Privacy Policy

Last updated: 17 May 2026

1. Data We Collect

When you transact or interact with ZenVan Store, we may store:

• The name or alias you use when communicating with us
• Your WhatsApp number, for transaction-related communication
• Details of the account being traded (rank, skins, heroes, price)
• Transaction history, for warranty and dispute purposes
• WhatsApp number and budget range if you sign up for new-stock notifications through the pop-up form on our website (stored in the wa_subscribers table)
• Data from Google Sign-In (opt-in) — If you choose to sign in with Google, we receive from Google:
  • Your Google account email address
  • Your Google profile name and profile photo
  • Your Google account ID (an internal identifier managed by Supabase Auth)
  • Your sign-up date and last-login timestamp
  We do not receive your Google password or access to any other Google service (Gmail, Drive, Calendar). You can disconnect at any time via Google Account — Third-party connections.

We do not directly collect game account passwords or financial data (bank accounts, PINs).

2. How We Use Your Data

• Processing and completing transactions
• Providing after-sales support and warranty service
• Sending new-stock notifications to subscribers who signed up
• Preventing fraud and illegal activity
• Improving the quality of our service
• Identifying you on the /akun page and syncing your wishlist and loyalty points across devices (if you sign in with Google)

3. Sharing Your Data

We do not sell or rent your personal data to third parties. Data is shared only where required by law or valid legal process.

4. Data Security

We use encryption and industry-standard security practices to protect your data. No system is 100% secure, however, so we encourage you not to share sensitive information that isn't needed.

Data processing is governed by Indonesia's Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) (the Personal Data Protection Act).

5. Data Retention

Transaction data is kept for 12 months from the transaction date, then deleted or anonymised, unless the law requires us to keep it longer.

WhatsApp notification subscriber data (number and budget) is kept until you request deletion or opt out.

Google profile data (for accounts signed in with Google) is kept while the account is active. After you delete your account, the related data is permanently erased within 30 days.

6. Local Storage (localStorage)

This website uses your browser's localStorage for:

• Wishlist (anonymous mode) — the account IDs you save are stored locally on your device. If you sign in with Google, your wishlist is synced to the server (the user_wishlist table) so it is available across devices.
• Live chat session — if you use live chat, a session token may be stored locally so the conversation can continue.

7. Cookies & Analytics

This website uses the following technologies:

• Google Analytics 4 (GA4) — we use GA4 to understand how visitors use our website (pages visited, time on page, device). This data is collected anonymously and cannot identify you personally. You can opt out via the Google Analytics Opt-out Add-on.
• WhatsApp Business — our customer support runs on WhatsApp. When you contact us via a WhatsApp button or message form, the conversation is handled through WhatsApp Business under WhatsApp/Meta's own privacy policy. See the WhatsApp privacy policy for more information.
• Supabase Auth (if you sign in with Google) — we store session cookies to keep you signed in:
  • sb-<project>-auth-token — session token (httpOnly, secure, sameSite=lax)
  • sb-<project>-auth-token-code-verifier — PKCE verifier for the OAuth flow (only while signing in)
  The cookies are deleted automatically when you click “Sign out” or when the session expires.

8. Legal Basis for Collecting Data

Under Indonesia's Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP), we process your personal data on the following legal bases:

• Consent (UU PDP Article 20(2)(a)) — for opt-in features such as Google sign-in, WhatsApp notifications, and marketing communication.
• Performance of a contract (UU PDP Article 20(2)(b)) — to process account purchases and provide the ZenGuard™ warranty.
• Legal obligation (UU PDP Article 20(2)(c)) — where required by law enforcement or a valid court order.
• Legitimate interest (UU PDP Article 20(2)(f)) — for fraud prevention and platform security.

9. Your Rights

• Request access to the personal data we hold
• Request deletion of your data once the warranty period ends
• Opt out of WhatsApp notifications — send “BERHENTI” to our WhatsApp or contact support to remove your number from the subscriber list
• Clear your wishlist data at any time via your browser's localStorage settings
• Delete your Google account link — contact support on WhatsApp to request deletion of your account and related data (processed within 30 days)
• Object to the use of your data for non-essential purposes

10. Governing Language

This policy is written in Indonesian. Translations are provided for convenience. If the Indonesian version and a translation differ in meaning, the Indonesian version prevails.

11. Contact

Privacy questions can be sent via WhatsApp to +62 831-9644-0619.