Privacy Policy

Last updated: 13 October 2026

1. Data We Collect

When you transact or interact with ZenVan Store, we may store:

The name or alias you use when communicating with us
Your WhatsApp number or other contact (e.g. a Telegram username or email), for transaction-related communication
Details of the account being traded (rank, skins, heroes, price)
Transaction history, for warranty and dispute purposes
Sell-account form entries — if you fill in the form on the /jual-akun page (Mobile Legends, PUBG Mobile or Free Fire): your name, contact (a WhatsApp number or another contact you choose) and the account details you enter: rank/tier, region, bindings, level, skin & hero counts, other account attributes, access status (e.g. whether the original email is handed over), expected price and notes. We turn these entries into a chat message to our admin. When you press the form's submit button, a copy of the entries may also be stored on our server (the sell_leads table), even if the chat fails to open or you don't send the chat message, so your offer is not lost. A summary of the stored entries (name, contact, account details, price and an excerpt of the notes) may also be forwarded to our admin through our internal notification channel (Telegram bot or WhatsApp), not by email. The form does not ask for game passwords, OTPs or verification codes. If you type them into the notes field, our system tries to drop the lines containing them (including lines containing an email address) before storage, but please don't type them.
Alongside these entries we store: the ad reference code and Google Ads click identifier if you came from an ad (see section 7), your first-visit source from the zv_attr cookie if present, the page where the form was filled in, the page language, the customer-service channel active at the time, a summary of device type, operating system & browser (not the full user-agent string), and a flag for whether the browser appears to be automated. IP addresses are not stored with this data. The form on the /jual-akun/ajukan page does not open a chat: your entries go straight to our server, and our customer service then contacts you through the contact (WhatsApp or Telegram) you provided. We also store the LAST campaign source before you filled in the form (the zv_last cookie, see section 7), including the TikTok ad click identifier (ttclid) if you came from a TikTok ad, and the referral code you typed, if any. If your submission later leads to us buying the account, our admin records the account code and purchase price on the same record, to measure which promotion channel actually brings in accounts.
WhatsApp number, budget range and email (optional) if you sign up for new-stock notifications through the pop-up form on our website (stored in the wa_subscribers table)
Telegram chat ID, budget & game preference if you turn on stock alerts through our Telegram bot (@zenvanstore_bot). Stored on our own server only to send the alerts you asked for (at most 3 a day); send /stop to the bot to stop at any time.
Data from Google Sign-In (opt-in) — If you choose to sign in with Google, we receive from Google:
- Your Google account email address
- Your Google profile name and profile photo
- Your Google account ID (an internal identifier managed by Supabase Auth)
- Your sign-up date and last-login timestamp
We do not receive your Google password or access to any other Google service (Gmail, Drive, Calendar). You can disconnect at any time via Google Account — Third-party connections.
Orders on the site — if you order through the site checkout: your name, contact, email (optional) and order notes, together with your first-visit source (the zv_attr cookie) and your browser's Google Analytics identifier, to record where the order came from, plus the approximate city and country our network provider (Cloudflare) derives from your IP address (the IP address itself is not stored with the order). If you came from an ad, we also store its ad click identifier with the order (Google Ads: gclid, gbraid or wbraid; Microsoft Ads: msclkid), so we know which ads bring in buyers. Some order data is shown, censored, on the public /bukti-transaksi page (see section 3). The last campaign source before you ordered (the zv_last cookie, see section 7) may also be stored with the order.
Seller applications (old form) — if you applied through the old become-a-seller form (closed on 9 October 2026; selling your account to us now goes through /jual-akun): your name, WhatsApp number, the platform you sell on, your listing count and your message (the seller_applications table). The entries are also forwarded to our admin as a notification.
Stock alerts for a specific search — if you ask to be told when an account you searched for becomes available: the search keywords, your email or WhatsApp number, and the page language (the stock_alerts table).
Referral program — if you create a referral code: the WhatsApp number and name you enter, to link the code to you (the referral_codes table).
Email subscription — if you subscribe to email updates (e.g. in the footer, at checkout or on the account page): your email address, the form you signed up from, language, confirmation or unsubscribe status, and a record of sends (the email_subscribers table). We send a confirmation email first, and every email contains an unsubscribe link.
Conversations — messages you send to our customer-service channel (currently Telegram) may be helped by automatic replies as well as answered by our admin, and are stored on our servers (ID and profile name, message content); conversation history from the period when our support still used WhatsApp is also kept. If you use the chat assistant on this site, your messages are sent to an AI model provider to be answered, and a snippet of your latest message (max. 500 characters) may be stored to understand visitor needs.
Buyer account (sign-in) — if you sign in to buy (with Google or a code we email you): your email address, full name, phone number, the privacy-policy version you accepted and when, and your Google account ID if you sign in with Google (the buyer_profiles table). Email sign-in codes are stored only as a one-way hash and expire after 10 minutes.
Account-data access log — each time the game-account data you bought is released or opened, we record the time, the related order, and your IP address and browser type as a keyed hash (not the IP address itself) in the credential_access_log table, for security and dispute handling.
Customer Match ad consent (optional) — if you tick the Customer Match consent box at checkout, in the profile step when signing in, or on the sell-account form: that choice, when you made it and which form it came from, plus when you withdrew it if you withdraw consent (stored with your order, account profile or sell-account form entries). What it is used for is in section 7.
Technical data — data your browser sends automatically (IP address, browser type) is processed by our hosting providers and used for security, e.g. rate limiting. To count listing views and power recommendations we store a one-way hash of the IP address, not the address itself.

