Skip to content
ZenVan
17,000+
Sold
4.8★
Rating
Full
Warranty
Chat CS

ZenVan Store's WhatsApp is currently banned — for now all buying & selling goes through Telegram @zenvanstoree.Chat on Telegram →

← Back to Home
Terms & ConditionsPrivacy PolicyRefund PolicyDisclaimer

Privacy Policy

Last updated: 25 September 2026

1. Data We Collect

When you transact or interact with ZenVan Store, we may store:

  • The name or alias you use when communicating with us
  • Your WhatsApp number or other contact (e.g. a Telegram username or email), for transaction-related communication
  • Details of the account being traded (rank, skins, heroes, price)
  • Transaction history, for warranty and dispute purposes
  • Sell-account form entries — if you fill in the form on the /jual-akun page (Mobile Legends, PUBG Mobile or Free Fire): your name, contact (a WhatsApp number or another contact you choose) and the account details you enter: rank/tier, region, bindings, level, skin & hero counts, other account attributes, access status (e.g. whether the original email is handed over), expected price and notes. We turn these entries into a chat message to our admin. When you press the form's submit button, a copy of the entries may also be stored on our server (the sell_leads table), even if the chat fails to open or you don't send the chat message, so your offer is not lost. A summary of the stored entries (name, contact, account details, price and an excerpt of the notes) may also be forwarded to our admin through our internal notification channel (Telegram bot or WhatsApp), not by email. The form does not ask for game passwords, OTPs or verification codes. If you type them into the notes field, our system tries to drop the lines containing them (including lines containing an email address) before storage, but please don't type them.

    Alongside these entries we store: the ad reference code and Google Ads click identifier if you came from an ad (see section 7), your first-visit source from the zv_attr cookie if present, the page where the form was filled in, the page language, the customer-service channel active at the time, a summary of device type, operating system & browser (not the full user-agent string), and a flag for whether the browser appears to be automated. IP addresses are not stored with this data. The form on the /jual-akun/ajukan page does not open a chat: your entries go straight to our server, and our customer service then contacts you through the contact (WhatsApp or Telegram) you provided. We also store the LAST campaign source before you filled in the form (the zv_last cookie, see section 7) and the referral code you typed, if any. If your submission later leads to us buying the account, our admin records the account code and purchase price on the same record, to measure which promotion channel actually brings in accounts.

  • WhatsApp number, budget range and email (optional) if you sign up for new-stock notifications through the pop-up form on our website (stored in the wa_subscribers table)
  • Telegram chat ID, budget & game preference if you turn on stock alerts through our Telegram bot (@zenvanstore_bot). Stored on our own server only to send the alerts you asked for (at most 3 a day); send /stop to the bot to stop at any time.
  • Data from Google Sign-In (opt-in) — If you choose to sign in with Google, we receive from Google:
    • Your Google account email address
    • Your Google profile name and profile photo
    • Your Google account ID (an internal identifier managed by Supabase Auth)
    • Your sign-up date and last-login timestamp
    We do not receive your Google password or access to any other Google service (Gmail, Drive, Calendar). You can disconnect at any time via Google Account — Third-party connections.
  • Orders on the site — if you order through the site checkout: your name, contact, email (optional) and order notes, together with your first-visit source (the zv_attr cookie) and your browser's Google Analytics identifier, to record where the order came from, plus the approximate city and country our hosting provider derives from your IP address (the IP address itself is not stored with the order). If you came from an ad, we also store its ad click identifier with the order (Google Ads: gclid, gbraid or wbraid; Microsoft Ads: msclkid), so we know which ads bring in buyers. Some order data is shown, censored, on the public /bukti-transaksi page (see section 3). The last campaign source before you ordered (the zv_last cookie, see section 7) may also be stored with the order.
  • Seller applications — if you apply through the become-a-seller form: your name, WhatsApp number, the platform you currently sell on, your listing count and your message (the seller_applications table). The entries are also forwarded to our admin as a notification.
  • Stock alerts for a specific search — if you ask to be told when an account you searched for becomes available: the search keywords, your email or WhatsApp number, and the page language (the stock_alerts table).
  • Referral program — if you create a referral code: the WhatsApp number and name you enter, to link the code to you (the referral_codes table).
  • Email subscription — if you subscribe to email updates (e.g. in the footer, at checkout or on the account page): your email address, the form you signed up from, language, confirmation or unsubscribe status, and a record of sends (the email_subscribers table). We send a confirmation email first, and every email contains an unsubscribe link.
  • Conversations — messages you send to our WhatsApp business number may be answered by an automated assistant and stored in our database (number, profile name, message content). If you use the chat assistant on this site, your messages are sent to an AI model provider to be answered, and a snippet of your latest message (max. 500 characters) may be stored to understand visitor needs.
  • Technical data — data your browser sends automatically (IP address, browser type) is processed by our hosting providers and used for security, e.g. rate limiting. To count listing views and power recommendations we store a one-way hash of the IP address, not the address itself.

