Privacy Policy

Last updated: August 8, 2026

Toko Kartu (operated by PT Arnero Kreasi Multi Jaya) respects your privacy. This policy explains what data we collect when you use our website, including when you sign up or sign in with Google or Facebook, how that data is used, and your rights over it.

Data We Collect

Account Data

Name, email address, phone number, password (stored encrypted/hashed, never in plain text), profile photo, and shipping address (country, province, city, sub-district, village, postal code).

Data from Google / Facebook Login

If you sign up or sign in using Google or Facebook, we receive your name, email address, and profile photo from that account, based on the permission you grant during sign-in. For Facebook accounts, we also store the connected Facebook account's display name so you can see which account is linked to your profile. We do not post anything on your behalf, and we do not access your friends list or contacts.

Transaction Data

Order history, purchased items, shipping/pickup address, courier method, and payment status. Payments are processed directly by Midtrans or PayPal — we do not store your credit/debit card number on our servers.

Automatic Data (Cookies & Analytics)

We use Google Tag Manager and Facebook Pixel to understand website usage and measure the effectiveness of our promotions. These tools may record the pages you visit and general interactions on the website, but do not access your private account data.

How We Use Your Data

  • To create and manage your account, including sign-in via Google/Facebook.
  • To process orders, shipping, and payments.
  • To send verification codes (OTP), order notifications, and other transactional emails.
  • To provide customer support and respond to your inquiries.
  • To improve the website and measure promotion/advertising performance.

Who We Share Data With

We do not sell your personal data. Data is only shared with third parties that help us operate, and only to the extent necessary:

  • Midtrans and PayPal — to process payments.
  • Courier services (e.g. POS, DHL, FedEx, and other shipping partners) — name, address, and phone number for delivery purposes.
  • Google and Facebook — only for authentication/sign-in, subject to each platform's own privacy policy.
  • Cloud storage providers (image hosting) and our email provider (sending OTP/notifications).

Data Security

Your password is stored as a bcrypt hash and is never stored in plain text. All communication between your browser and our servers is encrypted via HTTPS.

Your Rights

  • View and update your account data anytime via the Profile page.
  • Request a copy of your data or account deletion by contacting us at the email below.
  • Revoke Google/Facebook sign-in access anytime by removing this app's access from your Google/Facebook account settings.

Changes to This Policy

We may update this policy from time to time. Significant changes will be announced on this website.

Contact Us

If you have questions about this privacy policy, please contact us at halo@toko-kartu.com.