Storefront privacy notice
How the Indonesia storefront handles information.
This notice describes the current data flows used to operate novabiolabs.id, including orders, bank-transfer coordination, fulfilment, support, email delivery, analytics and live chat. It is an operational disclosure, not a legal conclusion.
2. Information We Collect
- Order and delivery information: name, email, phone number, delivery address, country, order reference, ordered products, quantities and totals.
- Payment and status information: payment method, provider references, payment status, timestamps and the minimum information needed to reconcile a bank transfer or provider payment. Bank credentials are not collected through the public storefront.
- Fulfilment information: assigned supplier, delivery details, courier, tracking number, tracking URL and fulfilment status.
- Communications: messages and contact details you provide through email, official WhatsApp links, support chat, restock requests, membership or programme forms.
- Security and operational information: IP-derived rate-limit identifiers, request metadata, safe error summaries and event delivery state.
- Optional usage information: page and device information collected by Google Analytics only after affirmative consent.
3. How We Use Information
- Receive and validate orders, coordinate official bank-transfer instructions and review payment status.
- Send order-received, payment-confirmed and dispatch communications.
- Arrange supplier fulfilment and provide courier tracking.
- Respond to support, privacy and restock enquiries.
- Prevent abuse, troubleshoot failures and maintain retry-safe operational records.
- Measure site usage and provide support chat where you have accepted optional services.
Opening WhatsApp does not mark an order as paid. Payment status changes are verified through authorised server-side processes.
4. Current Service Providers and Recipients
- Netlify: website hosting, serverless Functions and Netlify Blobs storage for orders and operational records.
- Resend: delivery of operational customer and administrator emails.
- Telegram: restricted operational notifications to authorised staff and assigned suppliers. Depending on the event, a message can include an order reference, customer name and contact details, order items, total, or delivery address.
- Google Analytics: optional site measurement loaded only after affirmative consent. Advertising signals and personalisation are disabled in the site configuration.
- Tawk: optional live support chat loaded only after affirmative consent.
- WhatsApp / Meta: official contact links used for customer-initiated payment coordination and support. WhatsApp processes messages under its own terms.
- Fena: server-side support remains available for an authorised Fena-hosted payment link used for a separately arranged order. The standard storefront payment routes do not currently offer Fena; manual bank transfer remains the initial launch method.
- Fulfilment suppliers and couriers: an assigned supplier receives the customer name, delivery address, ordered product and quantity. A courier receives the recipient and delivery information needed to deliver and track the parcel.
- Google Fonts: font files requested by the browser from Google infrastructure.
EmailJS, Formspree and browser-side Google Apps Script order logging are not active storefront processors.
5. Storage and Security
Order and operational records are processed server-side and stored in Netlify Blobs. Access to administrative and supplier operations is restricted by server-side authentication and supplier scoping. Email and notification event records store delivery state and safe failure summaries rather than complete email bodies.
No internet service can be guaranteed completely secure. Contact hello@novabiolabs.io if you believe information has been exposed or used incorrectly.
6. Retention and Deletion
Order, payment, fulfilment and communication records are retained for operational and record-keeping purposes. Restock contact details can be removed after a request is fulfilled or withdrawn. The storefront does not currently enforce a fixed automated deletion schedule for order records.
To request access, correction or deletion, email hello@novabiolabs.io with enough information to locate the relevant record. Requests are reviewed manually, and some information may need to be retained where an applicable obligation requires it.
7. International Processing
Providers such as Netlify, Resend, Google, Tawk, Meta, Telegram and Fena may process information in countries outside Indonesia. Their infrastructure and support operations may therefore involve international transfers. Provider locations and safeguards vary by service.
8. Your Choices and Requests
Ask what information is held about you
Ask for inaccurate information to be corrected
Ask for deletion where applicable
Object to or restrict particular uses where applicable
Withdraw optional analytics and chat consent at any time
Unsubscribe from optional marketing communications
Available rights and complaint routes depend on applicable law. Contact hello@novabiolabs.io to make a request.
9. Cookies, Local Storage and Optional Services
Essential storefront storage works without analytics consent. The site does not treat scrolling or continued browsing as consent.
| Storage | Purpose | Category | Typical retention |
|---|
cart and checkout state | Keeps selected products and essential order-flow state in the browser. | Essential | Until cleared or replaced |
nova_verified | Remembers the session acknowledgement used by the storefront notice. | Essential | Browser session |
nova_consent_v1 | Stores whether optional analytics and support chat were accepted or declined. | Essential preference | Until changed or browser storage is cleared |
| Order access and referral state | Supports order-email authorisation, order continuity and referral attribution. | Essential / requested feature | Feature-specific |
| Google Analytics storage | Measures site usage only after optional services are accepted. | Optional analytics | Controlled by Google and browser settings |
| Tawk storage | Provides live support chat only after optional services are accepted. | Optional support | Controlled by Tawk and browser settings |
Use the Privacy choices control at the bottom of any consent-enabled page to accept, decline or revisit optional services. Declining does not disable essential storefront functions.
10. Age Restriction
The storefront is intended for people aged 18 or over. If you believe information from a person under 18 has been submitted, contact hello@novabiolabs.io.
11. Updates and Contact
This notice may be updated when processors or operational practices change. The revision date at the top identifies the current version.