We do not directly collect game account passwords or financial data (bank accounts, PINs).

2. How We Use Your Data

  • Reviewing and following up on account-sale offers you send, including contacting you through the contact you provided
  • Measuring where visits come from and how well our ads work, and showing ZenVan ads to people who have visited this site before (remarketing)
  • Processing and completing transactions
  • Providing after-sales support and warranty service
  • Sending new-stock notifications to subscribers who signed up
  • Preventing fraud and illegal activity
  • Improving the quality of our service
  • Identifying you on the /akun page and syncing your wishlist and loyalty points across devices (if you sign in with Google)

3. Sharing Your Data

We do not sell or rent your personal data. We share data with service providers that help run this site, limited to what they need for their service, and with authorities where required by law or valid legal process. In addition, some site-order data is shown, censored, on a public page (see below this list). Our service providers:

  • Google: Analytics, Ads, Tag Manager and Google Sign-In (see section 7)
  • Telegram: customer-service channel, stock-alert bot and internal notifications to our admin
  • Meta: Meta Pixel (ad measurement) and WhatsApp (customer-service channel and internal notifications to our admin)
  • Microsoft: Clarity (page-interaction analytics)
  • Supabase (database & sign-in) and Vercel (site hosting)
  • Tripay and NOWPayments: payment processing. Tripay receives the buyer's name, email and phone number
  • Resend and Amazon SES: email delivery (order confirmations, stock news for subscribers, internal notifications to our admin)
  • Brevo: contact list for stock-news subscribers. If you enter an email in the stock-alert pop-up, that email is sent to Brevo together with the WhatsApp number and budget range you entered
  • Anthropic: AI model for the on-site chat assistant
  • Upstash: rate limiting (uses the IP address as a temporary key)
  • Third-party Mobile Legends ID lookup services (including Codashop): when you use the account checker, the User ID and Zone ID are sent to them to read the public nickname

Some of these providers process data outside Indonesia.

Public transaction board — the /bukti-transaksi page shows orders placed through the site checkout (except cancelled ones): account title, price, game, payment method, status and its timing, approximate city, and the buyer's identity censored on the server before it reaches the browser (at most the first 4 letters of the name, the first 2 characters of the number, and the first 3 letters of the email plus its domain). You can object to your order being shown through the contact in section 11.

We use sell-account form entries to follow up on your offer, and to count incoming offers and the ads they came from (through the reference code and ad click identifier in section 7). Our site's code does not include the name, contact or notes from this form in data sent to Google or Meta for advertising or analytics (other than the chat message you send yourself via WhatsApp or Telegram); analytics events sent when the form is submitted do not contain your name or contact. Exception: if you open the form from the PUBG Mobile price calculator, the account specs from the calculator are carried in the page address (URL) and are recorded by the analytics and ad tools as the address of the page you opened.

4. Data Security

We use encryption and industry-standard security practices to protect your data. No system is 100% secure, however, so we encourage you not to share sensitive information that isn't needed.

Data processing is governed by Indonesia's Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) (the Personal Data Protection Act).

5. Data Retention

We keep data for as long as it is needed for the purposes in section 2, for example transaction data for warranty and disputes, and sell-account form entries to follow up on your offer, or as long as the law requires. There is currently no scheduled automatic deletion: data is deleted at your request (see section 9) or when we review data that is no longer needed.

WhatsApp notification subscriber data (number and budget) is kept until you request deletion or opt out.

Google profile data (for accounts signed in with Google) is kept while the account is active. The site has no self-service delete-account button yet: contact us (section 9) to delete your account, and we delete your Google profile data and related data once the request is verified.

