Privacy Policy

Protection and governance of RAZRBILZ customer personal data. Last updated: 29 September 2026.

1. Who We Are

RAZRBILZ CREATIVE STUDIO LLC. For the purposes of Indonesian Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”), we are the data controller of the personal data described in this Policy.

This Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, how we protect it, and what rights you have. It applies to the Site and to any message you send us about an order.

Please read this Policy together with our Terms of Service and our Refund Policy.

2. What Personal Data We Collect

2.1 Data you give us directly. When you place an order we collect: first name, last name (optional), email address, phone number, country, province or state, street address, apartment/unit (optional), district (optional), city, postal code, your chosen courier and service, and your chosen payment method. When you use the contact form we collect: your name, email address, subject, and the message you write. When you make a return or refund claim we collect: your order number and any photographs or video (for example an unboxing video) that you attach to your email.

We do not offer customer accounts. We do not ask for, and you should never send us, passwords, card numbers, bank account credentials, government identification numbers, or data about your health, biometrics, genetics, religion, or political views.

2.2 Data about other people. The delivery details you enter at checkout do not have to be your own. If you give us the name, address, or phone number of another person as the recipient of a parcel, you confirm that you are allowed to share that person’s data with us and that you have told them we will use it to deliver the order.

2.3 Data collected automatically.

  • Country of visit. We set one cookie, named user_country, holding a two-letter country code. It is derived from your IP address by our hosting provider’s geolocation header, or from the country you select. It lasts one year. We use it to show a reference price in your currency and to display the checkout in the right language.
  • Shopping cart. The contents of your cart are stored in your browser’s local storage, on your device. They are not sent to us until you check out.
  • Error reports. When the Site fails, our error monitoring service records the error message, the stack trace, the page path, and an internal order number. We have deliberately configured it not to record cookies, HTTP headers, request or response bodies, URL query parameters, database query values, or the values of local variables in the code.
  • Aggregate analytics. We use first-party web analytics that count page views and visits in aggregate. This service does not use cookies, does not build a cross-site profile of you, and does not identify you to us.
  • Server logs. Our hosting platform keeps standard request logs, which may include your IP address, browser type, and the time of the request.
  • Abuse prevention. When you submit the contact form we read your IP address briefly, in server memory only, to limit repeated automated submissions. It is not written to our database.

2.4 Data we receive from third parties.

  • From our payment gateway: the payment reference, payment method used, virtual account number or QR/payment code, any fee, and the payment status.
  • From our shipping aggregator: the tracking number and courier status events.
  • From our hosting provider: the country inferred from your IP address.

3. Why We Process Your Data and on What Legal Basis

Under Article 20(2) of the PDP Law, each processing activity must rest on a legal basis. Ours are:

  • Performance of a contract with you (Article 20(2)(b)): producing, packing, and handing over your order; processing your payment and recording its status; arranging delivery and giving you tracking details; answering your messages, handling returns and refund claims, and responding to warranty questions; showing a reference price in your currency and displaying the checkout in the appropriate language.
  • Compliance with a legal obligation (Article 20(2)(c)): keeping accounting records and meeting tax obligations.
  • Our legitimate interest, balanced against your rights (Article 20(2)(f)): detecting and preventing fraud, abuse, and automated submission of our forms; keeping the Site working and diagnosing failures; understanding, in aggregate, how the Site is used.

We process data only for these purposes, only as much as is needed for them, and we keep it accurate and up to date (Articles 27 to 29 of the PDP Law).

4. Consent and Withdrawing It

We do not currently rely on your consent for anything we do. We send no promotional email, run no advertising, use no advertising cookies, and build no profile of you. Every purpose listed in section 3 rests on contract, legal obligation, or legitimate interest.

If we ever start sending promotional email, we will ask for your separate, explicit, recorded consent first (Articles 21 and 22 of the PDP Law), we will not pre-tick the box for you, and refusing it will not affect your ability to buy from us.

Where we do rely on consent, you may withdraw it at any time by writing to support@razrbilz.id. Withdrawing consent does not make earlier processing unlawful. Once we receive a withdrawal request we must stop the relevant processing within 3 × 24 hours (Article 40(2) of the PDP Law).

5. Who We Share Your Data With

We share only what each recipient needs to do its job. We never sell your personal data, and we never share it with anyone for their own advertising.

  • Payment gateway: Duitku (Indonesia). Your name, email, phone, billing and shipping address, item details, amount, and payment method. Duitku processes the payment. We never receive your card number or bank credentials.
  • Shipping: Biteship (Indonesia) and the courier it dispatches. Recipient name, phone, email, full delivery address, postal code, delivery note, and the name, value, quantity, weight, and dimensions of each item.
  • Database hosting: Supabase. Our order, product, and settings records. The database is hosted in Singapore.
  • Site hosting: Vercel. The Site itself, server logs, and first-party aggregate analytics.
  • Email delivery: Resend. Transactional email only: order confirmation, cancellation notice, and notification to us when you use the contact form.
  • Error monitoring: Sentry. Error messages, stack traces, page paths, and internal identifiers, with personal data fields excluded as described in section 2.3.
  • Professional advisers. Where we engage an accountant or tax adviser, they receive only the records needed for accounting and tax filings.
  • Public authorities. Where a statute, court order, or lawful request obliges us to disclose data.

