Privacy Policy

Effective date: 11 August 2026

This Privacy Policy explains what data the Omzeta app and service collect, what the data is used for, who it is shared with, and what rights you have over it.

Omzeta is a point-of-sale (POS) app for repair shops and service businesses. It is intended for business use, not for general consumers.

1. Who Controls the Data

The controller of account and subscription data is the operator of the Omzeta service. Contact: omzetaapps@gmail.com.

For the business data you enter into the app yourself (customers, vendors, employees, and transactions), your organization is the data controller and Omzeta acts as a processor — we process that data on your instructions. See section 12.

2. Data We Collect

a. User account data

Full name
Email address
Password — stored as a bcrypt hash, never as plain text
Email verification and password reset tokens with their expiry times
Role, permissions, and the organizations and branches you may access

b. Organization and branch data

Organization name, business type, organization email, logo
Branch data, member list, and member invitations (invitee email addresses)
Subscription status, invoice history, and feature usage quota

c. Business data you enter

Customers: name, phone number, address
Vendors/suppliers: name, contact, address
Employees: salary schemes, payroll periods, and salary components
Transactions: orders/services, purchases, debts and receivables, payments, cash flow
Inventory: products, services, prices, discounts, stock, and stock adjustments

d. Photos and images

Product and stock photos
Organization logo
Purchase proof photos
Receipt photos captured with the receipt scan feature

Images are uploaded to Omzeta servers and served via file URLs. We do not extract location (GPS) metadata from images and we do not perform face recognition.

e. Technical and log data

Every request to the server is logged with: timestamp, request ID, correlation ID, HTTP method and path, status code, processing time, app name, app version, build version, and IP address. Logs are used for security and troubleshooting.

f. What we do NOT collect

No advertising and no third-party ad networks
No behavioral analytics SDKs and no cross-app trackers
No GPS location, contacts, SMS, call logs, or installed-app lists
No credit/debit card numbers stored in our systems
We do not sell your data to anyone

3. Device Permissions Requested

Permission	Used for
Camera	Scanning QR codes, photographing receipts for the receipt scan feature, and taking product, stock, or purchase proof photos.
Photos / device media	Selecting existing images from your gallery to use as product, stock, logo, or purchase proof photos.
Internet	Connecting the app to Omzeta servers.

The app only reads images you select yourself. It does not scan your gallery, does not upload images automatically, and does not activate the camera in the background.

4. How We Use the Data

Creating and managing accounts, authentication, and role-based access control
Running core app functions: transactions, inventory, debts, payroll, cash flow, and reports
Sending transactional email: email verification, password reset, and member invitations
Billing and managing subscriptions
Detecting abuse, keeping the system secure, and troubleshooting
Meeting legal obligations

Legal bases: performance of the service agreement, your consent at registration, legitimate interest in service security, and legal obligations.

5. AI Receipt Scanning

Important: when you use the receipt scan feature, the receipt image you capture is sent to Google (Gemini API) to be read and converted into structured data. This feature is optional — you can enter transactions manually without using receipt scan.

What we store from this process: the parsed result (items, quantities, prices), success/failure status, token usage counts, and error messages. Receipt images are sent to Google only for that processing run; Google's handling of the data is governed by Google's terms of service and privacy policy.

Do not photograph documents containing sensitive personal data (such as national ID cards, family records, or health data) with this feature.

6. Third Parties That Process Data

Party	Role	Data processed
Google (Gemini API)	AI-based receipt parsing	Receipt images you scan
Midtrans	Subscription payment processor	Name, email, amount, and invoice details. Payment happens on Midtrans' page; card data never passes through our servers.
Resend	Transactional email delivery	Recipient email address and email content
Aiven	Managed PostgreSQL database hosting	All application data (encrypted in transit)
Fly.io	Application server hosting	Request traffic and uploaded files

We share data only as far as needed to run the service, or where required by law or a lawful request from authorities.

7. Data Transfers Outside Indonesia

Application servers run in the Singapore region, and some of the third-party providers above process data outside Indonesia. By using Omzeta, you understand that data is processed across borders under the contractual and technical safeguards of each provider.

8. Storage and Retention

Account and business data are retained while the account/organization remains active
Deletion uses soft delete: data is marked deleted and is no longer reachable through the app
After an account deletion request is processed, data marked deleted is permanently destroyed within 30 days
Billing and payment records are kept longer where tax or accounting rules require it
Technical logs are kept for at most 90 days

9. Security

All traffic uses HTTPS/TLS
Passwords are hashed with bcrypt and cannot be reversed
Database access uses an encrypted (SSL) connection
Feature and data access is restricted by role, permission, organization, and branch
Session tokens are stored in app storage on your device — lock your device and log out of devices you no longer use

No system is entirely free of risk. If you find a security vulnerability, report it to omzetaapps@gmail.com.

10. Your Rights

Under Indonesian Law No. 27 of 2022 on Personal Data Protection, you have the right to:

Know what data we process and for what purpose
Access and obtain a copy of your personal data
Correct inaccurate data — available directly via Edit Profile in the app
Delete your data and end processing — see section 11
Withdraw consent for consent-based processing
Object to certain processing
Lodge a complaint with the competent authority

Send requests to omzetaapps@gmail.com; we respond within 30 days at the latest.

11. Deleting Your Account

You can request account deletion at any time. Full instructions, what data is removed, and the timeline are at https://api.omzeta.com/delete-account. The Profile → Delete Account menu in the app opens that same page.

12. Customer and Employee Data You Enter

When you enter customer, vendor, or employee data into Omzeta, you act as the data controller for those people. You are responsible for:

Having a lawful basis (such as consent) to collect and store their data
Informing them that their data is stored in your POS system
Responding to their access, correction, or deletion requests

Omzeta processes that data solely to provide the service to you, and does not use it for any other purpose.

13. Children

Omzeta is intended for adult business operators. The service is not directed at children under 18 and we do not knowingly collect children's data.

14. Changes to This Policy

This policy may be updated. The current version is always available at https://api.omzeta.com/privacy-policy with the effective date at the top of the page. For significant changes, we notify you by email or an in-app notice.

15. Contact

Questions, personal data rights requests, or privacy complaints: omzetaapps@gmail.com.