Privacy
This notice describes data the hosted Ongapi service processes for developer accounts and order sync.
Account data
We store your email, a password hash or Google sign-in subject, session cookies, and API key hashes. Plaintext API keys are shown once at creation.
Shop and order data
For each connected shop we store platform, region, shop id, and encrypted marketplace tokens. Canonical orders may include buyer contact and shipping fields supplied by the marketplace. API responses, outbound webhooks, and logs must not include marketplace access tokens.
Billing
Stripe stores card and invoice data when you start a paid subscription. Ongapi stores your Stripe customer id, plan, and subscription status.
Retention
Event log retention: Sandbox 24 hours; Starter 7 days; Growth 14 days; Scale 30 days. Canonical orders and buyer fields are kept for the life of the developer account. There is no automatic calendar deletion of order rows. Disconnecting a shop stops new ingest for that connection and does not delete historical orders. Email support@ongapi.com to delete an account, or the orders and delivery records for a connection. We complete verified deletion requests within 30 calendar days of receiving your email.
Location and transfers
We host the API and database on Railway (United States). The marketing site is served by Vercel. DNS is managed on Cloudflare. Data may be processed in these regions and in countries where our sub-processors operate. We use standard contractual safeguards where required for cross-border transfers.
Security incidents
If we become aware of a personal data breach likely to affect your account, we will notify you without undue delay and describe steps we are taking, consistent with applicable law.
Roles
Creai Technology is the controller for developer account data. For buyer name, phone, and address, Ongapi processes that data on the developer's instructions. The developer is responsible for telling its end users how that data is used.
Sub-processors
We use Railway for API hosting and the database, Vercel for the marketing site and console UI, Cloudflare for DNS, Google for optional Google sign-in, Stripe for payments, and Resend for account email. Connected shops also send data through Shopee, TikTok Shop, Lazada, and Shopify.
Buyer personal data
Buyer and shipping fields stay with the shop connection so we can sync orders and send webhooks. They remain until you ask us to delete them. Disconnecting a shop stops new sync for that connection and does not erase stored orders. Email support@ongapi.com to delete the orders and delivery records for that connection.
Your rights under the PDPA 2010
Email support@ongapi.com to request access, correction, or deletion of your personal data. We reply within 21 days.
Company
Ongapi is operated by Creai Technology, registration no. 202503145737 (003735650-V), E17-07 Edumetro, Taman Subang Permai, 47500 Subang Jaya, Selangor, Malaysia. Contact support@ongapi.com.