We do not ask for the password of your own game account or for financial data (bank accounts, PINs). The login details of a game account you BUY from us (that account's email and password) are stored encrypted and opened only for you as the order's owner — see sections 4 and 5.

2. How We Use Your Data

Reviewing and following up on account-sale offers you send, including contacting you through the contact you provided
Measuring where visits come from and how well our ads work, and showing ZenVan ads to people who have visited this site before (remarketing)
Processing and completing transactions
Providing after-sales support and warranty service
Sending new-stock notifications to subscribers who signed up
Only for those who tick the Customer Match consent box: showing relevant ZenVan ads on Google services, and not showing ads that are no longer relevant to you (for example, ads for new buyers to existing customers)
Preventing fraud and illegal activity
Improving the quality of our service
Identifying you on the /akun page and syncing your wishlist and loyalty points across devices (if you sign in with Google)
Delivering the game-account data you bought to your account only (not to anyone else who knows the order number), and making sure each account is handed to a single buyer

The legal basis for processing buyer-account data, order data and account-data delivery is the performance of the sale contract between you and us (UU PDP).

3. Sharing Your Data

We do not sell or rent your personal data. We share data with service providers that help run this site, limited to what they need for their service, and with authorities where required by law or valid legal process. Only if you tick the Customer Match consent box, we also share your email and/or phone number with Google Ads in hashed form (see section 7). In addition, some site-order data is shown, censored, on a public page (see below this list). Our service providers:

Google: Analytics, Ads (including Customer Match, only for those who consent), Tag Manager, Google Sign-In and Google Customer Reviews (see section 7)
Telegram: customer-service channel, stock-alert bot and internal notifications to our admin
Meta: Meta Pixel (ad measurement) and WhatsApp (customer-service channel and internal notifications to our admin)
TikTok: TikTok Pixel (ad measurement and remarketing; see section 7)
Microsoft: Clarity (page-interaction analytics)
Supabase (database & sign-in; servers in Tokyo, Japan), Railway (site hosting) and Cloudflare (content delivery, caching and site security)
Tripay and NOWPayments: payment processing. Tripay receives the buyer's name, email and phone number
Resend and Amazon SES: email delivery (order confirmations, sign-in codes, links to the account-data page — without the account data itself, stock news for subscribers, internal notifications to our admin). Resend is located in the United States
Brevo: contact list for stock-news subscribers, and backup email delivery when Resend cannot send (the same kinds of email as Resend above) as well as stock news for subscribers. Emails sent through Brevo may contain Brevo's open-tracking pixel and click-tracking links, and Brevo may store their content. If you enter an email in the stock-alert pop-up, that email is sent to Brevo together with the WhatsApp number and budget range you entered
Anthropic: AI model for the on-site chat assistant
Upstash: rate limiting (uses the IP address as a temporary key)
Third-party Mobile Legends ID lookup services (including Codashop): when you use the account checker, the User ID and Zone ID are sent to them to read the public nickname

Some of these providers process data outside Indonesia.

