1Seller data we keep
- What you enter at sign-up: business name, type of business, city, number of stores, the point-of-sale app you use, the owner's name, WhatsApp number, account email, and the language you chose for emails.
- Your password, stored as a hash. We cannot read your password.
- Your sign-in session: one cookie from api.poinpas.com that lasts 30 days, or until you sign out.
- The stores, API keys, points rules and tier settings you create. API keys are stored as a hash.
- Billing: plan, month, amount, reference number and payment notifications from Doit. Your card or bank details never pass through Poinpas, because you enter them directly on Doit's page.
IP addresses are held briefly in server memory, for at most 1 hour, to limit sign-in and sign-up attempts. They are not stored in the Poinpas database.
2Store customer data
Sellers register their customers with Poinpas through their point-of-sale app or the Till in app.poinpas.com. For each customer, we keep:
- one identifier chosen by the seller: phone number, email, card code or another identifier;
- a name, if the seller adds one;
- history at that seller's stores: time and total of each purchase, the store, points earned and redeemed, and tier.
We do not receive the items bought, the payment method, or the customer's address.
Customer data can only be seen by the seller account that registered it. The same person at two seller accounts is recorded as two separate customers.
If you are a customer and want to see, correct or delete your data, contact the store where you are registered. The seller can anonymise your data from the Poinpas app: your identifier and name are erased, and the points history stays without an identity. If the store does not respond, contact us at halo@poinpas.com.
3What the data is used for
- calculating, keeping and redeeming points and tiers under the seller's rules;
- producing per-store reports for the seller;
- counting active members for plans and billing;
- sending account emails: confirmation, password resets, billing and notice of changes to the terms;
- contacting sellers by WhatsApp or email about their account, billing, and help connecting a point-of-sale app;
- keeping the service secure, for example by limiting sign-in attempts.
The basis for processing seller data is performing our agreement with you, the Terms of Service. The basis for processing customer data is set by the seller, usually the consent asked for at the till.
We do not sell data, do not use it for advertising, and do not contact store customers.
4Providers that process data with us
- Tencent Cloud runs the Poinpas API server and database in Jakarta, Indonesia. All account and customer data is stored there.
- Cloudflare serves the Poinpas web pages and runs DNS. To deliver pages, Cloudflare processes visitors' IP addresses, and its network may serve them from outside Indonesia. These web pages store no account data.
- Cloudflare Turnstile checks that a person, not a bot, fills in the sign-up, sign-in and forgot password forms. For that Cloudflare processes the IP address and signals from the browser, and the Poinpas server sends the IP address when it checks the result.
- Doit (doit.id) processes plan payments. We send the invoice amount and a reference number, and you enter your payment details directly on Doit's page.
- The email provider we use receives the recipient address and the content of the account emails we send.
6How long data is kept
Account data and points history are kept while the account is active. Points history is recorded by adding rows only: cancels and corrections become new rows, so every customer's balance can always be traced.
After an account is closed, you can ask for your personal data to be deleted. We then anonymise the personal data in your account and its customer data, except what the law requires us to keep.
Billing records are kept for as long as Indonesian tax regulations require.
7Security
Every connection to Poinpas uses HTTPS. Passwords, API keys and sign-in tokens are stored as hashes. System credentials, such as access to the email server and payments, are encrypted with AES-256-GCM. Every Poinpas admin signs in with a password and a code from an authenticator app.
If a personal data protection failure occurs, we notify the people affected and the competent authority in writing within 3 x 24 hours, as the PDP Law requires.
8Your rights
Under the PDP Law, you have the right to access your personal data, correct it, ask for it to be deleted, withdraw consent, and object to its processing.
Sellers can send a request from their account email to halo@poinpas.com. We respond within 3 x 24 hours. Store customers can read Store customer data.
9Changes to this policy
If this policy changes, we update its effective date above and send notice to sellers' email at least 14 days before the change takes effect.
This policy is available in Indonesian and English. If the two differ in meaning, the Indonesian version prevails.
10Contact
PT Jipraks Digital Indonesia. Questions and requests about personal data can be sent to halo@poinpas.com.