Version: 2026-10-20-v4
Effective date: 20 October 2026
1. Who we are and who this covers
This Privacy Policy describes personal-data processing on the Jastip by TebetLabs website, application, personal shopper workspace, public catalogs, and support channels (the "Service"). The Service operator is TebetLabs, located at No.6 Blok Ac 6, Jl. Raya Pd. Ungu Permai, Kaliabang Tengah, Kec. Bekasi Utara, Kota Bekasi ("Operator," "we," or "us").
The Service is designed for personal shoppers. Customers do not need an account to view a public catalog. When a personal shopper enters customer data into their workspace, that personal shopper decides why the data is used. This Policy explains Operator's role for account and Service data and how Operator helps personal shoppers manage data they enter.
We process personal data under Indonesia's Law No. 27 of 2022 on Personal Data Protection and other applicable laws. This Policy does not replace notices a personal shopper is required to give customers.
2. Personal data we process
The data depends on how you use the Service and what a personal shopper enters.
- Account and security data: email address, protected authentication information, email-verification status, account-recovery records, login activity, account plan, preferred currency, and the version and time you accepted the Terms.
- Onboarding quiz answers: your jastip stage, monthly order-volume range, order channels, operating challenge, and selected goal. Answers are linked to your account so we can understand personal shopper needs and review trends in aggregate.
- Personal shopper profile and catalog: display name, username or catalog address, WhatsApp number, sourcing-trip details, item, variant, source, indicative price, photos, and publication settings. Information selected for publication can be viewed by anyone without logging in.
- Workspace data entered by a personal shopper: customer name, phone, email, location, notes, and consent status; inquiry and order records; items, variants, quantities, sources, communication channels, statuses, dates, prices and calculations; recorded receipts, allocations, methods, references and notes; stock and procurement data; procurement proof photos; and expenses and operating notes. Notes and photos may contain personal data if a user adds it.
- Premium purchase data: name and phone number provided at checkout, account email, payment amount and currency, merchant order ID, transaction reference, payment URL, status, and transaction time. Payment details such as card numbers, bank credentials, PINs, and one-time passwords are handled by Duitku and/or the payment channel selected. Jastip by TebetLabs does not request or store your PIN or one-time password.
- Support and report data: information you send through email or support/reporting channels, including your email address, message content, attachments, and information needed to follow up.
- Basic technical data: information needed to maintain a signed-in session and language preference, as well as connection information such as IP address, access time, and device information that may be processed to protect Service security and reliability.
Do not enter passwords, PINs, one-time passwords, full payment-card data, health or biometric data, children's data, or other sensitive personal data in notes, orders, photos, or messages unless it is truly necessary and you have a lawful basis to do so.
3. Purposes and legal bases
We use personal data to:
- create and manage accounts, verify email, authenticate sessions, and help restore passwords;
- provide the workspace and store data entered by a personal shopper under their instructions;
- publish catalogs, profiles, items, photos, and prices that a personal shopper chooses to share publicly;
- process Premium purchases, confirm payment status, and manage paid access;
- respond to questions, personal-data requests, complaints, and abuse reports;
- protect the Service, prevent abuse, limit automated requests, resolve disputes, and meet legal obligations;
- understand personal shopper workflows and needs, and improve onboarding and the Service by reviewing quiz trends in aggregate. Quiz answers are not used for personal promotional outreach; and
- operate, maintain, and improve the Service.
The legal basis depends on the purpose and context. It may be performance of a contract or steps before a contract to provide an account and requested features; compliance with a legal obligation; legitimate interests in securing and operating the Service after balancing your rights; or consent where required by law. A personal shopper selects information for publication in a catalog. For customer data entered into a workspace, the personal shopper is responsible for determining and recording the appropriate legal basis.
4. Personal shopper roles and public information
A personal shopper usually acts as controller of personal data about customers they record. Operator processes those records as a processor to the extent necessary to provide the workspace under the personal shopper's instructions. Operator acts as a separate controller for personal shopper account data, Service security, support, abuse reporting, and Premium billing. For customer data, the processing instructions in this relationship cover storing and managing records, making them available to the authorized personal shopper, Service backups and recovery, security, support, compliance with legal obligations, and deletion or return under a valid request and these Terms. The personal shopper determines what data is entered and how it is published.
