Privacy Policy

Bearded Vault ("we", "us") runs an online trading card store serving collectors across Indonesia. This policy explains exactly what we collect when you browse, order, or write to us, who we hand it to, how long we keep it, and what you can ask us to do with it. It is written against Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (the PDP Law).

1. What We Collect

• Checkout details: your first and last name, email address, street address and optional unit number, plus the city or regency, district (kecamatan), sub-district (kelurahan/desa), province and postal code you select. The sub-district is required because Indonesian courier tariffs are priced at that level. We do not ask for a phone number at checkout; if you give us one in a message, we use it only to reach you about that order.
• Order records: the items, quantities and prices in your order, the shipping service you chose, the totals in IDR, and the order status (pending, paid, shipped, delivered or cancelled).
• Payment data: payments run entirely inside Midtrans. Card numbers, virtual account credentials and e-wallet logins are entered on Midtrans' own screens and never reach our servers. All we store is the Midtrans transaction reference, its checkout token, and the resulting status.
• Messages: the name, email, subject, optional order ID and message body you send through our contact form, plus anything you email or send us on WhatsApp, including photos attached to a selling enquiry or a damage claim.
• Technical data: standard server logs generated by our host — IP address, timestamp, requested URL, browser user agent. Your IP address is also held briefly in memory to rate-limit the contact form against spam.

There are no customer accounts on this store. You do not create a password, and we never collect government ID numbers, dates of birth, or any of the sensitive categories defined in the PDP Law.

2. Cookies and Browser Storage

This is the complete list of what this site puts in your browser:

The cart, language, consent and admin entries are strictly necessary or set by your own choice, so they are never gated by the banner. Analytics is the only non-essential item, it is Google Analytics 4 running in consent mode with advertising signals permanently denied and IP anonymisation on, and we run no advertising pixels or retargeting tags of any kind.

You can change your mind at any time with the Cookie preferences link at the bottom of every page, which clears your stored choice and brings the banner back. You can also clear the localStorage entries from your browser's site settings — clearing the cart entry simply empties your cart.

3. How We Use It

We use your data to quote courier rates for your sub-district, take payment, pack and dispatch your parcel, print the waybill, send order and delivery updates, answer your messages, handle returns and insurance claims, detect fraudulent orders, and keep the bookkeeping Indonesian tax law requires. The lawful basis is performance of the contract you enter when you order, our legitimate interest in preventing fraud, and our legal obligations. We do not sell your data, we do not share it with data brokers, and we do not send marketing email unless you have asked us to.

4. Who Processes It

We share only what each partner needs to do its job:

• Midtrans (PT Midtrans, Indonesia) — payment processing. Receives your name, email and the order amount, and returns the payment status to us by webhook.
• RajaOngkir — courier rate lookup. Receives only the destination sub-district ID and the parcel weight. No name, address line, or email is sent.
• JNE and J&T Express — delivery. Receive the recipient name and full address printed on the waybill.
• Vercel — hosting for this website and Blob storage for our product photography. Processes request logs; product images contain no customer data.
• Neon — the managed PostgreSQL database that stores our product catalogue and your order records.
• Google Analytics — aggregate traffic statistics, and only if you accepted cookies. Receives an anonymised IP and page-view events. It never receives your name, address, email, or what you bought.
• Authorities — only where Indonesian law obliges us to disclose.

Our hosting and database providers operate servers outside Indonesia, so your order data may be stored and processed abroad under their contractual data-protection commitments. If you would rather not have your data leave Indonesia, do not place an order through this site — contact us and we will arrange it another way.

5. How Long We Keep It

• Order records: ten years, the bookkeeping period Indonesian tax law expects. After a return window closes we can strip the delivery address on request and keep only the accounting figures.
• Unpaid, expired orders: deleted after 90 days.
• Contact messages: 12 months after the conversation ends.
• Server logs: kept by our host on a short rolling window. The contact-form rate limit holds your IP in memory for 10 minutes and never writes it to the database.

6. Security

All traffic to this site is encrypted with HTTPS. The order database is reachable only over an encrypted connection with credentials held in server-side environment variables. The admin area sits behind an HttpOnly, SameSite session cookie, and staff passwords are stored only as salted hashes — never in plain text. Midtrans webhooks are verified by signature before we mark an order paid. No system is perfect, so keep your order confirmation email private: it contains the order ID used for tracking.

7. Your Rights

Under the PDP Law you can ask us to show you the personal data we hold about you, correct anything inaccurate, delete it once no active order or legal obligation still needs it, restrict how we use it, receive a copy in a portable format, or withdraw a consent you previously gave. You can also object to a particular use and complain to the supervisory authority.

Send any request through our contact form or by email to hello@beardedvault.com. We reply within 14 days. To protect you we may ask you to confirm an order ID or reply from the email address used at checkout before we release or erase anything.

8. Children

This store is intended for buyers aged 17 and over. We do not knowingly collect data from children; if you are under 17, ask a parent or guardian to place the order. If you believe a child has given us personal data, tell us and we will delete it.

9. Changes and Contact

We update this policy whenever the store's data handling changes, and the date at the top always shows the current version. Material changes are noted on this page for 30 days. Privacy questions go to hello@beardedvault.com.