Privacy Policy & Data Protection

1. Introduction & Governance

PT Boontrack Inovasi Digital ("We", "Us", "Company") operates the BoonTrack enterprise commerce platform ("Service"). This Privacy Policy outlines our transparent governance for personal data collection, processing, and protection across our official Meta WhatsApp Business Cloud API integrations, sub-second storefronts, and server-side marketing attribution pipelines in compliance with Indonesian Personal Data Protection Law (UU PDP No. 27/2022) and global privacy benchmarks.

2. Information We Collect

• Merchant & Business Account Data: Legal business name, business email addresses, billing contacts, WhatsApp Business Account (WABA) IDs, and API authorization tokens.
• Conversation & Interaction Data: Inbound and outbound customer communications processed through official Meta Cloud API webhook endpoints for real-time order processing, inventory sync, and AI-assisted responses.
• Transactional & Fulfillment Metadata: Order identifiers, product line items, amounts, dynamic QRIS transaction IDs, delivery addresses, and courier tracking details.
• Technical Telemetry: Anonymized IP addresses, API endpoint access logs, webhook latency measurements, and browser technical specs.

3. Tracking, Cookies & Meta Conversions API (CAPI) Disclosure

BoonTrack utilizes consent-based measurement technologies to ensure commercial accuracy and prevent fraudulent orders:

• Essential & Functional Cookies: Session tokens, language selections, and cart state cookies necessary to maintain seamless sub-second checkout operations.
• Server-Side Meta Conversions API (CAPI): When enabled by the merchant, conversion events (such as Purchase, AddToCart, InitiateCheckout) are dispatched server-to-server directly to Meta Graph API endpoints. Customer identifiers are cryptographically hashed using one-way SHA-256 before transmission to protect consumer privacy.
• Strict Consent Basis: Marketing attribution and tracking scripts are only initialized in accordance with user consent preferences expressed via our cookie consent banner.

4. Security, Encryption & Storage Locations

Security is built into our core topology:

• In-Transit & At-Rest Encryption: All API communications are secured via HTTPS / TLS 1.3. Persistent database records and outbox event stores are protected using industry-standard AES-256 encryption.
• Multi-Tenant Logical Isolation: Data belonging to different merchants is partitioned using strict logical tenant boundaries, preventing unauthorized cross-tenant data access.
• Data Center Storage Locations: Primary operational databases and message queues are hosted in secure, certified cloud infrastructure facilities located in Indonesia and regional tier-4 data centers, satisfying Indonesian statutory data residency and sovereignty requirements.

5. Non-Custodian Fund Flow Architecture

BoonTrack is exclusively a software technology provider. BoonTrack does not operate as a bank, licensed payment gateway, or fund custodian. Payment processing, dynamic QRIS settlement, and customer refunds are executed directly by licensed acquiring banks, payment gateways (e.g. Xendit), and Authorized Merchant of Record & Payment Infrastructure Partners.

6. User Rights, Opt-Out & Data Deletion

In full accordance with statutory rights under UU PDP and international data protection laws:

• Access & Rectification: Users and merchants may access and rectify their account profiles at any time.
• Right to Permanent Erasure: Any consumer or merchant may request complete deletion of their personal records and message histories by visiting our dedicated Data Deletion Request Page or emailing support@boontrack.com.
• Marketing Opt-Out: End users may revoke WhatsApp messaging consent at any time as governed under our Anti-Spam & User Consent Policy.

7. Corporate Contact & Privacy Officer