Privacy Policy
This document is a draft and has not been reviewed by legal counsel. Do not treat it as final before that review is complete.
1. Introduction
This policy explains what data we collect when you use the Tatsupay service, what it is used for, and what rights you have over it.
It applies to the tatsupay.com site, the merchant dashboard, the account centre, and the API we provide.
2. Data We Collect
We collect only what is needed to operate the service and meet our legal obligations.
- Account data: name, email address, and a password stored as a hash rather than plain text.
- Business data: business name, display name, contact email and phone, and website address if you provide one.
- Verification data: identity documents and bank account details, for due diligence and payouts.
- Transaction data: amount, payment method, order reference, timestamps, and the status of each transaction.
- Security data: IP address, browser and device type, and sign-in times, recorded as security activity history.
- Technical data: API request logs needed to investigate faults and abuse.
3. Data We Do Not Collect
We do not collect your buyers' payment card details. QRIS payments are processed through the buyer's own payment app, and those payment credentials never pass through our systems.
The public tatsupay.com site loads no third-party tracking scripts and sets no advertising cookies.
4. How We Use Data
- Operating the service: creating transactions, updating status, recording balances, and processing payouts.
- Securing accounts: two-step verification, detecting unusual activity, and providing a security history you can review.
- Meeting legal obligations: customer due diligence, anti-money-laundering measures, and responding to lawful requests from competent authorities.
- Providing support: answering questions and investigating issues you report.
- Improving the service: understanding technical failures so they do not recur.
5. Basis for Processing
We process your data to perform our service agreement with you, to meet applicable legal obligations, and for our legitimate interest in keeping the service secure.
6. Sharing of Data
We do not sell your data. Data is shared only in the following circumstances:
- With infrastructure providers we use to operate the service, limited to what is necessary and subject to confidentiality obligations.
- With payment partners and banks, limited to what is necessary to process transactions and payouts.
- With competent authorities, where required by regulation or in response to a lawful request supported by legal basis.
7. Retention
Transaction and account data are retained while your account is active, and after closure for the period required by financial and tax regulation.
Security activity logs are retained for a reasonable period to support incident investigation, then deleted.
8. Security
- Passwords are stored as hashes and cannot be read back, including by us.
- All traffic between your browser and our service runs over HTTPS.
- API keys are shown once at creation and stored as hashes, so they cannot be displayed again.
- Two-step verification is available and enforced during sign-in.
- Internal access to data is restricted on a need-to-know basis.
9. Your Rights
You have rights over your personal data, including:
- Requesting access to the personal data we hold about you.
- Requesting correction of inaccurate data.
- Requesting deletion of data, to the extent this does not conflict with regulatory retention obligations.
- Withdrawing consent where processing is based on consent.
- Raising a complaint about how we process your data.
10. Cookies
We use cookies that are necessary to operate the service, principally to keep your sign-in session active and to protect against cross-site request forgery.
We do not use cookies for advertising or cross-site tracking.
11. Minors
This service is intended for businesses and is not directed at individuals under 18 years of age. We do not knowingly collect data from children.
12. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes by email or through a notice in the dashboard.
13. Contacting Us
Questions about this policy, or requests relating to your data rights, can be sent to the email address shown on this page.