Privacy Policy

Account and business information you provide: name, email address, phone number, and business details.

Payout information: bank name, account holder name, and account number, needed to send you your earnings.

Order and payment records generated when your customers buy from your store, including the Buyer’s name, email address, phone number, and — for physical goods — the delivery address they enter at checkout.

Domain registration details, where you buy a domain through us, including the registrant contact information the registry requires.

WhatsApp messages, if a Seller connects a WhatsApp Business number to illoow: the messages Buyers send to that number and the replies sent from it, the Buyer’s WhatsApp number and profile name, and delivery status. We receive these from Meta’s WhatsApp Business Platform on the Seller’s behalf.

Product photos, catalog text, and business details you submit to the AI store generator ("Kirim foto, toko jadi"), together with the store page, product drafts, and usage records (such as token counts and estimated cost) it produces.

Usage and device data: log data and analytics events used to operate, secure, and improve the service.

Cookies and similar technologies: on illoow.com and on our account pages (sign-up, log-in, and the dashboard) we use cookies, pixels, and similar identifiers — including Google Analytics, Google Ads, the Meta Pixel, and Microsoft Clarity — to measure visits, sign-ups, and purchases, and to understand which of our campaigns bring people to illoow. Microsoft Clarity also records how these pages are used — clicks, scrolls, and cursor movement — so we can see where people get stuck; what you type into form fields is masked, so Clarity does not record it. These run from your first page view; our cookie notice tells you about them, and dismissing it does not turn them on or off. We also store the campaign tags (such as utm_source) from the link you arrived on with your account, so we know which campaign you signed up from. Sellers’ public stores do not load illoow’s own measurement tags.

To perform our contract with you: providing and maintaining the service, processing subscriptions, calculating and paying out your earnings, and providing support.

To meet legal obligations: keeping accounting and tax records, and responding to lawful requests from authorities.

For our legitimate interests, balanced against your rights: preventing fraud and abuse, securing the platform, and improving the product.

For our legitimate interest in measuring and improving our own marketing: counting visits, sign-ups, and purchases, and attributing them to the campaign that brought them. You can opt out at any time by blocking or deleting cookies in your browser, or by using an ad or tracker blocker; Google and Meta also offer controls in your account settings with them.

We do not sell your personal data, and we do not use it to train third-party AI models.

When a Buyer purchases from a Seller’s store, we process the Buyer’s details in order to complete the order, send the receipt, and enable delivery. The Seller sees these details in their dashboard so they can fulfil the order.

Sellers must use Buyer data only to fulfil and support that order and as their own privacy notice permits, and must not repurpose it for unrelated marketing without the Buyer’s consent.

If a Seller uses the AI store generator, we send the photos, catalog text, business type, and business name they submit to our AI provider to draft the store page and products. Sellers should not include Buyers’ personal data, or photos of people who have not agreed to it, in what they submit.

If a Seller turns on the WhatsApp assistant, we use the Buyer’s message together with the Seller’s own store information (products, prices, stock and orders) to prepare a reply sent from the Seller’s number. We use these messages only to answer that Seller’s Buyers, not for advertising.

Payment processing: Duitku (PT Kharisma Catur Mandala) collects Buyer payments and payments for our subscriptions and domains. Payments made before 23 September 2026 were collected by our previous processors, most recently DOKU (PT Nusa Satu Inti Artha). Payouts to Sellers are made by bank transfer from our own account and involve no additional processor.

Infrastructure and delivery: Supabase (database and authentication, hosted in Singapore), Vercel (application hosting), Resend (transactional email), and Cloudinary (media storage).

Analytics and advertising measurement: Google (Google Analytics and Google Ads), Meta Platforms (Meta Pixel), Microsoft (Clarity), and Vercel (Web Analytics) receive page visits, device and browser information, and conversion events (such as a completed sign-up or purchase) from our site and account pages. Microsoft also receives Clarity’s recordings of how those pages are used, with form inputs masked. They may set or read their own cookies and process this data under their own privacy policies.

Domain registration: IDCloudHost as registrar, and the relevant registry (for .id domains, PANDI), where you purchase a domain through us. Registry rules may require some registrant details to be recorded publicly.

WhatsApp messaging: Meta Platforms (WhatsApp Business Platform) carries messages between Buyers and a Seller’s connected WhatsApp number, processes them under its own terms, and bills the Seller directly for message fees.

Shipping rates and payout account checks: api.co.id receives the origin and destination area codes and the parcel weight to quote courier rates, and, when you register a payout account, the bank code, account number, and account holder name so the bank can confirm the account is yours.

AI processing: when a Seller uses the AI store generator ("Kirim foto, toko jadi") to build or revise their store, the business name and type, the product photos and WhatsApp catalog text they submit, and the names, descriptions, prices, and photo links of their existing products are sent to our current AI provider, Moonshot AI (Kimi), to read the products and draft the store page. Photos are sent to Moonshot AI as image data, not as public links. When a Seller uses the in-app support chat, their messages in that conversation are sent to Moonshot AI (Kimi) to prepare the answer. Moonshot AI processes this data outside Indonesia under its own terms. The store generator and the support chat may instead use another AI processor — an OpenAI-compatible provider such as OpenAI or the api.co.id AI Gateway, Anthropic, or Groq — which receives the same information for the same purpose, on the same terms as described here. When the WhatsApp assistant is on, the Buyer’s message and the Seller’s store information are sent to the api.co.id AI Gateway to prepare the reply.

These providers process data on our behalf and only as needed to deliver the service. Some are located outside Indonesia, so your data may be transferred abroad; where that happens we rely on the provider’s contractual data protection commitments.

We keep your account data for as long as your account is active.

After you close your account we delete your sites and anonymize your profile. We retain order, payment, and accounting records for 10 years from the end of the relevant financial year, as required of Indonesian companies for corporate document and tax purposes.

Log and analytics data is kept for a shorter period appropriate to its purpose and then deleted or aggregated.

Under the Personal Data Protection Law you may request access to your personal data, correction of inaccurate data, deletion, an end to processing, and a copy of your data in a usable format. You may also withdraw consent where processing rests on consent.

You can access and correct your account information in-app at any time, and close your account to have your profile anonymized, subject to the retention rules in section 5.

For any other request, contact support@illoow.com from your account email address. We will respond within the period required by law, and will tell you if we cannot act on a request and why.

We use reasonable technical and organizational measures to protect personal data, including encryption in transit, access controls, and separation of production credentials.

No method of transmission or storage is completely secure and we cannot guarantee absolute security.

If a personal data breach occurs that affects you, we will notify you and the relevant authority within the timeframe required by the Personal Data Protection Law.

The platform is intended for business use by adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy. Material changes will be notified in-app or by email, and the revision date at the top of this page will change.

Questions or data requests: support@illoow.com.

PT Lentera Emas Kehidupan, Lingkungan Delod Pempatan Lukluk, Desa Lukluk, Kecamatan Mengwi, Kabupaten Badung, Bali 80351, Indonesia.