Privacy Policy

Last updated: 24 September 2026

1. Who we are

OS Seller (“we”, “us”, “our”) provides the OS Seller app, the OS-Scraper browser extension and the website os-seller.com. For the personal data described in this policy we act as the data controller (pengendali data pribadi), except where section 6 says we act as a processor (prosesor data pribadi) for a seller. You can reach us at [email protected].

We process personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and its implementing regulations, and we apply the same standards — including the rights in section 12 — to users wherever they are.

2. What this policy covers

• The OS Seller app at seller.os-seller.com — a seller operations app for marketplace sellers (orders, products, stock, purchasing and money), connected to the seller’s shop through the Shopee Open Platform;
• The OS-Scraper browser extension — reads marketplace pages you visit and shows you the data on them;
• os-seller.com — our public website and its launch-news email list.

It does not cover websites and services of others, such as Shopee or Google, which have their own privacy policies.

3. Data we collect

3.1 Account data (Google sign-in)

You sign in to the OS Seller app with your Google account. From Google we receive only your name, email address, profile picture and Google account identifier, through the standard openid, email and profile scopes. We do not receive your Google password and we do not access your Gmail, Google Drive, contacts or any other Google data.

3.2 Shop and workspace data

The shops you connect or are invited to, the people who have access to each shop and their roles, your settings, and the records you create in the app — for example suppliers, purchase orders, stock adjustments, costs and notes.

3.3 Marketplace data (Shopee Open Platform)

When a shop owner connects a Shopee shop, we receive, through Shopee’s official API and within the permissions the owner grants, the shop’s data needed to run the app: shop profile, products and variants, prices, stock, orders and their status, shipping and tracking details, returns, and payment and settlement (escrow) figures. Orders include the buyer’s personal data that the shop already holds for fulfilment, such as the buyer’s username, and the recipient’s name, phone number and shipping address as Shopee provides them. We also store the access tokens Shopee issues so the app can keep the shop in sync.

3.4 OS-Scraper extension data

The extension reads product data — such as product names, prices, stock, sold counts, ratings, shop names and page URLs — on the marketplace and sourcing sites it supports, when you open those pages; on other sites only when you click its toolbar button there or add the site yourself. What it captures is stored on your device first. Server sync is off until you turn it on; when you turn it on, captures are sent to our central store at scrape.os-seller.com, where they serve as market information for you and other OS Seller users (or, if you enter one, to a server of your own instead). For each record our store keeps the captured data, when it was captured and when it arrived, an anonymous install identifier and the extension version, a keyed hash of your IP address (the IP address itself is not stored) and your browser’s User-Agent string. If you choose to link the extension to your OS Seller account, it presents your OS Seller session once to prove the link; the session cookie itself is not stored — only a hash of it, briefly, to verify. The extension loads parts of its functionality as signed code from scrape.os-seller.com when it runs, and it contains no analytics or telemetry. It does not read your browsing history, form entries or passwords, and it does not read other websites unless you activate it there as described above.

3.5 Launch-news email list

If you leave your email on os-seller.com, we store the address, the time you subscribed, which form you used, and the exact promise shown next to the form. We use it only to send you one message when OS Seller opens, and that message contains a link to unsubscribe. We do not store your IP address, browser or referrer with it.

3.6 Technical data

Our servers keep short-lived logs of requests (such as time, requested page, status and IP address) to operate and secure the service. Error reports from the app contain technical details of the fault and are kept free of passwords and tokens. The app uses a session cookie to keep you signed in, and our public website os-seller.com uses Google Tag Manager to measure how the site is used (see section 13).

4. How we use data

• to sign you in, keep your account secure and control who can access which shop;
• to provide the app’s functions: show orders, products, stock and money, keep them in sync with the marketplace, and carry out actions you ask for, such as updating stock;
• to show marketplace listing data collected by the extension;
• to send service messages (for example about security or changes to these terms) and, if you subscribed, the launch-news email;
• to maintain, debug and improve the service, and to prevent abuse and fraud;
• to measure visits to our public website os-seller.com through Google Tag Manager and Google Analytics (see section 13);
• to comply with legal obligations and enforce our Terms of Service.

We do not sell personal data, we do not show advertising, and we do not use your data or your buyers’ data to build advertising profiles.

5. Legal bases

Under the UU PDP (and, where applicable, comparable laws such as the EU GDPR) we rely on:

• performance of a contract — to provide the app and the extension you choose to use;
• consent — for the launch-news email list and for connecting a marketplace shop; you can withdraw consent at any time, without affecting processing done before;
• legitimate interests — to secure the service, prevent abuse and fix faults, balanced against your rights;
• legal obligation — where the law requires us to keep or disclose data.

