Privacy Policy

Last updated: 5 July 2026

This Policy explains what information CardArc (operated by Coco Milo Holdings and its affiliates, including PT Coco Global Prima) collects, why, and your choices. It covers cardarc.app, admin.cardarc.app and store subdomains.

1. What we collect

We collect:

• Account details — your name, email and profile picture from Google when you sign in.
• Workspace data — the inventory, sales, customers, prices and settings you and your team enter to run your store.
• Contact requests — the details you submit on our early-access form (email, store name, location, message).
• Usage and technical data — logs, device/browser info and IP address, used to keep the service secure and working.

2. How we use it

We use your information only to:

• provide, operate and improve the CardArc platform
• run your storefront, POS, inventory and books
• communicate with you about your account, support and early access
• keep the platform secure and prevent abuse
• meet legal obligations

3. How we share it

We do not sell your personal information. We share it only with service providers that help us run CardArc — such as Google (sign-in), Resend (email delivery) and payment providers (Stripe, Xendit) when you use those features — and only as needed. Each workspace's data is kept isolated from other workspaces. We may disclose information if required by law.

4. Your data is yours

The business data in your workspace belongs to you. You can request an export or deletion of your data at any time. Consistent with Singapore's PDPA and the EU GDPR (where applicable), you may access, correct or delete your personal data and withdraw consent — contact us to do so.

5. Retention

We keep your data while your workspace is active and for a reasonable period afterwards, unless you ask us to delete it sooner or the law requires us to keep it (for example, transaction records).

6. Cookies and sessions

We use a small number of essential cookies to keep you signed in and to remember your selected workspace. We don't use advertising trackers.

7. Security

We host on a private server behind automatic HTTPS, isolate each workspace's data in the application layer, keep secrets off the public internet, and back data up. No system is perfectly secure, but we take protecting your data seriously and review our security regularly.

8. International transfers

CardArc operates across Southeast Asia. Your data may be processed in Singapore and other locations where we or our providers operate, with appropriate safeguards.

9. Changes and contact

We'll update this Policy as the platform grows and note the date above. For any privacy question or request, reach us through the contact form on our site.