Our shipping and payment providers act as processors for the delivery and payment steps and are bound by their own terms and by Indonesian law. Where a provider processes data on our instruction, we require it to act only on that instruction (Article 51 of the PDP Law).

6. Cookies and Similar Technologies

  • user_country: cookie, essential, 1 year. Remembers your country so prices and the checkout language are correct.
  • Cart contents: browser local storage, until you clear it. Keeps your cart between visits. Stays on your device; not sent to us until checkout.
  • Vercel Web Analytics: first-party analytics, not set by us. Counts visits and page views in aggregate. No cookies, no cross-site profile.
  • Sentry: operational, 90 days. Records technical failures so we can fix them.

You can delete or block cookies in your browser settings. If you do, the Site still works: we simply re-detect your country from your IP address on each visit instead of remembering it. Prices are stored and charged in Indonesian Rupiah and are not affected by your cookie settings. Blocking cookies does not empty your cart, because the cart is kept in local storage rather than in a cookie; clearing your browser’s site data will.

We do not respond to Do Not Track or Global Privacy Control signals. This is not an oversight: we run no targeted advertising and we do not sell or share personal data for anyone else’s advertising, so there is nothing for those signals to switch off.

We do not currently show a cookie consent banner, because we place no advertising or third-party tracking cookies. If that changes, this section will change with it.

7. Transfers of Your Data Outside Indonesia

Some of the services in section 5 are operated outside Indonesia. In particular, our database is hosted in Singapore, and our hosting, email, and error monitoring providers may process data in the United States or in other countries where they operate.

Article 56 of the PDP Law permits these transfers and sets a hierarchy of safeguards: the receiving country must provide a level of protection equal to or higher than the PDP Law (Article 56(2)); if it does not, there must be adequate and binding protection arrangements (Article 56(3)); and if neither is available, the controller must obtain the data subject’s consent (Article 56(4)).

No adequacy determination covering the countries where our providers operate has been issued under Indonesian law at the time of writing, so we rely on Article 56(3): adequate and binding protection. Each provider named in section 5 is bound by data protection terms in our agreement with it that restrict what it may do with your data and oblige it to keep your data protected. We limit what we send each provider to the minimum it needs. Where adequate and binding protection cannot be ensured for a particular transfer, we will obtain your consent under Article 56(4) before that transfer takes place.

You may ask us for further information about the safeguards in place for a specific provider by writing to support@razrbilz.id.

8. Buyers Outside Indonesia

We ship internationally. If you order from outside Indonesia, your personal data is still processed as described in this Policy and is subject to Indonesian law, because we are established in Indonesia.

The law of the country you live in may give you additional rights over your personal data. We do not claim to comply with every foreign privacy regime, and this Policy is not written as a GDPR, CCPA, or UK GDPR notice. If you believe you have a right under your local law that we should honour, write to support@razrbilz.id and we will consider your request in good faith.

9. How Long We Keep Your Data

We keep personal data only as long as it is needed for the purpose it was collected for, and no longer, unless a legal retention duty requires otherwise.

  • Order records: your name, contact details, delivery address, items, amounts, courier, payment reference and status. We keep them for 10 years from the end of the relevant financial year, as required for company records and accounting evidence under Article 11(1) of Law No. 8 of 1997 and Indonesian tax record-keeping rules.
  • Contact form messages: 3 years from the date of the last correspondence on the matter.
  • Return / refund claim material, including any photos or video you send: 3 years from the date the claim is closed.
  • Shipping event logs attached to an order: retained with the order record.
  • Error reports: 90 days from the date of the report, per our error monitoring retention setting.
  • Aggregate analytics: per the analytics provider’s own retention policy.
  • Cart contents in your browser: until you clear your browser storage.

When a retention period ends, we delete or destroy the data, or anonymise it so it can no longer be linked to you (Articles 43 and 44 of the PDP Law), and we will notify you that this has been done (Article 45).

You may ask us to delete your data earlier. We will do so unless we are legally required to keep it, for example to complete an order in progress, to satisfy the 10-year record-keeping duty above, or to handle a dispute. Where we refuse, we will tell you which exception applies.