6. Local Storage (localStorage & sessionStorage)

This website uses your browser's storage for:

  • Wishlist (anonymous mode) — the account IDs you save are stored locally on your device. If you sign in with Google, your wishlist is synced to the server (the user_wishlist table) so it is available across devices.
  • Chat assistant history — if you use the on-site chat assistant, up to the last 30 messages of the conversation are kept in your device's localStorage so the conversation can continue.
  • History & display — accounts you viewed recently, the accounts you are comparing, a visit counter for the install-app (PWA) prompt, and other display flags (e.g. pop-ups you have closed). All of these are stored on your device; the account lists are used to load those accounts' details from our server when displayed.
  • Sell-account form draft (Mobile Legends) — unsent entries are kept in this tab's sessionStorage so they survive a reload. Valid for up to two hours and cleared when the tab closes.
  • Price calculator — your last inputs (rank, skin counts, etc.) are kept in localStorage so you don't have to re-enter them.
  • Cookie banner — a flag that you have dismissed the banner.

7. Cookies, Analytics & Advertising

This website uses the following technologies:

  • Google Tag Manager (GTM-N3PTSFRM) — a container that loads some of the tags below, including the Google Ads and Microsoft Clarity tags.
  • Google Analytics 4 (G-SFDK4RHBQK) — to understand how visitors use the site (pages, time on page, device, visit source, and events such as chat-button clicks). GA4 uses cookies (_ga, _ga_*) holding a random per-browser identifier. The data is pseudonymous, not anonymous: the identifier doesn't contain your name, but it links your visits together. If you order through the site checkout, the GA identifier is stored with the order and a purchase event may be sent to GA4 from our server. Google may estimate your general location from your IP address. You can opt out via the Google Analytics Opt-out Add-on.
  • Google Ads (AW-17982269181) — we use the Google Ads tag for two things. (1) Conversions: recording when a visitor presses a customer-service chat button, so Google can connect it to the ad click that brought them. (2) Remarketing: the tag adds your browser to a list of site visitors, so Google and its partners can show you ZenVan ads on other sites and apps based on your earlier visits. Google uses cookies for this (including _gcl_aw on our domain and cookies on Google/DoubleClick domains). If you came from an ad and then contacted us, pressed a chat button, submitted the sell-account form, or paid for an order on the site, we may send back to Google Ads only the ad click identifier, the conversion name, its time and (for paid orders) the order value, with no name, number, conversation content or form entries, so we know which ads bring in sellers or buyers. You can turn off personalised ads at adssettings.google.com. How Google uses data from partner sites: policies.google.com/technologies/partner-sites.
  • Meta Pixel — records page visits and events such as chat-button clicks to measure how well our Facebook/Instagram ads work, using the _fbp cookie. If we enable server-side measurement, purchase events may be sent to Meta together with a hashed (SHA-256) phone number. See Meta's privacy policy.
  • Microsoft Clarity — loaded through Google Tag Manager. Records interactions such as clicks, scrolling and cursor movement for heatmaps and session recordings, using the _clck and _clsk cookies. Clarity also syncs its identifier with a Microsoft cookie on the bing.com domain. See the Microsoft privacy statement.
  • ZenVan ad-bridge cookies (_zv_gclid, _zv_ref) — if you arrive from a Google ad, we store the ad click identifier and an 8-character reference code in these two cookies for 90 days, and record the reference-code-to-click pair (with the ad keyword and campaign) in the gclid_bridge table on our server. The reference code is appended to the chat message ("(ref: …)") and may be stored with sell-account form entries, so we can connect a chat or form to the ad click that brought it.
  • Visit-source cookie (zv_attr) — set when you arrive through a campaign, ad or referral link (or open an account/order page). It lasts 90 days and can only be read by our server. It holds the campaign parameters (UTM), the ad click identifier if any (gclid, gbraid, wbraid, msclkid), referring site, the first page you opened, a referral code if any, and the time. If the cookie already exists but holds no campaign parameters or click identifier, your next visit through an ad or campaign link updates it once. We read it when you place an order or submit the sell-account form, to record where the visit came from.
  • Last campaign-source cookie (zv_last) — set or updated every time you open our site through a link that carries campaign parameters (utm_source, utm_medium or utm_campaign) or one of the ad click identifiers listed below. It lasts 30 days and can only be read by our server. It holds the campaign parameters (utm_source, utm_medium, utm_campaign), one ad click identifier if any (gclid, gbraid, wbraid, msclkid, twclid, oppref, aleid), and the time — no referring site, no page, no IP address. We read it when you submit the sell-account form or place an order, to measure which promotion channel brings in sellers and buyers.
  • Other cookies — ref_code (referral code from a /r/… link, 7 days) and zv_currency (the display currency you chose in the currency picker, or the one set by an ad or campaign link that carries a currency parameter, 1 year).
  • Customer service: WhatsApp & Telegram — Our customer service runs on WhatsApp or Telegram, currently on Telegram. Chat buttons on the site open that app with a pre-filled message (including form entries and a reference code, if any). The chat message only reaches us after you press Send in the app. Sell-account form entries are different: we may receive and store a copy on our server when you press the form's button, before the chat opens (see section 1). On Telegram, our customer service is the account @zenvanstoree. Conversations are handled by WhatsApp (Meta) or Telegram under their own privacy policies: WhatsApp privacy policy · Telegram privacy policy.
  • Chat-button click log (cs_clicks) — when you press a customer-service chat button (other than the sell-account form's submit button, which is already covered in section 1), our server records that the button was pressed: which button and page (without URL parameters), the page language, the customer-service channel active at the time, the request type (sell, buy or other), the ad reference code and ad click identifier if you came from an ad (read from the cookies above), campaign parameters if any, a summary of device type, operating system & browser (not the full user-agent string), and a flag for whether the browser appears to be automated. No name, number, message content or IP address is stored. We use it to count how many people choose chat rather than the form, and only the ad click identifier, the conversion name and its time may be sent to Google Ads.
  • Supabase Auth (if you sign in with Google) — we store session cookies to keep you signed in:
    • sb-<project>-auth-token — session token (sameSite=lax; readable by this site's scripts because the in-browser sign-in client uses it)
    • sb-<project>-auth-token-code-verifier — PKCE verifier for the OAuth flow (only while signing in)
    The cookies are deleted when you click “Sign out”; otherwise they last until they expire (up to about 400 days).