When a personal shopper enables a catalog, public information may include the shopper's display name and WhatsApp number, selected sourcing-trip details, published item names, indicative prices, and published photos. A public catalog does not show customer names or contact details, private notes, order totals, origin prices, or the personal shopper's margins. Visitors can open a WhatsApp link to contact the personal shopper. After opening it, the communication takes place through WhatsApp and is subject to WhatsApp's terms and privacy policy.
Public information may be copied, saved, indexed by search engines, or captured by others. Closing a catalog stops its presentation through the Service once the change takes effect, but does not automatically remove copies made by other parties.
5. Recipients, service providers, and transfers
We may provide limited access or send data to the following parties as needed:
- Hosting, network, and storage providers to operate the Service and store data. Providers and processing locations may differ by Service environment.
- Email providers to send email verification, account recovery, and Service notices.
- Duitku and related payment channels to create Premium invoices, receive payment confirmation, and send transaction status. Duitku receives the checkout data listed in Section 2. The provider's terms and privacy policy also apply.
- Photo storage and delivery providers, if used, to store and display product and procurement photos. Photo links can be accessed by anyone who has the link; copies may also be temporarily stored by other service providers. Do not upload proof photos containing unnecessary personal data.
- Authorities or professional advisers where required by law, needed to protect rights and security, or to handle a dispute.
A catalog link may open WhatsApp at the visitor's choice. We do not receive the content of that conversation through the link unless you or the personal shopper send it to us through another channel.
Service providers may process data in Indonesia or other countries. If data is transferred outside Indonesia, Operator applies the transfer basis and safeguards required by law.
6. Cookies and preferences
The Service uses cookies needed to keep personal shoppers signed in and remember their language preference. These cookies support the Service's basic functions. We do not use cookies for advertising.
Service providers may use technical storage needed for their security and reliability.
7. Retention, security, and incidents
We keep account and workspace data while an account is active and the data is needed to provide the Service. Account-verification and recovery information is kept as long as needed to protect and manage the account.
Premium transaction data and consent records are kept as needed for transaction, accounting, tax, security, and dispute obligations. Support correspondence and reports are kept as long as needed to handle them and document follow-up. Security logs and photos are kept as long as needed for their collection purpose and security. Backups are used for recovery and deleted under the backup system's retention cycle. When a purpose ends, data is deleted or anonymized where possible, unless further retention is required by law or needed to establish, exercise, or defend legal claims.
The application does not yet provide self-service account deletion. To request account closure or data deletion, contact the support email in the Contact section. After verifying the requester's identity and authority, Operator acknowledges receipt within five business days and aims to complete the request within 30 calendar days. If a request takes longer or some data must be retained because of a legal obligation or dispute, Operator explains the reason and expected follow-up time. Personal shoppers should export any business records they still need before closing an account.
We use account-scoped access controls, authentication, credential protection, and technical and organizational safeguards appropriate to the Service. No electronic transmission or storage can be guaranteed completely secure. Operator handles incidents through the Service's responsible operator and uses the support email in the Contact section for coordination and notices. If Operator acts as controller and a personal-data protection failure occurs, Operator gives written notice to data subjects and the competent authority no later than 3 × 24 hours as required by Article 46 of Indonesia's PDP Law. If Operator acts as processor, Operator notifies the personal shopper acting as controller without undue delay so they can meet their obligations.
8. Your rights and how to make a request
Subject to applicable conditions and exceptions, you may request information about processing, access to or a copy of data, an update or correction, an end to processing or deletion, withdrawal of consent, and exercise of other rights provided by personal-data protection law.
Send a request to the email listed in the Contact section with the subject "Personal Data Request." Describe the right you want to exercise and the account or information involved. We may ask for reasonable additional information to verify your identity and protect security. We acknowledge receipt within five business days and handle requests within the time required by law. If customer data is in a personal shopper's workspace, contact that personal shopper first; Operator will assist according to its role and applicable instructions. You may also lodge a complaint with the competent authority under applicable law.
9. Children, changes, and contact
Personal shopper accounts are not intended for children. Do not register an account or enter children's personal data into the Service unless permitted by law and the required authority and safeguards are in place.
We may update this Privacy Policy when our practices or features change. We will notify you of material changes through the Service or another appropriate channel. The latest version and effective date will appear on this page.
For questions, personal-data requests, or complaints, contact:
- Operator: TebetLabs
- Address: No.6 Blok Ac 6, Jl. Raya Pd. Ungu Permai, Kaliabang Tengah, Kec. Bekasi Utara, Kota Bekasi
- Support/privacy email: [email protected]
- Effective date: 20 October 2026