Exception for Google Customer Reviews: in this program Google does not act merely as our service provider. Google processes the data as an independent controller under Google's Privacy Policy, and Google may receive information about transactions you make on this site. Details are in section 7.

Public transaction board — the /bukti-transaksi page shows orders placed through the site checkout (except cancelled ones): account title, price, game, payment method, status and its timing, approximate city, and the buyer's identity censored on the server before it reaches the browser (at most the first 4 letters of the name, the first 2 characters of the number, and the first 3 letters of the email plus its domain). You can object to your order being shown through the contact in section 11.

We use sell-account form entries to follow up on your offer, and to count incoming offers and the ads they came from (through the reference code and ad click identifier in section 7). Our site's code does not include the name, contact or notes from this form in the tag and measurement data sent to Google, Meta or TikTok for advertising or analytics (other than the chat message you send yourself via WhatsApp or Telegram); analytics events sent when the form is submitted do not contain your name or contact. Exception: if you open the form from the PUBG Mobile price calculator, the account specs from the calculator are carried in the page address (URL) and are recorded by the analytics and ad tools as the address of the page you opened. Second exception, only with your consent: if you tick the Customer Match consent box on this form, the WhatsApp number or email you entered may be uploaded to Google Ads in hashed form (see section 7); your name and notes are never uploaded.

4. Data Security

We use encryption and industry-standard security practices to protect your data. No system is 100% secure, however, so we encourage you not to share sensitive information that isn't needed.

The login details of game accounts we sell are stored encrypted (AES-256-GCM) with keys that exist only on our server; even our admins cannot display them again from the admin panel. They are opened only for the buyer who owns the order while signed in to their account — if your last sign-in was more than 60 minutes ago you are asked for an email code again — and every opening is logged.

Data processing is governed by Indonesia's Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) (the Personal Data Protection Act).

5. Data Retention

We keep data for as long as it is needed for the purposes in section 2, for example transaction data for warranty and disputes, and sell-account form entries to follow up on your offer, or as long as the law requires. Apart from the automatic deletion described below, data is deleted at your request (see section 9) or when we review data that is no longer needed.

Game-account data delivered to you can be opened during the access period (30 days from delivery), then is automatically deleted from encrypted storage about 37 days after delivery. The account-data access log is automatically deleted after 180 days, and expired email sign-in codes are deleted automatically.

WhatsApp notification subscriber data (number and budget) is kept until you request deletion or opt out.

Sign-in profile data (for accounts signed in with Google or an email code: email, name, phone number, and Google ID where applicable) is kept while the account is active. The site has no self-service delete-account button yet: contact us (section 9) to delete your account, and we delete your Google profile data and related data once the request is verified.

6. Local Storage (localStorage & sessionStorage)

This website uses your browser's storage for:

zv_gcr_<order number> — if you check out with an email, the order number and that email are kept temporarily on your own device (at most 3 days, and deleted as soon as the Google Customer Reviews window is shown), so the order status page can show the survey offer without our server sending your email over the internet.
Wishlist (anonymous mode) — the account IDs you save are stored locally on your device. If you sign in with Google, your wishlist is synced to the server (the user_wishlist table) so it is available across devices.
Chat assistant history — if you use the on-site chat assistant, up to the last 30 messages of the conversation are kept in your device's localStorage so the conversation can continue.
History & display — accounts you viewed recently, the accounts you are comparing, a visit counter for the install-app (PWA) prompt, and other display flags (e.g. pop-ups you have closed). All of these are stored on your device; the account lists are used to load those accounts' details from our server when displayed.
Sell-account form draft (Mobile Legends) — unsent entries are kept in this tab's sessionStorage so they survive a reload. Valid for up to two hours and cleared when the tab closes.
Price calculator — your last inputs (rank, skin counts, etc.) are kept in localStorage so you don't have to re-enter them.
Cookie banner — a flag that you have dismissed the banner.

