Privacy Policy
This Privacy Policy explains what personal data Lesstruct Merch collects when you browse the store, place an order, or create an account — and what we do with it. It is written to meet both the EU General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022, "PDP Law").
Effective date: 31 October 2026.
Who we are
The data controller (Pengendali Data) is Lesstruct Merch, operated by Lesstruct (lesstruct.dev).
Contact for everything in this policy — including privacy requests: contact@lesstruct.dev
What we collect and why
Data | Why we need it | Legal basis |
|---|---|---|
Order details — name, email, phone, shipping address, and the items you order | to process, pack, and deliver your order | performing our contract with you |
Payment proof (your bank-transfer receipt) | you pay by manual bank transfer; the proof lets us verify your payment before shipping | performing our contract with you |
Account data — username, email address, hashed password, verification and sign-in codes | to create and secure your account | performing the contract, and our legitimate interest in keeping accounts secure |
Order-status emails | to keep you informed from payment to delivery | performing our contract |
Technical logs — IP address and request logs | to rate-limit authentication and prevent abuse and fraud | our legitimate interest in security |
Invoice records | Indonesian tax law requires transaction records | legal obligation |
We collect nothing else. We run no analytics, advertising, or tracking on this store.
A note on payment proof: transfer screenshots often contain your bank account name and number. We use them only to verify your payment — you are welcome to cover your account number before uploading; we only need to see the amount, date, and recipient account.
Cookies and local storage
We set a small number of cookies and use browser local storage for your cart. See the Cookie Policy for the full list and how to change your choices.
Who receives your data
We share personal data only with the providers that make the store work:
our email delivery provider (order confirmations and status emails),
our hosting provider,
a payment gateway, if and when online payment methods are offered (today the store uses manual bank transfer only).
These providers process data on our behalf, under contract. We never sell your personal data, and we share only what each provider needs.
Transfers outside Indonesia
Some providers may process data outside Indonesia — or outside your country of residence. Where that happens, we put safeguards in place first, such as the contractual data-protection clauses required by the GDPR or the PDP Law.
How long we keep your data
Unpaid orders expire automatically 24 hours after checkout.
Paid orders and invoices are retained for up to 10 years, as required by Indonesian tax law.
Accounts are kept until you ask us to delete them.
Verification and sign-in codes expire within minutes.
If you ask us to delete data, copies in routine backups may persist for a short period until the backups rotate out.
How we protect your data
Personal data in orders (names, emails, phones, addresses) is encrypted at rest in our database.
Staff and administrator accounts are protected with multi-factor authentication.
Authentication endpoints are rate-limited to slow down attacks.
All traffic is served over HTTPS in production.
Your rights
You can ask us to:
access the personal data we hold about you,
correct data that is wrong or incomplete,
delete your data (except records we must keep by law, such as paid invoices),
port your data to you in a machine-readable format,
restrict or object to processing based on our legitimate interests,
withdraw consent where processing relies on it (for example, preference cookies).
To use any of these rights, email contact@lesstruct.dev. We answer within 30 days and may ask you for minimal information to verify that you are the account or order owner.
If you are in the EU/EEA, you may also complain to your national data protection authority. If you are in Indonesia, the PDP Law grants equivalent rights, with a supervisory authority to be designated under the law.
Children
The store is not directed at children, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy as the store evolves. The effective date above always reflects the current version; material changes will be announced on this page.
Contact
Questions about privacy? Email contact@lesstruct.dev.