Merchant HubENTRO.LY merchant Data Processing
Agreement
For enterprise customers, MCN partners, and agencies integrating with ENTRO.LY.Hailstone AI Innovations Limited · [email protected]
Introduction
This Data Processing Agreement ('DPA') forms part of the Terms of Service between Hailstone AI Innovations Limited ('ENTRO.LY', 'we', 'us') and you ('Controller') when you use ENTRO.LY services that involve the processing of personal data on your behalf.
This DPA is designed to comply with: GDPR (General Data Protection Regulation, EU/EEA), Indonesia's Personal Data Protection Law (UU PDP No. 27/2022), and applicable data protection laws in Hong Kong and the United States.
What Data We Process
| Data Category | Examples | Purpose | Retention |
|---|---|---|---|
| Creator account data | TikTok handle, email, commission history | Platform service delivery | Duration of account + 1 year |
| TikTok Shop & GO API data | Order IDs, commission amounts, product GMV | Commission tracking, Creator Score calculation | Duration of account + 90 days post-deletion |
| Payment data | Stripe tokens (no raw card data stored) | Pro subscription billing | Per Stripe's retention policy |
| Usage analytics | Anonymized page views, feature usage | Product improvement | 24 months rolling |
Creator account data
Examples
TikTok handle, email, commission history
Purpose
Platform service delivery
Retention
Duration of account + 1 year
TikTok Shop & GO API data
Examples
Order IDs, commission amounts, product GMV
Purpose
Commission tracking, Creator Score calculation
Retention
Duration of account + 90 days post-deletion
Payment data
Examples
Stripe tokens (no raw card data stored)
Purpose
Pro subscription billing
Retention
Per Stripe's retention policy
Usage analytics
Examples
Anonymized page views, feature usage
Purpose
Product improvement
Retention
24 months rolling
Data Transfers
Creator data is processed on servers located in Singapore (Supabase SEA region) and the United States (Vercel CDN). For Indonesian users, data transfers comply with UU PDP cross-border transfer requirements. For EU users, transfers are covered by Standard Contractual Clauses (SCCs).
Your Rights as Data Controller
- •Right to access your data: export available within the dashboard
- •Right to rectification: update via account settings
- •Right to erasure: submit deletion request to [email protected]
- •Right to data portability: CSV export available in dashboard
- •Right to object: contact [email protected]
Request a Signed DPA
Enterprise customers and MCN partners requiring a countersigned DPA for compliance purposes can request one by contacting [email protected]. We typically process DPA requests within 3 business days.
Need a countersigned DPA?
For enterprise customers, MCN partners, and agencies.
Contact: [email protected] · Response time: 3 business days
Request Signed DPA →