7. Cookies, Analytics & Advertising

This website uses the following technologies:

Google Tag Manager (GTM-N3PTSFRM) — a container that loads some of the tags below, including the Google Ads and Microsoft Clarity tags.
Google Analytics 4 (G-SFDK4RHBQK) — to understand how visitors use the site (pages, time on page, device, visit source, and events such as chat-button clicks). GA4 uses cookies (_ga, _ga_*) holding a random per-browser identifier. The data is pseudonymous, not anonymous: the identifier doesn't contain your name, but it links your visits together. If you order through the site checkout, the GA identifier is stored with the order and a purchase event may be sent to GA4 from our server. Google may estimate your general location from your IP address. You can opt out via the Google Analytics Opt-out Add-on.
Google Ads (AW-17982269181) — we use the Google Ads tag for two things. (1) Conversions: recording when a visitor presses a customer-service chat button, so Google can connect it to the ad click that brought them. (2) Remarketing: the tag adds your browser to a list of site visitors, so Google and its partners can show you ZenVan ads on other sites and apps based on your earlier visits. Google uses cookies for this (including _gcl_aw on our domain and cookies on Google/DoubleClick domains). If you came from an ad and then contacted us, pressed a chat button, submitted the sell-account form, or paid for an order on the site, we may send back to Google Ads only the ad click identifier, the conversion name, its time and (for paid orders) the order value, with no name, number, conversation content or form entries, so we know which ads bring in sellers or buyers. These conversion uploads are separate from Customer Match in the next item, which applies only to those who consent. You can turn off personalised ads at adssettings.google.com. How Google uses data from partner sites: policies.google.com/technologies/partner-sites.
Google Ads Customer Match (only with your consent) — ONLY if you tick the Customer Match consent box (at checkout, in the profile step when signing in, or on the sell-account form), we turn the email address and/or phone number you entered into a one-way hash code (SHA-256) before uploading it to Google Ads as a customer list (Customer Match). Before hashing, the email is normalised (lowercase, no spaces) and the phone number is converted to international format (e.g. +62…) so it can be matched. Google matches that code against Google accounts, and we use the list for two things: showing you relevant ZenVan ads, and NOT showing you ads that are no longer relevant to you (for example, ads for new buyers to existing customers). Your name, conversations, order history and other form entries are not uploaded. The box is unticked by default, is not required to buy or sell, and is only for people aged 18 or older; without the tick, we do not upload your email or number to Google Ads. Data we collected before this consent box existed (9 October 2026) is not uploaded. You can withdraw consent at any time through the contact in section 11 or, if you have an account, on the My Account page; after you withdraw, your email/number is left out of the next upload and removed from the list when that list is updated. This consent covers Google Ads only: we do not upload your email or number to TikTok or Meta as a customer list. Google processes this list under Google's Customer Match policy and Google's Privacy Policy.
Meta Pixel — records page visits and events such as chat-button clicks to measure how well our Facebook/Instagram ads work, using the _fbp cookie. If we enable server-side measurement, purchase events may be sent to Meta together with a hashed (SHA-256) phone number. See Meta's privacy policy.
TikTok Pixel — records page visits and six events to measure our ads on TikTok and to show ZenVan ads to people who have visited this site (remarketing): ViewContent (opening an account detail page), InitiateCheckout (starting checkout), Lead (submitting the Mobile Legends sell-account form), Contact (pressing a customer-service chat button, except the Mobile Legends sell form's submit button, which is already recorded as Lead), ClickButton (pressing the button to the sell-account form in an in-app browser such as TikTok's) and Purchase (a paid order, sent once from your order status page). Alongside these events we send only the account's code, title, price and category; for Purchase also the order value and order number (as a de-duplication key); for Lead, Contact and ClickButton only the category (for example selling a Mobile Legends account, or a support chat), plus, for Lead and Contact, a random code that is also the record number of that form submission or click on our server, as a de-duplication key (it contains none of your form entries or personal details). TikTok uses the _ttp cookie (and TikTok's supporting cookies) on our domain, reads the TikTok ad click identifier (ttclid) when you arrive from a TikTok ad, and receives your IP address, browser/device type and the address (URL) of the page you open. We do not enable Advanced Matching: our site's code never sends your name, email, phone number or form entries to TikTok. The pixel is not loaded on the account-data page (/akun/pesanan). See TikTok's privacy policy.
