of demand. First-touch attribution is saved on the account at registration; first- and last-touch attribution and a visitor identifier may be saved on an order. We do not use third-party advertising trackers.

Service providers and disclosure

Cloudflare provides hosting, database, storage, and email services. Midtrans processes payments; necessary transaction and contact information is supplied for payment. Biteship handles shipping rates and delivery using recipient details, addresses, telephone numbers, and package information. Data may also be disclosed to meet legal obligations or to providers necessary for the service. Providers may process data on infrastructure outside Indonesia, subject to applicable data protection obligations.

Cookies and browser storage

The gloopi_session cookie maintains sign-in and gloopi_locale remembers your language. Server sessions store a hashed token identifier. Browser storage also keeps your cart and quotation request drafts so selections survive navigation or sign-in. Disabling cookies or clearing browser storage may end your session and remove saved selections. The gloopi_vid analytics cookie keeps a random visitor identifier for one year, gloopi_sid keeps an analytics session for 30 minutes renewed with activity, and gloopi_ft remembers the first referral source and the most recent campaign or external referral. These are separate from the account sign-in session. You can delete cookies through browser settings.

Retention and security

Data is retained as needed for transactions, service, dispute handling, and legal and tax obligations. We do not promise automatic deletion or one uniform retention period. Passwords are hashed with PBKDF2; tax invoice documents are private and access is checked. See the Data Security page for safeguards and their limits. Transaction records, status history, and webhook payloads may be retained for checks; expired sessions or tokens are not necessarily deleted immediately. Self-service account deletion and data export are not available; send requests through the service contact. Raw analytics events are processed in Cloudflare Analytics Engine under provider retention; daily aggregates may be stored in the database for reporting. Clearing cookies does not automatically erase existing transaction records or analytics aggregates.

Your rights under the PDP Law

Under Indonesia’s Law No. 27 of 2022 on Personal Data Protection, you may request information and access, correction, updating, cessation of processing, deletion or destruction, withdrawal of consent where it is the processing ground, and other applicable rights including objections to automated decisions and portability where relevant. Rights are subject to legal conditions and exceptions, including tax-document retention requirements. Contact service; proportionate identity verification may be needed. You may also use complaint or remedy mechanisms provided by law.

Changes and contact

This policy may be updated to reflect the service and legal requirements. The update date is shown above. Use the official contact details below for privacy requests; do not send passwords or confidential payment information.

Sales-created accounts and payment documents

Sales staff may create customer accounts for field transactions and send an email invitation to set a password. Accounts without an email cannot sign in until an email is added. Account and transaction records may include the responsible salesperson, sales channel, payment terms, credit limits, partial payments, uploaded transfer proofs, and delivery proof documents. Payment and delivery proofs are private and reviewed according to authorization.

Quotation drafts are kept in browser sessionStorage to preserve selections during sign-in or registration and are valid for 24 hours. Validity is checked on access; data may remain in browser storage until accessed again or cleared by you. Do not include unnecessary sensitive information in searches or drafts. The first source stays unchanged; a new campaign or external referral updates the latest source, while internal or direct navigation does not overwrite it. The gloopi_ft cookie is stored for one year; all three analytics cookies are HttpOnly and SameSite=Lax, and Secure in HTTPS production. The store does not currently offer a separate analytics consent setting; cookies can be managed through your browser.