This page is still a draft and has not been through legal review. It is written to match the service that actually runs today, and several clauses a document like this usually carries are left as [KONFIRMASI] markers rather than drafted here. Questions? halo@jeejak.id.

This page covers one thing: your buyers' personal data as it enters Jeejak while you use the service. Your own account data is covered by the Privacy Policy, and the rules for using the service are in the Terms & Conditions.

One question about this page's own standing is still open. [KONFIRMASI: apakah halaman ini berlaku otomatis sebagai lampiran Syarat & Ketentuan begitu kamu memakai paket berbayar, atau perlu dokumen terpisah untuk organisasi yang memintanya.]

1. When this page applies to you

How you use it	Applies?
Free, no account	No. Nothing reaches us, so there is nothing we process for you.
Free, with an account	No. All we receive is your account identity and usage counts. No buyer data is sent.
Pro Lite / Pro / Pro Team / Enterprise	Yes. Order data syncs, including recipient names, phone numbers and delivery addresses.

So this is not only a page for the team plans: it applies from the first paid plan on, because cloud sync is in every paid plan and a marketplace store can be connected from Pro Lite up.

2. Who controls and who processes

Your buyers' data is personal data belonging to those buyers, not to you and not to us. You act as the controller of that data and you are responsible for your obligations to your buyers. We process it for you, on your instructions, and not for purposes of our own.

For your own account data, meaning your name, email, WhatsApp number, device data and subscription data, the positions are reversed: there we are the data controller. That is explained in section 1 of the Privacy Policy.

3. What we process for you

Purpose	Running Jeejak for you: syncing between your devices, showing your records in the console, building the dispute evidence PDF, and counting your plan's quota.
Categories of data	Evidence records (the resi number (the shipping waybill), courier, status, time, note, session, and the number of koli (the boxes in one shipment)), order data (order number, marketplace, recipient name, phone number, address, product summary, total value), and the evidence photo and video files.
Data subjects	Your buyers, and the people you invite into your organisation on a team plan.
Duration	For as long as your account is active. After an account deletion, 30 days and then gone. See section 10.

We do not sell your data, we do not use it for advertising, and there is no third-party tracker inside the app.

4. Your instructions, and one exception

Your instructions are your use of the service: what you record, sync, export and delete. Beyond that we do not process your buyers' data for any other purpose.

One thing runs only if your organisation asks us for it: the evidence quality check sends up to four packing photos per parcel to Google Cloud, processed outside Indonesia. It is off unless you ask for it, and if the resi label is visible in a photo, the buyer data printed on that label goes with the image. The details, including what is not sent and what we keep, are in section 1.6 of the Privacy Policy.

It is not the only data that leaves our server. The second route is in section 5, and the second one is not your choice.

One clause in this section is still empty. [KONFIRMASI: klausul tentang instruksi yang menurut kami melanggar hukum, dan apa yang kami lakukan dalam keadaan itu. Ditulis penasihat hukum.]

5. Sub-processors

The parties your data reaches are listed in one place, section 4 of the Privacy Policy, and that list is deliberately not copied onto this page: two lists on two pages will differ sooner or later, and one of them becomes the list nobody updates. It does not yet carry the destination of the nightly backup below, so do not read it as a list that is already complete.

Two notes to read alongside that list. First, the payment providers receive your data as the buyer of a Jeejak plan, not your buyers' data. Second, two routes carry your buyers' data off our server, and the two are not equivalent:

The evidence quality check

To Google Cloud, as our sub-processor, processed outside Indonesia. Only if your organisation asks for it, and only packing photos. See section 4.

The nightly backup

To Cloudflare R2, object storage off our own server, as our sub-processor. This is not your choice and it applies on every paid plan. It has one role, holding the nightly copy: the whole database plus all the photo and video files, so your buyers' names, phone numbers and addresses are in it. Which region those copies sit in is not pinned down in any document of ours, and that question is in section 10 rather than here. Section 6 says what protects those copies. That section sets out which steps are ours to take, not a limit on our responsibility for R2 as our sub-processor.

Before we add or replace a sub-processor, we tell your account contact by email 30 days ahead. If you object, you may end your subscription, and we pay back the part of the period you have not used. That is a ground of its own, outside what the Refund Policy sets out, and we work the amount out by hand, because our system does not calculate it.