10. How We Protect Your Data

Connections to the Site are encrypted in transit over HTTPS. Our measures include, in proportion to the risk:

  • restricting access to order data to authenticated administrator users only;
  • holding database and service credentials ourselves and never exposing them to the browser;
  • verifying courier status callbacks against a shared secret using a timing-safe comparison, so that status updates cannot be forged;
  • generating order numbers cryptographically at random, so that one customer’s order cannot be reached by guessing another order’s address;
  • validating and length-limiting every field submitted through public forms, and rate-limiting the contact form to resist automated abuse;
  • configuring our error monitoring service to exclude cookies, headers, request bodies, query parameters, database values, and local variable values, so that crash reports do not carry your name, address, or phone number;
  • keeping off-site backups of the database.

No security measure is perfect and we cannot promise that data will never be intercepted or misused. Please do not send us sensitive information through an insecure channel, and tell us promptly if you believe your data has been misused.

11. Your Rights

As a data subject you have the following rights under the PDP Law:

  • to be informed about the identity, legal interest, and purpose of the party requesting your data (Article 5);
  • to complete, update, and correct inaccurate or incomplete data (Article 6);
  • to access your data and obtain a copy of it (Article 7);
  • to end processing, delete, and/or destroy your data (Article 8);
  • to withdraw consent you have given (Article 9);
  • to object to a decision based solely on automated processing, including profiling, that has legal or significant effects for you (Article 10);
  • to delay or restrict processing, in proportion to its purpose (Article 11);
  • to sue for and receive compensation where processing of your data violates the law (Article 12);
  • to receive your data in a commonly used, machine-readable format and to send it to another controller where the systems can communicate securely (Article 13).

How to make a request. Email support@razrbilz.id with the subject line “Data Privacy Request”. Include your order number if you have one, and say clearly which right you are exercising. We may ask you to confirm your identity before we respond, and we will use anything you send only to verify you and to answer the request. There is no charge. We respond as follows:

  • Correction or update of your data: 3 × 24 hours (Article 30(1)).
  • Access to your data and a copy of it: 3 × 24 hours (Article 32(2)).
  • Withdrawal of consent, which stops the processing: 3 × 24 hours (Article 40(2)).
  • Delay or restriction of processing: 3 × 24 hours (Article 41).
  • Notification that data has been deleted or destroyed: after we act (Article 45).

These rights are not absolute. Articles 15 and 50 of the PDP Law allow us to refuse or limit certain requests where necessary for national defence and security, law enforcement, the public interest in running the state, or supervision of the financial sector. If we refuse a request, we will tell you why and which exception applies. We will not treat you worse because you exercised a right.

Complaints. Please contact us first at support@razrbilz.id so that we can try to resolve the matter. If you are not satisfied, you may complain to the data protection authority established under the PDP Law. At the time this Policy was written that authority had not yet been formally established. Until it is, you may also direct your complaint to the Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, “Komdigi”), the ministry responsible for the digital sector, without prejudice to your right to complain to the authority once it exists.

12. Children’s Data

Our products are not marketed to children and we do not knowingly collect personal data from children. Under Article 25 of the PDP Law, processing a child’s personal data requires the consent of the child’s parent or guardian.

If you are under 18, please do not place an order without a parent or guardian acting for you. If you are a parent or guardian and believe we hold your child’s personal data without your consent, write to support@razrbilz.id. We will verify the situation and delete the data promptly.

13. If There Is a Data Breach

If our protection of your personal data fails, we will notify you and the competent authority in writing no later than 3 × 24 hours after we become aware of it, as required by Article 46 of the PDP Law. The notification will state at least which personal data was disclosed, when and how it was disclosed, and what we are doing to handle and recover from it. In certain cases we will also notify the public.

14. Data Protection Officer

We have not formally appointed a Data Protection Officer. For questions, data rights requests, or complaints, contact support@razrbilz.id.

Article 53(1) of the PDP Law requires a data protection officer only where processing serves the public, where core activities require regular and systematic monitoring of personal data at large scale, or where core activities consist of large-scale processing of specific personal data or data relating to criminal offences. We have assessed that we do not meet these conditions: we provide no public service, we carry out no systematic monitoring, and we do not process specific personal data at scale. The payment details we keep are references issued by our payment gateway: payment method, status, and reference or virtual account codes, together with the amount paid. The underlying card or bank account data is held by the gateway and never reaches us. We will review this assessment whenever our processing changes, and in particular before we start processing any category of specific personal data.

15. Links to Other Sites

Completing a purchase takes you to a payment page operated by Duitku, and tracking a parcel may take you to a courier’s site. Those services are run by third parties under their own privacy policies, which we do not control. We are not responsible for what happens on them.

16. Changes to This Policy

We may update this Policy to reflect changes in our practices, in the law, or in our services. The revised version will be posted on this page with a new “Last updated” date. For changes that materially affect your rights, we will give notice on the Site and, where the law requires it, by email, before the change takes effect. We will not apply a material change retroactively in a way that reduces your rights without telling you first.

17. Contact