Privacy Policy.

STSPoint ("we," "us," or "our") operates a digital infrastructure bridge. Because we function as a technical intermediary between your business and third-party upstream providers (such as Xendit, GoPay, and Orderkuota), we process data necessary to facilitate API requests, transaction reconciliation, and system security. This policy outlines how we handle data within this bridge architecture.

To provide our infrastructure services, we collect three types of information: • Account Information: Name, business email, and identity verification data provided during registration. • Technical Data: IP addresses, User-Agent strings, API request headers, and usage timestamps required for security monitoring and rate limiting. • Transaction Metadata: Details of transactions processed through our bridge (e.g., amount, status, timestamps, and destination identifiers). We do not store raw payment credentials such as credit card numbers or bank PINs.

Your data is utilized strictly for the following purposes: • Service Delivery: Fulfilling PPOB, OTP, and Payment Gateway requests via upstream bridges. • Reconciliation: Ensuring transaction statuses are correctly synchronized between our system and yours. • Security: Detecting fraudulent activity, unauthorized API access, and system anomalies. • Communication: Sending critical system alerts, maintenance notices, and security updates related to your account.

As a bridge service, your data is inherently shared with Third-Party Providers to execute your requests. For example: • Payment data is shared with Xendit or Midtrans for processing. • Phone numbers are shared with Orderkuota for OTP delivery. • Product SKUs are sent to DigiFlazz for fulfillment. Each upstream provider has its own privacy policy. STSPoint is not responsible for the data handling practices of these independent entities.

We implement industry-standard encryption (TLS 1.3) for all data in transit. Your Secret Keys are your primary authentication mechanism; we hash these where possible or encrypt them at rest. STRICT POLICY: STSPoint employees will never ask for your passwords, Secret Keys, or 'unnatural' sensitive data such as 12/24-word recovery phrases. Any such request should be treated as fraudulent.

We retain transaction logs and account data for as long as necessary to fulfill our legal obligations, resolve disputes, and maintain system integrity. Inactive accounts may be purged after a period of prolonged dormancy, subject to our internal data lifecycle policies.

You have the right to: • Access the personal data we hold about you via your Console. • Request the correction of inaccurate information. • Request the deletion of your account (which may result in the immediate termination of API access). • Revoke Secret Keys at any time through the Developer settings.

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency). However, as a bridge, we do not participate in or monitor your specific business activities unless required by upstream security protocols.