Lamxo
Log in Sign up
← Back to the Lamxo home page

Lamxo Privacy Policy

Updated 24 October 2026 · effective from the day Lamxo opens to the public

Lamxo is run by PT IZAAJA SOLUSI DIGITAL. This policy explains what data we store, why, and your rights — as a store owner, and the rights of buyers whose data you keep in Lamxo.

1. Our two roles

For your data as a store owner (account, staff, subscription), we are the data controller.

For buyer data you keep in Lamxo, you are the data controller and we are the processor. We process it only to run your till, do not sell it, do not use it for advertising, and do not contact your buyers on our own behalf.

2. Store owner and staff data

  • Account: name, email, phone number, password (stored as a one-way hash), language, and time zone — the same as your Izaaja account.
  • Business: store name, outlet addresses, tax number, tax registration status, and receipt settings.
  • Staff: name, role, permissions, PIN (stored as a one-way hash), clock-in and clock-out times, and commission if you use it.
  • Subscription: plan, dates, amount, invoice number, and payment status from Midtrans or Google Play.
  • Technical records: IP address, device type, and error logs, for security and fixes.

3. Sales and buyer data

  • Sales: items, quantities, prices, discounts, tax, payment method, cashier, outlet, time, and receipt number.
  • Customers you register: name, phone number, email (optional), purchase history, points, and store credit — nothing more. A customer cannot be saved without recorded consent: the time, the staff member who recorded it, and the consent text in the outlet's language.
  • Items with serial numbers/IMEI and expiry dates, if you use them.

4. What we do not store

  • Card numbers, card PINs, or EDC data — card payments are recorded by type and amount only.
  • Money from buyers: QR payments go straight to your bank account, and we do not read your bank account.
  • Your marketplace account passwords.

5. What the data is used for

  • Running the till: recording sales, printing receipts, reducing stock, and building reports in the Izaaja dashboard.
  • Counting the free-plan allowance and managing subscriptions.
  • Security: preventing unauthorised access and recording important actions (customer data exports and deletions) in the audit log.
  • Answering your questions and help requests.
  • Meeting legal obligations, including bookkeeping and tax.

We do not sell data and do not use your sales or buyer data for advertising.

6. Legal basis

We process data because it is needed to perform our agreement with you, because of legal obligations (bookkeeping and tax), because of our legitimate interest in keeping the service secure, and — for buyer data — on the consent you collect and your instructions as controller.

7. Retention

Account data is kept while the account is active and permanently deleted 14 days after a deletion request. Transaction and tax records are kept for 10 years, because Indonesian bookkeeping rules require it, or longer if the law of your store's country requires. These records cannot be deleted sooner, even on request.

When one customer's data is deleted, the name, phone number, and email are blanked; sales and money records stay without identity. Deletion is refused while that customer still has unpaid store credit, and the reason is shown.

8. Location and recipients

Data is stored on Contabo GmbH servers in Germany. Other recipients only as far as needed: Cloudflare (network, security, and Turnstile on the contact form), Midtrans and Google Play (subscription payments), and Google Sign-In if you sign in with Google. The full list of providers shared with Izaaja is in the Izaaja Privacy Policy.

9. Security

All connections use HTTPS. Secret data is stored encrypted (AES-256-GCM), passwords and PINs are stored as one-way hashes, and staff access is limited by the permissions you set.

10. If a breach happens

For your account data, we notify you and the relevant authority within 3×24 hours under Indonesia's Personal Data Protection Law, or 72 hours in another country if its law asks for sooner. For buyer data, we notify you without undue delay, so you have time to meet your own obligations as controller.

11. Cookies

The lamxo.com site uses no advertising or tracking cookies. Only what is needed: Cloudflare Turnstile on the contact form to filter out bots, and the sign-in cookie in the app.

12. Your rights and your buyers' rights

You have the right to see, correct, export, and delete your data, and to withdraw consent. Send requests to dpo@izaaja.com from your account email; we reply within 14 days.

Buyers who want to see or delete their data contact the store where they shopped. In Lamxo, you can export one customer's data (JSON or CSV) and delete it. If a buyer's request reaches us, we pass it on to the store concerned.

13. Children

Lamxo accounts are only for people aged 18 and over. Do not register a child as a customer without the consent of their parent or guardian.

14. Changes

We announce important changes at least 30 days before they take effect, by email or in the app.

15. Contact

See also About Lamxo · Contact us · Lamxo Terms of Service · Delete Lamxo data. Juga tersedia dalam Bahasa Indonesia