Privacy policy

Last updated 2 August 2026

This policy explains what data Sentraway accesses from Google Merchant Center, why we access it, how we store it, how long we keep it, and how you remove it. It is specific to Sentraway and describes what the service actually does.

1. Who we are

Sentraway is operated by Ichsan Takwa, a sole proprietor based in Indonesia ("we", "us", "our"). Ichsan Takwa is the data controller for the data described in this policy. You can reach us at support@sentraway.com.

This policy covers the Sentraway website at sentraway.com and the Sentraway application.

2. What Google user data we access

When you connect your Google Merchant Center account, Sentraway requests exactly one Google OAuth scope:

https://www.googleapis.com/auth/content

This is the Google Merchant Center scope. Using it, Sentraway accesses:

Product data you have already submitted to Merchant Center — titles, descriptions, prices, images, product identifiers and other attributes
Product statuses, including whether each product is approved, disapproved or otherwise not eligible
Item-level issues recorded by Google, including the issue code, severity, affected attribute and Google's own description
The Merchant Center account ID of the account you connect

We request no other Google OAuth scopes. In particular we do not request access to your Google account profile, your email address, your Google Ads account or your Google Analytics data.

3. Why we access it

We access this data for one purpose: to diagnose and correct product disapprovals in your Google Merchant Center account.

We read your product data and product statuses to identify which products Google has disapproved or marked as not eligible, and to determine which item-level issue is responsible for each.
We read Google's item-level issue records so we can explain each issue to you in plain language, including its code, severity and the product attribute at fault.
We write corrections back to the specific product attributes causing a disapproval, so that Google can reprocess the product and it can start showing again.

We do not use your Google user data for any purpose other than providing this functionality to you.

4. What we never access

The Merchant Center scope does not give us access to, and we never collect:

Customer data of any kind
Order, transaction or fulfilment data
Payment, payout or banking data
Personal or contact information about your shoppers
Google Ads campaigns, budgets or performance data
Any Google service other than Merchant Center

5. How we store it

All data is stored on Google Cloud Platform infrastructure. Data is encrypted in transit using TLS and encrypted at rest.

OAuth tokens. Your refresh token is encrypted before it is written to our database, using a key held in Google Cloud Secret Manager and never stored alongside the data it protects. Tokens are never written to application logs, never included in error messages and never committed to source control.
Product data. Product data and status data retrieved from Merchant Center are stored in an access-controlled database used solely to render your dashboard and to determine which corrections to apply.
Access control. Access to production systems is restricted to Ichsan Takwa and protected by Google Cloud identity and access management.

6. How long we keep it

While your account is connected, we retain your product data and product statuses so the service can function.
OAuth tokens are revoked with Google and deleted from our systems immediately when you disconnect.
Product and status data are deleted within 30 days of you disconnecting your account or requesting deletion.
Diagnostic logs, which record that a request happened but contain no product data and no tokens, are retained for up to 30 days and then deleted.

7. We do not sell or share your Google user data

We do not sell, rent, trade or otherwise transfer your Google user data to any third party. We do not share it with data brokers, advertisers, analytics providers or AI vendors.

The only third party involved in processing your data is Google Cloud Platform, which hosts our infrastructure and processes data on our instructions as our sub-processor. No other party receives your Google user data. We will disclose data only where we are legally required to do so by a valid legal process, and we will notify you unless prohibited by law.

8. We do not use your data for advertising or AI training

We do not use your Google user data for advertising, ad targeting or audience building. We do not use it to develop, improve or train machine learning or artificial intelligence models, whether ours or anyone else's. We do not create profiles of you or your customers.

9. Limited Use disclosure

Sentraway's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. How to revoke access and request deletion

You can end our access to your data at any time:

From inside Sentraway — use the disconnect control in the application. This revokes our access token with Google and deletes the data we hold about your account.
From your Google Account — visit myaccount.google.com/permissions, select Sentraway and remove its access.
By email — write to support@sentraway.com and ask us to delete your data. We will confirm deletion within 30 days.

You may also ask us for a copy of the data we hold about you, or ask us to correct it, using the same address.

11. What this website collects

The Sentraway website sets no cookies, runs no analytics or tracking scripts, embeds no advertising pixels and loads no third-party fonts or scripts. Our hosting provider records standard server request logs, which may include IP address, user agent and requested URL, for security and reliability purposes. These logs are retained for up to 30 days.

If you email us, we keep your message and address so we can reply to you.

12. Security

We encrypt data in transit and at rest, encrypt refresh tokens with a separately held key, restrict production access, and keep our dependencies current. No system is perfectly secure, but we take these measures seriously and will notify affected users promptly if a breach affecting their data occurs.

13. International transfers

We operate from Indonesia and host on Google Cloud Platform infrastructure located in the United States. If you are located elsewhere, your data will be transferred to and processed in these locations.

14. Children

Sentraway is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

15. Changes to this policy

If we change this policy we will update the "last updated" date above. If a change materially affects how we handle your Google user data, we will notify connected users by email before it takes effect.

16. Contact

Questions, access requests and deletion requests all go to support@sentraway.com.

Ichsan Takwa
Indonesia