Privacy policy

This Privacy Policy describes how Biponik (“we”, “us”, “our”) collects, uses, discloses, and safeguards information when you use our platform, websites, and related services (collectively, the “Services”). By using the Services, you agree to this policy. If you do not agree, please do not use the Services.

1. Who this applies to

We process information about:

• Merchants, individuals or businesses that register for an account, subscribe to a plan, and operate an online store on our platform.
• End customers, people who browse or buy from a merchant’s storefront, create a customer account, or interact with checkout and support.
• Visitors, anyone who visits our marketing site or central portal without yet creating an account.

2. Information we collect

2.1 Information you provide

• Account and profile data: name, email address, phone number, business name, billing address, and authentication credentials (passwords are stored using strong one-way hashing).
• Payment-related data: subscription payments may be processed by third-party providers (e.g. bKash, SSLCommerz). We receive limited confirmation data (transaction IDs, status, amounts) as required to activate or renew your subscription, not your full card or wallet credentials, which are handled by the payment provider under their terms.
• Communications: messages you send to support, feedback forms, or email.
• Store content: product listings, images, descriptions, and settings you upload to your store, stored to provide the Services.

2.2 Information collected automatically

• Technical data: IP address, browser type, device type, approximate location derived from IP, timestamps, and pages or endpoints accessed.
• Cookies and similar technologies: used where necessary for security, session management, and (where enabled) analytics or preferences.
• Logs: application and server logs for security, debugging, and abuse prevention.

2.3 Information from merchants about their customers

When an end customer shops with a merchant using our platform, the merchant is responsible for how they use that data. We process such data on behalf of the merchant to operate the storefront, orders, and related features, in line with this policy and our agreement with the merchant.

3. How we use information

We use personal information to:

• Provide, maintain, and improve the Services (hosting stores, checkout, admin tools, APIs).
• Create and manage accounts; authenticate users; process subscriptions and renewals.
• Send service-related notices (e.g. security alerts, billing receipts, policy updates where required).
• Detect, prevent, and investigate fraud, abuse, spam, and security incidents.
• Comply with legal obligations and respond to lawful requests from public authorities.
• Analyze aggregated or de-identified usage to improve performance and user experience.

4. Legal bases (where applicable)

Depending on your jurisdiction, we rely on one or more of: performance of a contract, legitimate interests (e.g. securing the platform), consent (where required), and legal obligation.

5. Sharing and disclosure

We do not sell your personal information. We may share information:

• Service providers, infrastructure, email delivery, payment gateways, and security vendors, under strict confidentiality and data-processing terms.
• Merchants vs. end customers, order and customer data necessary to fulfil purchases is available to the relevant merchant through their admin tools.
• Legal and safety, when required by law, court order, or to protect rights, safety, and integrity of users and the Services.
• Business transfers, in connection with a merger, acquisition, or asset sale, subject to appropriate safeguards.

6. International transfers

Data may be processed in Bangladesh and other countries where we or our subprocessors operate. We take steps designed to ensure appropriate safeguards consistent with applicable law.

7. Data retention

We retain information for as long as needed to provide the Services, comply with law, resolve disputes, and enforce agreements. Retention periods vary by data type (e.g. billing records may be kept longer for tax and accounting). When data is no longer required, we delete or anonymize it in line with our internal procedures.

8. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, monitoring, and secure development practices. No method of transmission or storage is 100% secure; we encourage strong passwords and safeguarding your account credentials.

9. Your rights and choices

Depending on applicable law, you may have the right to access, correct, delete, restrict, or object to certain processing, and to data portability. You may withdraw consent where processing is consent-based. To exercise rights, contact us using the details below. You may also lodge a complaint with a supervisory authority where applicable.

Marketing emails, where sent, include an unsubscribe option where required by law.

10. Mobile applications

We publish Android applications, the Biponik Merchant app for store owners and staff, and optional customer apps for individual stores. This section describes what those apps do in addition to the practices above.

10.1 What the apps collect

• Sign-in details, the store domain, email address, and password you enter to sign in. Credentials are sent over HTTPS to your own store and are never stored in plain text on the device.
• Session token, kept on the device so you are not asked to sign in on every launch. Removing it is as simple as signing out or uninstalling the app.
• Push notification token, a Firebase Cloud Messaging (FCM) identifier issued by Google, used only to deliver order and account notifications to your device. It is not an advertising identifier and is not used for tracking or profiling.
• Store data you view, orders, products, and reports are fetched from your own store to display in the app. They are not copied to any separate database of ours.

10.2 What the apps do not collect

• No location data, contacts, photos, microphone, or camera access is requested.
• No advertising identifiers, and no data is sold or shared with advertising networks.
• Biometric unlock, where you enable it, is handled entirely by Android. Your fingerprint or face data never leaves the device and is never transmitted to or seen by us.

10.3 Permissions

The merchant app requests only: internet access, notification delivery, biometric unlock (optional, used solely to lock the app), and permission to restore notifications after a device restart.

10.4 Deleting your account and data

You can request deletion of your account and associated data at any time. See Account & data deletion for what is deleted, what is retained, and how to make a request.

11. Children’s privacy

The Services are not directed at children under the age required by local law to consent to data collection. We do not knowingly collect personal information from children inappropriately. If you believe we have, please contact us and we will take steps to delete such information.

12. Third-party sites

Our Services may link to third-party websites or services. We are not responsible for their privacy practices. Please read their policies before providing information.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated “Last updated” date. Material changes may be communicated by email or a notice on the Services. Continued use after changes constitutes acceptance where permitted by law.

14. Contact

For privacy questions or requests regarding this policy, contact your platform administrator or the contact details published by Biponik on the central website.