One thing about that list is still undecided. [KONFIRMASI: apakah Cloudflare R2 ditambahkan dengan namanya ke daftar sub-pemroses di bagian 4 Kebijakan Privasi, supaya daftar itu memuat jalur ini juga. Nama dan perannya sudah disebut di halaman ini, dan yurisdiksinya ada di bagian 10.]

6. Security

What we do today:

Traffic to our servers uses HTTPS.
Every piece of business data on the server is bound to your organisation and cannot be read across organisations.
Data on the device sits in the app's private area, protected by the operating system sandbox.
Session tokens live in the operating system's secure storage, not in an ordinary preferences file.
Android's automatic backup is turned off, so evidence and account material are not copied into your Google account backup.

What we do not claim. Synced photos and videos sit in our object storage with no additional cipher layer whose key you hold yourself. An exported PDF carries no cryptographic mark either. This paragraph says the same as section 6 of the Privacy Policy and that is not a coincidence: if we ever add either one, both pages change together.

And about the nightly copies in section 5. The paragraph above is about our object storage and not about those copies, so the copies are stated on their own here, in two halves that are not equally certain. The photo and video files get no protection from us. They are copied there as they are, with no encryption step on our side, in every configuration of the script. That half is settled and is not an open question. What the destination does with a file once it arrives belongs to the destination and is not a step of ours, and this page does not describe it. The database copy is the half that is not settled. Our backup script has an encryption step for that copy and the step is optional, so the control exists. The configuration we keep in the repository does not fill that setting in, so as it stands the script sends the database copy with no encryption step of ours. What is not confirmed is only whether the setting on the production host was ever edited by hand, so we do not claim the step is on. Changing the script is the owner's decision, and the question is in section 10.

7. Who on our side can look

Internal access is limited to the people on our team who need it to run the service and to help you. An action that changes data through our internal console produces its own record of who did what and when.

That internal console belongs to our team and is not a feature of your account. Your account has no such history view yet, and we are not promising one here.

8. If there is an incident

If a security incident happens that requires notification, we notify the organisations affected. The notice says what happened, which data was affected, what we have already done, and what comes next.

The number is not settled. [KONFIRMASI: tenggat pemberitahuan insiden, ditulis pemilik dan ditinjau penasihat hukum. Angka 72 jam di bundle desain tidak dipakai karena tidak ada keputusan di baliknya.]

9. If one of your buyers asks for their data

Your buyers deal with you, not with us, so you answer their requests and we help you do it.

What you can do yourself today:

see and change evidence records and order data, in the app and in the console;
delete a record you no longer need;
export the evidence PDF for a parcel, at any time.

What does not exist yet: taking one account's whole data set out in a single file. If you need that to answer a request, write to halo@jeejak.id and we will do it by hand.

10. Deleting data

One record at a time: you delete it yourself, from the app or the console.
The whole account: through Akun → Hapus akun & semua data. The account is deactivated on every device immediately, then permanently deleted 30 days later, photo and video files in our object storage included. The details are in section 7 of the Privacy Policy.
Ending a subscription is not a deletion. Data that has already synced stays; what stops is new syncing. See section 8 of the Refund Policy.

The nightly backup in section 5 leaves four questions unanswered on every page of this site. [KONFIRMASI: berapa lama salinan cadangan disimpan, kapan penghapusan akun ikut berlaku di sana, di wilayah mana salinan itu berada, dan apakah skrip cadangan kami diubah supaya salinan foto dan videonya ikut terlindungi, sebagaimana bagian 6 menyebutnya. Kebijakan Privasi belum menjawab satu pun, jadi jangan dibaca sebagai jawaban.]

11. Audits and documentation

We hold no third-party security certification, and we claim none. What we can do today is answer your questions about how we process data, at halo@jeejak.id, as far as the answer does not expose another customer's security.

This part is still the owner's decision. [KONFIRMASI: hak audit pelanggan, pengujian keamanan oleh pelanggan, dan laporan yang akan kami sediakan untuk pelanggan Enterprise.]

12. How this sits with the other documents

Read this page together with the Terms & Conditions and the Privacy Policy. If this page and the Privacy Policy differ, which of the two governs depends on the data in question. For the processing of your buyers' personal data, this page governs. For other data, your own account data included, the Privacy Policy governs. The basis for that is not which page carries more detail: this page is a document you agree to as the data controller, while a privacy policy is a one-sided statement we can change without your consent.

13. Contact

Email: halo@jeejak.id
Processor: CV. Adisatya IT Consultant in Kediri, Indonesia, aitc.co.id