Privacy Policy

1. Introduction & Scope

2. The Data We Collect

To deliver a resilient, cloud-connected Point of Sale service, we collect the following categories of data:

3. How We Use Your Data

We process your data for legitimate business purposes, including:

• Delivering and maintaining core POS capabilities (order management, thermal printing, offline-to-online sync, and multi-outlet management).
• Generating sales reports, profit & loss analytics, and cashier ledger exports.
• Facilitating automated digital receipts dispatched via WhatsApp Business API and email.
• Managing and verifying KopiPOS SaaS subscription billing and proforma invoices.
• Detecting fraud, mitigating unauthorized account access, and conducting security audit logs.
• Fulfilling statutory accounting, tax, and government regulatory obligations.

4. Data Security & Multi-Tenant Isolation

Your data security is our top priority. We implement defense-in-depth safeguards across our infrastructure:

• High-Grade Encryption: All network traffic is encrypted via TLS 1.3 in transit and AES-256 for persistent database storage and backups.
• Multi-Tenant Isolation: Tenant data is strictly segmented via Row-Level Security (RLS) or dedicated database schemas/servers according to your subscription tier.
• Indonesian Data Center Sovereignty: Primary servers and relational databases reside within ISO 27001-certified data centers in Indonesia to ensure low latency and regulatory compliance.
• Continuous Backups: Redundant, encrypted backups are taken regularly to prevent loss from hardware failure.

5. Third-Party Sub-Processors & Data Sharing

We do not sell, rent, or trade your personal or store data to third parties. Data is shared strictly with trusted service providers essential to service delivery:

• Licensed Payment Gateways: Xendit and Midtrans for QRIS, Virtual Accounts, and subscription processing.
• Digital Communication Platforms: WhatsApp Business Platform / Cloud API (Meta) for digital receipt messaging.
• Cloud Infrastructure Providers: Certified cloud compute and CDN providers for application uptime and speed.
• Law Enforcement: Only when strictly mandated by a valid court order or statutory legal obligation under Indonesian law.

6. Your Privacy Rights

Under applicable data protection laws including the Indonesian Personal Data Protection Act (UU PDP No. 27/2022), you are entitled to the following rights:

• Right to Information: Transparent notification of how and why your personal data is collected and processed.
• Right of Access & Correction: View and update your business profile, staff members, and product catalogs at any time via KopiPOS Admin.
• Right to Data Portability: Export your transaction logs, customer records, and inventory data into open CSV or Excel formats.
• Right to Withdraw Consent: Opt-out of optional features such as marketing communication integrations.
• Right to Erasure: Request permanent deletion of your business account and stored personal data.

7. Data Retention & Account Deletion Requests

We retain your store data for as long as your account is active and in good standing. If you choose to terminate your service:

• Store records are preserved during a 30-day grace period to allow easy reactivation should you change your mind.
• Following the grace period or upon explicit written request, all active store records are permanently purged from live databases, save for mandated statutory tax or financial records.
• To request complete account and data deletion, store owners can navigate to Settings > Delete Account in KopiPOS Admin or email [email protected].

8. Contact Us & Data Protection Officer

If you have inquiries, privacy concerns, or wish to exercise your legal data protection rights, please contact our team: