This page explains what data we keep when you use Seller Profit OS, what it is used for, which third parties process it, and what rights you have. It is written in plain language on purpose.
1. Who we are
Seller Profit OS ("TOS", "we") is a web app for online sellers, operated by a sole proprietorship based in Indonesia. This policy covers the website sellerprofitos.com (home page and free audit) and the app at app.sellerprofitos.com. Data questions: [email protected].
2. What we collect
- Account. Your email address, one-time sign-in codes (stored as a hash, expiring within minutes), sign-in times, a rough device label (for example "iPhone · Safari") for the active-devices list, language and region (Indonesia or global).
- Business data you enter. Product names, prices, costs, fees, ad spend, shipping, returns, unit-cost recipes, restock plans, cashflow notes, questions to the AI assistant and Trend Check keywords. This data is yours. We store it only to show it back to you.
- Payments. We never see or store your card, bank or wallet details. Payments are processed by Lemon Squeezy (global) or Mayar (Indonesian Rupiah). From them we receive only the buyer email, the name if given, the plan purchased, the order number, the amount and the currency, so that access can be activated.
- Technical data. IP address, browser type, access times and pages visited, recorded automatically by Cloudflare (our hosting provider) and by us when you sign in, for security and abuse prevention.
- Cookies. A session cookie so you stay signed in (90 days at most), preference cookies (language, dark/light theme, referral code) and, on the home page only, Meta Pixel cookies (
_fbp,_fbc) used to measure Facebook and Instagram ads. The app itself does not load the pixel. - Support messages. The content of messages you send through the Help menu or by email, with the sender address.
3. What we use it for
- Running the service: signing you in, showing your data, doing the calculations.
- Activating access after a purchase by matching the buyer email.
- Sending emails that are actually needed: sign-in codes, access confirmation, at most two reminders before a trial ends, and replies to support requests. We do not send marketing email without your consent.
- Measuring ads. If you arrive from a Facebook or Instagram ad we send Meta events such as page view, pricing viewed, checkout started, trial started and purchase. Email addresses are sent as SHA-256 hashes, never as plain text. Card details are never sent.
- Security: limits on code attempts, a two-device limit, rejection of disposable email domains and daily AI quotas.
- Improving the product using aggregate numbers (for example how many people use a feature), not your individual product data.
4. AI assistant and Trend Check
- AI assistant. Your question plus a summary of the relevant product figures is processed by a model on Cloudflare Workers AI. Under Cloudflare's policy that data is not used to train models. Do not enter other people's personal data into the assistant.
- Trend Check. The keyword you type is sent to SerpApi to fetch Google Trends data. Only the keyword is sent, never your email or account data.
5. Third parties that process data
We do not sell your data to anyone. The parties below process data only as far as needed to run the service:
| Party | Role | Server location |
|---|---|---|
| Cloudflare | Hosting, database, Workers AI, network security | Global (Cloudflare network, including the United States) |
| Resend | Delivery of sign-in codes and account email | Tokyo, Japan |
| Lemon Squeezy | Global payment processing as merchant of record | United States |
| Mayar | Indonesian Rupiah payments (QRIS, e-wallets, bank transfer) | Indonesia |
| Meta Platforms | Facebook/Instagram ad measurement (pixel on the home page and Conversions API) | United States |
| SerpApi | Google Trends data for Trend Check (keyword only) | United States |
| Google Fonts | Web fonts. Google receives your IP address when fonts load | Global |
6. How long we keep it
- Account and business data: for as long as your account exists.
- Sign-in codes: deleted once used or expired. Sessions: 90 days at most.
- Technical, sign-in and payment-webhook logs: 12 months at most.
- After you delete your account, data is erased within 30 days, except transaction records we are required to keep for bookkeeping and tax purposes under Indonesian law.
7. Your rights
Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and, where they apply, the GDPR and UK GDPR, you can:
- Request a copy of the data we hold about you.
- Correct inaccurate data. Business data can be edited in the app at any time.
- Delete your account and its data. Email [email protected] from your account address; we process it within 14 days.
- Opt out of ad measurement using your Facebook ad settings or a cookie blocker. The service keeps working normally.
- Withdraw consent you have given, and complain to your data protection authority if you believe your rights were violated.
8. Security
Every page uses HTTPS. Sign-in is passwordless, using one-time codes sent to your email. Codes and sessions are stored as hashes. Database access is limited to the operator. No system is completely secure. If an incident affects your data, we notify you by email within 72 hours of becoming aware of it.
9. Not for children
The service is intended for business users aged 18 or over. We do not knowingly collect data from children.
10. Changes to this policy
The current version and its effective date are always on this page. Material changes are announced by email or in the app before they take effect.
11. Contact
Questions, data requests or complaints: [email protected]. We reply within 3 business days.