Privacy Policy
This policy explains what personal data Kama collects when you visit and shop at kamastore.id, what it is used for, who it is shared with, how long it is kept, and how you can exercise your rights under Indonesia's Personal Data Protection Law (Law No. 27 of 2022).
Who we are
The controller of personal data on this site is Kama, located at Prenggan, Kotagede, Yogyakarta 55172. For privacy questions, contact us by email at kamastoreyogya@gmail.com or on WhatsApp at +62 8956-1275-1234.
Data we collect
- At checkout: name, email, phone number, shipping address, postal code, notes for the courier, and the contents of your order.
- When you sign in to a buyer account: your email address and a one-time sign-in code. Your order history is kept so you can see it again.
- When you write a review: the rating, the review text, and the name shown (your account name, or the first part of your email address if the name is empty). Reviews and that name are public.
- When you pay: payment happens on Midtrans' page. We never receive or store your card number or bank password; we only receive the payment status.
- On every visit: IP address, browser and device type, pages viewed, and the cookies described under Cookies.
What we use it for
- Processing, shipping and charging for your order, including calculating shipping and sending confirmation and shipping emails (basis: performing the sales contract).
- Running your account and reviews (basis: performing the contract, and your consent when you write a review).
- Measuring visits and the effectiveness of our ads on Meta (Facebook & Instagram) and Google (basis: your consent through the cookie banner, which you can withdraw at any time — see Cookies).
- Sending one invitation to review after an order is delivered (basis: our legitimate interest). You can stop receiving it through the link in that email.
- Keeping the site secure and fixing errors, including limiting excessive sign-in attempts (basis: legitimate interest).
- Meeting legal obligations, such as keeping transaction records.
We do not sell your personal data and do not use it for any purpose other than those listed here.
Who receives data
We use the following service providers to run the store. Each receives only the data its task needs and is bound by its own privacy policy.
| Provider | Purpose | Data received | Links |
|---|---|---|---|
| Midtrans | Payment processing | Name, email, phone, order number and amount | Privacy policy |
| Biteship | Shipping rate calculation | Destination postal code, parcel weight and contents | Privacy policy |
| Resend | Sending order emails, sign-in codes and review invitations | Email, name, order details | Privacy policy |
| Meta (Facebook & Instagram) | Measuring and optimising ads | _fbp/_fbc cookies, IP address, user agent, pages viewed, purchase value, hashed email and phone | Privacy policy Opt out |
| Google Analytics | Visit and sales statistics | Analytics cookies, pages viewed, device, approximate location, purchase value | Privacy policy Opt out |
| Sentry | Recording technical errors | Error message, page, browser, IP address — never form contents | Privacy policy |
| Vercel | Website hosting and visit statistics | IP address, user agent, request logs | Privacy policy |
| Supabase | Store database | Order, account and review data | Privacy policy |
Transfers outside Indonesia
Some of the providers above process data on servers located outside Indonesia:
- Resend
- Meta (Facebook & Instagram)
- Google Analytics
- Sentry
- Vercel
- Supabase
These transfers are needed to provide the service you asked for or are made with your consent. We only use providers that apply data protection equal to or stronger than Indonesia's Personal Data Protection Law, including encryption in transit and data processing agreements with those providers.
How long data is kept
| Type of data | Kept for |
|---|---|
| Transaction records | 10 years, as business records must be kept |
| Phone & delivery address | 2 years from the order; city and province are kept |
| Buyer account | Until you ask for the account to be deleted |
| Reviews | While the review is shown, or until you ask for it to be removed |
| Review invitation opt-outs | While the opt-out applies |
| Advertising data (Meta) | 30 days in the store's systems; at Meta, per Meta's policy |
| Visit statistics (Google Analytics) | 2 months |
| Error records (Sentry) | Up to 90 days |
| Visit logs (Vercel) | Briefly — hours to days, depending on the hosting plan |
Security
Every connection to this site is encrypted (HTTPS). Order data is accessible only to store staff who need it, and a deactivated staff member loses access within one hour. Technical error records never store the contents of forms you submit.
Your rights
Under the Personal Data Protection Law, you have the right to:
- be informed about, and get a copy of, the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data deleted, except what the law requires us to keep (such as transaction records);
- withdraw consent for processing based on consent, including advertising tracking;
- object to the processing of your data.
Send your request to kamastoreyogya@gmail.com or WhatsApp +62 8956-1275-1234, naming the email address you shopped with. We confirm receipt within 72 hours and complete the request within 14 days at the latest.
Children
This site is not intended for children under 17 and we do not knowingly collect their data. If you are a parent or guardian and learn that your child sent us data, contact us and we will delete it.
Changes to this policy
We may update this policy. The "Last updated" date above always shows the version in force; we will announce important changes on this site.