Privacy Policy

Account and billing

Name, email address, password (stored only as a one-way hash by our authentication provider), business name, industry, business model, currency, timezone, phone or WhatsApp number, and your chosen interface language. For paid plans, the subscription tier, credit balance and transaction references. Card and mobile-wallet credentials are entered directly on the payment provider’s systems and are never stored on ours.

Business content you create

Products, services, prices and cost prices, orders, bookings, invoices, customers and leads, suppliers, stock movements, cashflow records, uploaded images and files, website content, and anything else you enter or import. This is your business record. We hold it so the Platform can show it back to you.

Data about the people you serve

Where your customers order, enquire or book through a site or channel you have connected, we store the details that transaction requires — typically name, phone, email and delivery address — because you need them to fulfil the order. We do not use this data for our own purposes, we do not sell it, and we do not use it to advertise to those individuals.

Advertising measurement

When you run advertising through the Platform, each ad carries a tracking parameter. A visit arriving on your website with that parameter is recorded so the resulting sale can be attributed to the ad that produced it. That record holds the campaign identifiers, the landing page, a coarse device type (mobile, tablet or desktop), the country supplied by our network provider, and the visitor’s IP address stored only as an irreversible SHA-256 hash. We do not store the raw IP, we do not build a profile of that visitor, and the record is used only to tell you which of your ads made money.

Website visit statistics

Websites published with the Platform report how they are used, so the business that runs the site can see its own visitors: the pages viewed and for how long, the products looked at or added to a basket, whether an order was placed, a tap on a call, WhatsApp or email button, how the visitor arrived (for example a search engine, a social network or an ad), the type of device and browser, and the town, region and country supplied by our network provider for the request. Each browser is given a random identifier stored on that device; no cookie is set, no IP address is stored in any form, and no name, phone number or address is collected while somebody browses. These statistics are shown only to that business and are never used by us to advertise to anyone. A visitor can stop their browser being counted by opening the site once with ?ax_notrack=1 added to its address.

Technical and usage data

Log data needed to run and secure the service: IP address, browser and device information, pages requested, timestamps, and error diagnostics. Feature usage and credit consumption are recorded so we can bill accurately and show you your own usage history.

What we deliberately do not collect

We do not collect biometric data, government identity numbers, precise geolocation, or special-category data (health, religion, political opinion, sexual orientation) about you or your customers. If you enter such data into a free-text field, you do so as controller and on your own legal basis.

This section applies only if you choose to connect a Facebook, Instagram or WhatsApp account. Nothing here happens otherwise.

Connecting is an explicit, revocable grant made on Meta’s own consent screen. We never ask for your Facebook password and we never see it. What we receive, and why:

• Your Pages and linked Instagram accounts — so the AI assistant can reply to customers who message you there.
• Messages from customers on those channels — to read the question and send the answer. They are stored in your workspace as your conversation history.
• Your advertising accounts — to create the campaigns you ask us to create, and to read back what they spent and how they performed.
• An access token — held encrypted at rest on our servers, never sent to a browser, never shown to you or to anyone else, and used only for the actions above.

You can disconnect at any time from the dashboard, or from Facebook Settings → Business Integrations. Disconnecting deletes the stored token immediately. See Data Deletion.

We do not sell personal data, and we never have.

We use the vendors below. Each is bound by contract to process data only on our instructions and to protect it. Some are outside Bangladesh; transfers rely on the vendor’s own standard contractual clauses or equivalent safeguards.

Beyond these, we disclose data only where the law requires it, or to a successor entity in a merger or acquisition — in which case this Policy continues to apply until you are given notice of a change.

AI features send the relevant text to a model provider through OpenRouter. For a campaign strategy, for example, that includes your product names, prices, cost prices and recent sales totals — because those are exactly the numbers the answer must be built from.

That text is used to produce your answer and nothing else. It is not used to train models. We do not send your customers’ names, phone numbers or addresses to a model unless a feature you invoked plainly requires it — the AI assistant answering a customer’s message being the obvious case.

AI output can be wrong. It is a draft for you to check, not advice, and you remain responsible for anything you publish or send.

• Your business records — for as long as your account is open. You can delete individual records at any time.
• After you close your account — deleted within 30 days, except where we must keep something longer to meet a tax or legal obligation.
• Third-party tokens — deleted the moment you disconnect.
• Advertising visit records — 24 months, after which they are of no analytical use.
• Website visit statistics — a summary of each visit for 13 months; the individual steps of a visit for 90 days.
• Billing and audit records — as long as accounting and tax law requires.
• Backups — overwritten on a rolling cycle; a deleted record disappears from backups as that cycle completes.

Depending on where you live you may have the right to access your data, correct it, delete it, receive a portable copy, object to or restrict processing, and withdraw consent. Exercising any of them costs nothing and will never result in worse service.

Much of this is immediate and self-service: everything in your workspace can be viewed, edited, exported and deleted from the dashboard. For anything else, write to [email protected]. We reply within 30 days.

If you are one of our customer’s customers and want your data removed, contact that business directly — it is their record and they control it. If you cannot reach them, write to us and we will pass the request on.

• Encrypted in transit (TLS) and at rest.
• Every workspace is isolated by database-level Row Level Security, so one customer’s query cannot reach another’s data even if application code is wrong.
• Third-party tokens are held server-side only and are never included in any response sent to a browser.
• Visitor IP addresses in advertising records are stored hashed, never in the clear.
• Access to production data is limited to staff who need it, and is logged.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant authority without undue delay. Report a vulnerability to [email protected].

We use cookies that are strictly necessary — keeping you signed in, remembering your theme and language, and protecting against cross-site request forgery. We do not run third-party advertising cookies on the Platform itself.

Websites you publish with the Platform may load analytics or advertising pixels that you configure. Those are your responsibility as that site’s operator, including any consent banner your market requires.

The Platform is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child’s data has reached us, write to [email protected] and we will delete it.

We will post any change here with a new version number and date. If a change materially reduces your privacy, we will tell you before it takes effect — by email or in the dashboard — so you can object or close your account.