Privacy Policy

PT Solusi Bagi Bangsa (“jualan.ai”, “we”, “us”) operates the website jualan.ai and the jualan.ai product. We are the data controller (pengendali data pribadi) for the personal data described in this policy, except where we process buyer data on behalf of a seller — see section 2.

jualan.ai is an AI commerce platform that lets Indonesian sellers build and run online stores. For any question or request about this policy or your data, email support@jualan.ai.

This policy covers four groups of people:

• Sellers and their staff, who hold platform accounts and run stores on jualan.ai.
• Buyers, who shop on a seller’s storefront. We process buyer data on behalf of the seller: the seller is the data controller for their store’s customers and may publish an additional policy for their own store.
• Waitlist and marketing visitors, who join the early-access list or browse jualan.ai itself.
• People who contact us about the platform.

We collect what you give us, what is needed to run a store, and a small amount of technical information that comes with any web request. We do not buy personal data from third parties.

• Waitlist — name, email address, and phone number (used to reach you by email or WhatsApp), plus an optional referral code if you joined through someone’s link.
• Account data — name, email address, and authentication identifiers. Sign-in is handled by a dedicated identity provider; we never store passwords.
• Buyer identity — buyers sign in through a separate service from seller accounts: email address, saved shipping addresses, order history, cart, and wishlist.
• Orders and fulfillment — order contents, shipping addresses, payment status, and payment metadata such as virtual-account numbers, QRIS payloads, and the provider callback records used to confirm payment. Payments are processed by a licensed Indonesian payment gateway on a platform merchant account; we do not store card or e-wallet credentials.
• Seller content — catalog, product data, media files, storefront configuration, and (for digital and class stores) deliverables and access records.
• Assistant conversations — messages sellers exchange with the AI assistant, and buyer-assistant messages on storefronts.
• Connected platform data — only when a seller connects an integration: Google Sheets (see section 8) and Meta (see section 9).
• Technical data — logs, device, and usage information needed to operate and secure the service. Your IP address may be used in memory to rate-limit abuse of public forms.

We do not ask for specific personal data (data pribadi yang bersifat spesifik under UU PDP) such as health, biometric, genetic, or religious information, and you should not put it into chat or free-text fields.

We use data to provide and operate the service; review waitlist requests and open early access; process orders, shipping quotes, and payouts; provide AI features; give customer support; keep the service secure and prevent fraud and abuse; measure aggregate site usage and performance; send service emails (waitlist updates, order confirmations, tracking links, access links, and account alerts); and comply with the law.

We do not sell personal data, and we do not use it for third-party advertising or ad targeting.

Under Article 20 of UU PDP, we rely on:

• Your consent — you give it by submitting a waitlist form, creating an account, or connecting an integration. Optional fields can be left blank.
• Steps taken at your request before entering an agreement — evaluating a waitlist request and setting up access.
• Performance of an agreement — operating your store, processing orders, and metering prepaid usage.
• Our legitimate interests — securing the site, preventing abuse, and understanding demand for the product, weighed against your rights and interests.
• Legal obligation, where a law requires us to process or retain something — including tax and commercial records of transactions.

We do not sell or rent personal data. We share data only with service providers that process it on our instructions, strictly as needed to run jualan.ai and under contractual data-protection terms: cloud hosting and infrastructure, database hosting, cloud object storage, identity and authentication services, AI model providers, a licensed Indonesian payment gateway, shipping-rate providers, email delivery services, analytics and performance-monitoring services, and web research providers.

Order data is disclosed to the seller whose store received the order — they are the controller of their own customers’ data. We may also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim. If our business is ever reorganised, merged or acquired, data may transfer to the successor entity, which would remain bound by this policy. There is no other sharing.

Chat and other AI features are processed by third-party large language model and image-generation providers. Inputs are used to generate responses and content for the seller’s own store — not to train models of our own, and not to train public models on our behalf.

Data is processed on infrastructure operated by our service providers, which may be located outside Indonesia. Consistent with the international transfer requirements of UU PDP, we only use providers that offer an adequate level of protection and we put contractual data-protection terms in place with them. If you would like more detail on a specific transfer, email support@jualan.ai.

• Waitlist records — for as long as your request is open and while we are in contact with you about jualan.ai. We review records that have had no contact for 24 months and delete those we no longer need.
• Assistant conversation history is kept for 90 days, then automatically deleted.
• A deleted store goes offline immediately and is permanently purged, including its media files, after 30 days.
• Order and transaction records are retained as required by Indonesian tax and commercial law.
• Everything else is kept for as long as the account is active, or as needed to provide the service.

We delete sooner if you ask us to — see section 13. Copies may persist briefly in routine backups after deletion and are removed as those backups age out.

We use essential authentication and session cookies only: a seller session cookie, and a buyer session cookie shared across storefront subdomains. We do not use advertising cookies, cross-site tracking cookies, or third-party ad pixels. Blocking the session cookies breaks sign-in.

On the marketing site we use a cookieless analytics service to count page views and see which pages are used. It does not build a cross-site profile of you as an individual; we see aggregate numbers, not a browsing history tied to a person.

Under UU PDP you have the right to:

• Be told what personal data we hold about you and how we use it
• Access it, and get a copy
• Correct or update it if it is wrong or out of date
• Have it deleted or destroyed
• Withdraw a consent you previously gave
• Object to processing, including to decisions made solely by automated means
• Ask us to restrict or delay processing
• Receive your data in a usable format and have it transferred to another controller where technically feasible
• Lodge a complaint with the competent authority

How to exercise them: email support@jualan.ai from the address you gave us, and tell us what you want. Buyers of a specific store may also contact that store’s seller directly. If we cannot tell it is you, we may ask for something more to verify your identity before we act. We will respond as quickly as we can, and within 30 days at the latest. There is no charge.

Withdrawing consent stops future processing, but does not make processing we already carried out unlawful. Some requests may be limited where a law requires us to keep a record.

We take reasonable technical and organisational measures to protect personal data: traffic is encrypted in transit over HTTPS, integration credentials are encrypted at rest with AES-256-GCM, access is controlled by per-store roles, every store’s data is isolated from every other store’s, and public forms are rate-limited against abuse.

No system is perfectly secure. If a personal data breach affecting you occurs, we will notify you and the relevant authority as required by UU PDP, within the timeframe the law sets.

jualan.ai is a product for businesses and is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email support@jualan.ai and we will delete it.

If we change this policy we will update this page and change the “Last updated” date at the top. If a change materially affects how we handle your personal data, we will give you notice before it takes effect — by email where we hold your address, or through a notice on the site. Continuing to use jualan.ai after a change takes effect means you accept the updated policy. If you do not accept it, stop using the service and ask us to delete your data.

For anything about this policy or your personal data, email support@jualan.ai.

We would rather hear from you first and put it right. If you are not satisfied with how we handle your request, you may lodge a complaint with the competent personal data protection authority in Indonesia.

This policy is governed by the law of the Republic of Indonesia. Read our Terms of Service.