6. Seller data and buyer data: our role

For your own account data we are the controller. For the personal data of your buyers that comes from your marketplace shop, you, the seller, are the controller and we are your processor: we process that data only to provide the app to you and on your instructions, keep it confidential, protect it with the measures in section 11, do not use it for our own purposes, and delete it as described in section 10. Buyers who want to exercise their rights should contact the seller they bought from; we will help the seller respond.

7. Google user data

We use Google sign-in only to identify you. The Google data we receive (name, email address, profile picture and account identifier) is used to create and secure your OS Seller account and to show you who is signed in. We do not use it for advertising, we do not sell it, and we do not transfer it to others except as needed to provide the service, for security, or to comply with law.

OS Seller’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Sharing and service providers

We share personal data only with the following, and only as needed:

If OS Seller is reorganised, merged or sold, data may transfer to the successor, which will remain bound by this policy; we will tell you in advance. Our service providers may process data only on our instructions and must protect it.

9. Where data is stored

Our servers and databases are hosted in the Akamai / Linode data centre in Jakarta, Indonesia. Some of our providers (such as Google and Cloudflare) process data in other countries. Where personal data is transferred outside Indonesia, we do so in line with the UU PDP, relying on providers that apply a level of protection equal to or higher than Indonesian law or on appropriate contractual safeguards.

10. Retention

• Account and shop data: kept while your account or the shop is active. When you close your account or disconnect a shop and ask for deletion, we delete or anonymise the related data within 30 days, unless we must keep it longer by law.
• Marketplace data, including buyer data: kept while the shop is connected, for as long as the seller needs it for their records, and deleted on the seller’s request or after disconnection as above.
• Extension capture data: data on your device is yours to clear at any time and is removed when you uninstall the extension. Data synced to our central store is kept as market information while the service operates, until you ask us to remove it; on request we remove the data your install sent and its link to your account (email [email protected]).
• Launch-news list: kept until you unsubscribe or ask us to delete it.
• Server logs: kept for a short period, normally no longer than 30 days.
• Backups: our databases are backed up daily and backups are kept on a rotating schedule — 14 daily, 8 weekly and 6 monthly copies — so deleted data can remain in an encrypted backup for up to about 6 months until that backup expires. Backups are used only to restore the service.

11. Security

We use measures appropriate to the risk, including encryption of data in transit (HTTPS/TLS), encrypted backups, access limited to the people who need it, separation of each shop’s data, secure session cookies, and monitoring for faults and abuse. No system is completely secure; if a personal data breach occurs that affects you, we will notify you and the relevant authority as required by the UU PDP (within 3 x 24 hours where required).

12. Your rights

Subject to the law, you have the right to:

• obtain information about how we process your personal data;
• access and obtain a copy of your personal data, including a copy of your shop data in a commonly used, machine-readable format (export);
• correct inaccurate or incomplete data;
• have your data deleted or destroyed (including closing your account);
• withdraw consent;
• object to, or ask us to restrict, certain processing, including automated decision-making that has legal or similarly significant effects (we do not make such decisions about you);
• complain to the personal data protection authority in Indonesia, or to the supervisory authority where you live.

To exercise a right, email [email protected] from the address linked to your account. We may need to verify your identity. We respond within the time required by law, and in any case within 30 days. You can also remove OS Seller’s access at any time in your Google account settings (Security → Third-party apps & services), disconnect your shop from the Shopee side, remove the OS-Scraper extension from your browser, and unsubscribe from the launch-news email through the link in it.

13. Cookies and similar technologies

The OS Seller app uses a strictly necessary session cookie to keep you signed in and to protect against cross-site request forgery; the app itself uses no advertising or third-party analytics cookies. The OS-Scraper extension keeps a random device identifier in your browser’s extension storage. Our public website os-seller.com uses Google Tag Manager, which may set Google analytics cookies (such as _ga) to count visits and understand how the site is used; we use this measurement in aggregate and not to identify you. You can block or delete these cookies in your browser settings, and the site keeps working without them. We do not use advertising cookies anywhere.

14. Children

Our services are for sellers running a business and are not directed to children. You must be at least 18 years old to use them. We do not knowingly collect personal data from children; if you believe a child has given us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the service changes. We will change the “Last updated” date and, for material changes, notify account holders in the app or by email before the changes take effect.

16. Contact