Privacy Policy

1. Who we are and what this policy covers

Paccoy is run by Paccoy Infinite, based in Jakarta, Indonesia ("we", "us"). This policy explains how we process personal data in line with Law No. 27 of 2022 on Personal Data Protection ("UU PDP").

Our role depends on the data:

• For your account data (your name, email and the like), we are the data controller.
• For the customer and supplier details a business records in the app, that business is the data controller and we process the data on its behalf. If you are a customer of a shop that uses Paccoy, please send requests about your data to that shop first. We will help the shop respond.

2. What we collect

• Account: name, email address, password (stored as a hash, never in plain text), and a profile picture if you upload one.
• Company: business name, logo, timezone, language, and receipt details such as address, phone number and tax ID (NPWP).
• Members and invitations: each member's name, email, role, permissions and status, and the email address of anyone invited.
• Business data: products and their photos, stock, recipes, sales, payment records, cashier shifts, purchases, expenses and promotions.
• A business's customers and suppliers: name, phone number, email, address, tax ID and notes, as far as the business records them.
• Self-order: customers who order by QR code do not need an account. We only keep the order label (for example a table number or a name) and what was ordered.
• Technical data: IP address and browser type (user agent), recorded in the audit log and used to limit excessive sign-in attempts.
• Payments: the plan bought, the amount, the status and who paid. Card and bank details are handled directly by Pakasir and never reach us.

We do not collect your location, and we do not use analytics, tracking or advertising tools.

3. Why we use it

• To run the Service for you: creating and managing accounts, Companies and members, and recording sales, stock and books. The legal basis is performing our agreement with you.
• To send necessary emails: email verification, password resets, invitations, receipts you ask us to send, and billing reminders. The legal basis is performing our agreement.
• To process payments and keep records of them. The legal basis is performing our agreement and meeting legal obligations.
• To keep the Service secure: the audit log, limits on sign-in attempts and preventing misuse. The legal basis is our legitimate interest.
• To meet legal obligations, such as official requests from competent authorities.

If we ever want to use your data for another purpose, such as marketing emails, we will ask for your consent first.

4. Who we share it with

We do not sell personal data and do not share it for advertising. We only use the following providers to run the Service:

• Pakasir, to process payments.
• Resend, to send email.
• DomaiNesia, the hosting provider in Indonesia where the app and its data run.

Inside a Company, data is visible to members according to the roles and permissions the Owner sets. We may also disclose data where the law requires it.

5. Transfers outside Indonesia

Resend processes email outside Indonesia. What we send it is limited to what is needed to deliver an email, such as the recipient's address and the message. We make this transfer in line with Article 56 of UU PDP.

6. Cookies and browser storage

We only use cookies the Service needs to work or to remember your display choices:

• fulfillment_session: keeps you signed in. Lasts 7 days.
• fulfillment_company: remembers which Company you have open.
• sidebar_state: remembers whether the side menu is open or closed.

Your browser also stores a few things locally: the open till cart, the receipt paper width, the self-order cart, and the status of a payment in progress. This data stays on your device.

We do not use tracking or advertising cookies.

7. How long we keep it

• Account data is kept while your account is active. When you delete your account, your name, email, password and profile picture are erased.
• Financial records such as sales and shifts belong to the business and are kept without your identity, because they are needed for bookkeeping.
• Closed Companies are archived, not deleted, so their records stay available to their owner.
• If a cashier bill stays unpaid for the period set out in the Cashier Terms of Use, that Company's cashier data is permanently deleted.
• The audit log is kept for as long as the Company exists, for security and accountability.

8. Security

We protect data with reasonable measures, including: passwords stored as hashes, sessions kept in cookies that scripts cannot read, connections encrypted with HTTPS, access limited by role, and consequential actions recorded in the audit log.

Profile pictures, logos and product photos are served from direct links. Anyone who has a link can see that image, so please do not upload confidential images.

No system is perfectly secure. If you find a vulnerability, please report it to us at admin@paccoy.com.

9. Your rights

Under UU PDP, you have the right to:

• be informed about how your data is processed and get a copy of it;
• correct inaccurate data;
• ask for your data to be deleted;
• withdraw any consent you have given;
• object to, or ask us to restrict, certain processing;
• receive your data in a commonly used format;
• complain to the personal data protection authority.

You can exercise most of these yourself in your account settings, for example by changing your name and email or deleting your account. For anything else, contact us at admin@paccoy.com. We may need to verify your identity before responding, and we will respond within the time limits set by UU PDP.

10. Data breaches

If a personal data breach occurs, we will notify you and the competent authority in writing within 3 x 24 hours, as required by Article 46 of UU PDP. The notice will say what data was affected, when and how it happened, and what we are doing about it.

11. Children

The Service is meant for businesses and is not intended for anyone under 18. We do not knowingly collect children's data. If you learn that a child has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy, for example when we add features or new providers. The date of the last update is shown at the top of this page. For significant changes, we will tell you by email or in the app before they take effect.

This policy is made in Bahasa Indonesia and English. If the two differ, the Bahasa Indonesia version prevails.

13. Contact

Privacy questions or requests can be sent to admin@paccoy.com. The data controller is Paccoy Infinite, Jakarta, Indonesia.