The cookie banner on this site is a notice only: dismissing it does not switch any of the tools above on or off. How to opt out is in section 9.

8. Legal Basis for Collecting Data

Under Indonesia's Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP), we process your personal data on the following legal bases:

  • Consent (UU PDP Article 20(2)(a)) — for opt-in features such as Google sign-in, stock alerts (WhatsApp, Telegram or email), and marketing communication.
  • Performance of a contract (UU PDP Article 20(2)(b)) — to process account purchases, provide the ZenGuard™ warranty, and follow up on account-sale offers you send through the form (steps you request before an agreement is made).
  • Legal obligation (UU PDP Article 20(2)(c)) — where required by law enforcement or a valid court order.
  • Legitimate interest (UU PDP Article 20(2)(f)) — for fraud prevention and platform security, site analytics, and ad measurement and delivery (including remarketing). You can object to processing for analytics and advertising in the ways described in section 9.

9. Your Rights & How to Opt Out

  • Request access to the personal data we hold
  • Request correction of inaccurate data
  • Request deletion of your data at any time; data still needed for warranty, disputes or required by law is kept until that need ends
  • Delete your sell-account form entries — contact us on Telegram or by the email in section 11 at any time to request deletion of your sell-account form entries.
  • Stop stock alerts — send /stop to our Telegram bot, or contact customer service on Telegram or by email to remove your number from the subscriber list.
  • Clear your wishlist data at any time via your browser's localStorage settings
  • Delete your Google account link — contact customer service on Telegram to request deletion of your account and related data; we process it once the request is verified
  • Request that processing of your data be suspended or restricted, in proportion to the purpose of the processing
  • Obtain your personal data in a common, machine-readable format and transfer it to another data controller
  • Sue and receive compensation for violations in the processing of your personal data, in accordance with the law
  • Opt out of personalised ads — turn them off at adssettings.google.com (Google) and in the ad preferences of Meta's Accounts Center. This does not remove ads; it only stops tailoring them to your visits.
  • Opt out of analytics — install the Google Analytics Opt-out Add-on (it stops GA4 only, not the ad tags), or delete/block this site's cookies in your browser settings.
  • Object to the use of your data for non-essential purposes

10. Governing Language

This policy is written in Indonesian. Translations are provided for convenience. If the Indonesian version and a translation differ in meaning, the Indonesian version prevails.

11. Contact

The controller of personal data on this site is PT ZENVAN JAYA KAYA, a single-founder limited liability company (Perseroan Perorangan) operating ZenVan Store (Ministry of Law decree AHU-A125255.AH.01.30.Tahun 2026, NIB 2709260019928), represented by its director Muhammad Farizi, with the registered address Jl. Jaya Mangku, Loa Tebu, Tenggarong, Kutai Kartanegara Regency, East Kalimantan 75511, Indonesia. Email: enjifariz29@gmail.com.

Privacy questions can be sent via Telegram to @zenvanstoree.

© 2026 ZenVan Store · Questions? Contact us on Telegram