Microsoft Clarity — loaded through Google Tag Manager. Records interactions such as clicks, scrolling and cursor movement for heatmaps and session recordings, using the _clck and _clsk cookies. Clarity also syncs its identifier with a Microsoft cookie on the bing.com domain. See the Microsoft privacy statement.
ZenVan ad-bridge cookies (_zv_gclid, _zv_ref) — if you arrive from a Google ad, we store the ad click identifier and an 8-character reference code in these two cookies for 90 days, and record the reference-code-to-click pair (with the ad keyword and campaign) in the gclid_bridge table on our server. The reference code is appended to the chat message ("(ref: …)") and may be stored with sell-account form entries, so we can connect a chat or form to the ad click that brought it.
Visit-source cookie (zv_attr) — set when you arrive through a campaign, ad or referral link (or open an account/order page). It lasts 90 days and can only be read by our server. It holds the campaign parameters (UTM), the ad click identifier if any (gclid, gbraid, wbraid, msclkid), referring site, the first page you opened, a referral code if any, and the time. If the cookie already exists but holds no campaign parameters or click identifier, your next visit through an ad or campaign link updates it once. We read it when you place an order or submit the sell-account form, to record where the visit came from.
Last campaign-source cookie (zv_last) — set or updated every time you open our site through a link that carries campaign parameters (utm_source, utm_medium or utm_campaign) or one of the ad click identifiers listed below. It lasts 30 days and can only be read by our server. It holds the campaign parameters (utm_source, utm_medium, utm_campaign), one ad click identifier if any (gclid, gbraid, wbraid, msclkid, twclid, oppref, aleid), the TikTok ad click identifier (ttclid) if you came from a TikTok ad, and the time — no referring site, no page, no IP address. We read it when you submit the sell-account form or place an order, to measure which promotion channel brings in sellers and buyers.
Other cookies — ref_code (referral code from a /r/… link, 7 days) and zv_currency (the display currency you chose in the currency picker, or the one set by an ad or campaign link that carries a currency parameter, 1 year).
Customer service: WhatsApp & Telegram — Our customer service runs on WhatsApp or Telegram, currently on Telegram. Chat buttons on the site open that app with a pre-filled message (including form entries and a reference code, if any). The chat message only reaches us after you press Send in the app. Sell-account form entries are different: we may receive and store a copy on our server when you press the form's button, before the chat opens (see section 1). On Telegram, our customer service is the account @zenvanstoree. Conversations are handled by WhatsApp (Meta) or Telegram under their own privacy policies: WhatsApp privacy policy · Telegram privacy policy.
Chat-button click log (cs_clicks) — when you press a customer-service chat button (other than the sell-account form's submit button, which is already covered in section 1), our server records that the button was pressed: which button and page (without URL parameters), the page language, the customer-service channel active at the time, the request type (sell, buy or other), the ad reference code and ad click identifier if you came from an ad (read from the cookies above), campaign parameters if any, a summary of device type, operating system & browser (not the full user-agent string), and a flag for whether the browser appears to be automated. No name, number, message content or IP address is stored. We use it to count how many people choose chat rather than the form, and only the ad click identifier, the conversion name and its time may be sent to Google Ads.
Telegram chat reference log (cs_chat_refs) — if the Telegram chat message you send to our customer service contains the ad reference code ("(ref: …)", see the ad-bridge cookies above), our server records that reference code, the time of the first chat containing it, and its request type (sell, buy or other), read automatically from that message. Your message content, chat ID, name, username and number are not stored in this record. We use it to learn which ads bring in sellers who actually contact us, and only the ad click identifier, the conversion name and its time may be sent to Google Ads.
Supabase Auth (if you sign in with Google) — we store session cookies to keep you signed in:
- sb-<project>-auth-token — session token (sameSite=lax; readable by this site's scripts because the in-browser sign-in client uses it)
- sb-<project>-auth-token-code-verifier — PKCE verifier for the OAuth flow (only while signing in)
The cookies are deleted when you click “Sign out”; otherwise they last until they expire (up to about 400 days).

