Privacy policy

Last updated · 08.10.2026 · draft, pending legal review

This policy explains what personal data FRAG (fragstore.id, a 40H Studio brand) collects, why we use it, who helps us process it and the choices you have. It follows Indonesia’s Personal Data Protection Law (UU No. 27/2022, “UU PDP”).

1. What we collect

• —Order details — name, email, phone and delivery address you enter at checkout.
• —Payment — handled by Xendit, our payment provider. We never see or store your card number; we keep the method, amount and Xendit’s payment reference with your order.
• —Account — the email you use for the email-code sign-in on fragstore.id, and the addresses you save.
• —Advisor requests — what you send through “Contact an advisor”: name, email, perfumes you wear, budget and message.
• —Newsletter and back-in-stock alerts — your email, and when and where you signed up.
• —Usage data — pages viewed, device and approximate location. Collected only if you allow Analytics or Marketing cookies.

2. Why we use it

• Deliver and support your order

  Basis: Contract

  Data: Order details

• Answer advisor requests, send alerts you asked for

  Basis: Your request

  Data: Email, message

• Newsletter

  Basis: Consent — unsubscribe any time

  Data: Email

• Understand how the shop is used

  Basis: Consent — Analytics

  Data: Usage data

• Measure our ads, show FRAG ads elsewhere

  Basis: Consent — Marketing

  Data: Usage data, hashed email at purchase

• Tax and legal duties

  Basis: Legal obligation

  Data: Order records

3. Analytics and advertising

We use the services below to measure visits and our advertising. None of them loads before you choose in “Cookies”, and you can change your choice at any time from the link at the bottom of every page.

• Google Analytics 4

  Provider: Google

  What it does: Counts visits, pages and purchases (aggregated reports)

  Needs: Analytics

• Cloudflare Web Analytics

  Provider: Cloudflare

  What it does: Cookieless page counts

  Needs: Analytics

• Meta Pixel + Conversions API

  Provider: Meta

  What it does: Measures ads on Facebook and Instagram; builds ad audiences

  Needs: Marketing

• TikTok Pixel + Events API

  Provider: TikTok

  What it does: Measures ads on TikTok; builds ad audiences

  Needs: Marketing

When you buy after allowing Marketing, a hashed (unreadable) version of your email and the order value may be sent to Meta and TikTok so they can tell us which ads worked. Cookie names and durations are listed in our Cookie policy.

4. Email

We send all our email through Resend: order and payment messages, sign-in codes, advisor replies, back-in-stock alerts and the newsletter. Your subscription and preferences are kept in our own database — we don’t use a separate marketing platform. Newsletter emails may count opens and clicks so we can see what is useful; every newsletter has a one-click unsubscribe, and you can pick topics at fragstore.id/email/preferences.

5. Who we share it with

• —Xendit — processes your payment (virtual account, QRIS, e-wallet, card). Card details go straight to Xendit.
• —Couriers (e.g. JNE, SiCepat) — name, phone and address to deliver your order.
• —Cloudflare — hosting and security of fragstore.id.
• —Supabase — hosts the FRAG database: products, orders, accounts and requests.
• —Resend — sends our email (orders, sign-in codes, newsletter).
• —Google, Meta, TikTok — analytics and advertising, only with your consent.

We don’t sell your personal data. Some providers store data outside Indonesia (for example in Singapore or the United States); we only use providers bound by contract to protect it, as UU PDP requires.

6. How long we keep it

• —Orders and invoices — 10 years, as Indonesian tax law requires.
• —Advisor requests — 2 years after the last message.
• —Back-in-stock alerts — until the email is sent, or 6 months.
• —Newsletter — until you unsubscribe.
• —Analytics — 14 months in Google Analytics.

7. Your rights

You can ask to see, correct or delete your data, withdraw consent, object to processing or receive a copy. Email care@fragstore.id; we reply within 3 × 24 hours as UU PDP requires. Withdrawing consent doesn’t affect what happened before.

8. Contact and changes

FRAG, a 40H Studio brand · Jakarta, Indonesia · care@fragstore.id. We post changes here with a new date; for important changes we also tell newsletter subscribers.