Google Customer Reviews (review survey, optional) — after your order payment is confirmed, the order status page may show a window from Google offering a survey about your shopping experience. To show that window, our page passes to Google's script: the order number, the email address you entered at checkout, your country (estimated from the network at checkout) and the estimated account handover date. If you choose to take part, Google will email a survey to that address a few days after that date. Google may show your rating and comments publicly as ZenVan's store rating, including in Google ads and search results. If you decline or close the window, Google does not send you a survey. Google processes this data as an independent controller under Google's Privacy Policy (policies.google.com/privacy) and may process it outside Indonesia. In connection with this program, Google and other third parties may place and read cookies, web beacons or similar technologies on your browser. You can block or delete cookies in your browser settings and manage personalised ads at adssettings.google.com. Taking part or not does not affect your order, handover or warranty, and we offer no reward of any kind for reviews.

The cookie banner on this site is a notice only: dismissing it does not switch any of the tools above on or off. How to opt out is in section 9.

8. Legal Basis for Collecting Data

Under Indonesia's Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP), we process your personal data on the following legal bases:

Consent (UU PDP Article 20(2)(a)) — for opt-in features such as Google sign-in, stock alerts (WhatsApp, Telegram or email), and marketing communication, the Google Customer Reviews survey you choose to join in Google's window, and uploading your hashed email/phone number to Google Ads Customer Match if you tick its consent box (a separate consent you can withdraw at any time — see section 9).
Performance of a contract (UU PDP Article 20(2)(b)) — to process account purchases, provide the ZenGuard™ warranty, and follow up on account-sale offers you send through the form (steps you request before an agreement is made).
Legal obligation (UU PDP Article 20(2)(c)) — where required by law enforcement or a valid court order.
Legitimate interest (UU PDP Article 20(2)(f)) — for fraud prevention and platform security, site analytics, ad measurement and delivery (including remarketing), and showing Google's review-survey offer after payment. You can object to processing for analytics and advertising in the ways described in section 9.

9. Your Rights & How to Opt Out

Request access to the personal data we hold
Request correction of inaccurate data
Request deletion of your data at any time; data still needed for warranty, disputes or required by law is kept until that need ends
Delete your sell-account form entries — contact us on Telegram or by the email in section 11 at any time to request deletion of your sell-account form entries.
Declining the Google Customer Reviews survey — simply decline or close Google's window on the order page. For survey emails or reviews you have already sent, follow the instructions in Google's email, or contact us (section 11) and we will help.
Withdraw Customer Match consent — at any time, on the My Account page (if you have an account) or through the contact in section 11 (including for consent given on the sell-account form). Withdrawing does not affect your orders, warranty or sale offers.
Stop stock alerts — send /stop to our Telegram bot, or contact customer service on Telegram or by email to remove your number from the subscriber list.
Clear your wishlist data at any time via your browser's localStorage settings
Delete your Google account link — contact customer service on Telegram to request deletion of your account and related data; we process it once the request is verified
Request that processing of your data be suspended or restricted, in proportion to the purpose of the processing
Obtain your personal data in a common, machine-readable format and transfer it to another data controller
Sue and receive compensation for violations in the processing of your personal data, in accordance with the law
Opt out of personalised ads — turn them off at adssettings.google.com (Google), in the ad preferences of Meta's Accounts Center, and under Settings and privacy → Ads in the TikTok app. This does not remove ads; it only stops tailoring them to your visits.
Opt out of analytics — install the Google Analytics Opt-out Add-on (it stops GA4 only, not the ad tags), or delete/block this site's cookies in your browser settings.
Object to the use of your data for non-essential purposes

We respond to requests regarding the rights above within 3×24 hours of receiving them, through the contact in section 11. When you buy with an account, you are asked to accept the current version of this policy once; we record the version you accepted and when.

10. Governing Language

This policy is written in Indonesian. Translations are provided for convenience. If the Indonesian version and a translation differ in meaning, the Indonesian version prevails.

11. Contact

The controller of personal data on this site is PT ZENVAN JAYA KAYA, a single-founder limited liability company (Perseroan Perorangan) operating ZenVan Store (Ministry of Law decree AHU-A125255.AH.01.30.Tahun 2026, NIB 2709260019928), represented by its sole director (officer details on record with the Ministry of Law and the OSS system), with the registered address Jl. Jaya Mangku, Loa Tebu, Tenggarong, Kutai Kartanegara Regency, East Kalimantan 75511, Indonesia. Email: enjifariz29@gmail.com.

Privacy questions can be sent via Telegram to @zenvanstoree.