Privacy Policy

This policy explains how bikrighor, operated by Agilo IT (“we”, “us”), handles personal data. There are two roles, and they matter:

• We are the controller of data about our own customers: the merchants and team members who create bikrighor accounts, visit our website and use the dashboard.
• We are a processor of data that merchants put into the platform about their customers, store visitors and the people they message. The merchant decides why and how that data is used and is its controller. See the Data Processing Addendum. If you are a shopper or messaged a store, that store’s own privacy notice applies first, and you should contact the store about your data.

From merchants and team members

• Account data: name, email address, password (stored only as a salted hash), phone number, role and permissions.
• Business data: store name, URL, address, business phone, logo and branding, tax and invoice details you enter.
• Billing data: plan, invoices and payment status. Card details are handled by our payment processors; we do not store full card numbers.
• Credentials you connect: access tokens and API keys for payment gateways, couriers, email/SMS providers and Meta channels.
• Support requests and the messages you send us.
• Technical data: IP address, device and browser type, pages and actions in the dashboard, error reports and security logs.

Processed for merchants (we hold this on the merchant’s behalf)

• Customer records: name, phone, email, delivery address, order and payment history, wishlist and cart activity.
• Orders, shipments, returns and reviews.
• Inbox data from connected channels: for Facebook Pages, Instagram professional accounts and WhatsApp Business numbers a merchant connects, we receive and store the messages, the sender’s name or handle and platform-scoped ID, message timestamps, and the photos, video or documents sent in the conversation.

When a merchant connects Messenger, Instagram or WhatsApp, Meta sends us the conversations for the accounts they chose and lets us send replies they write. We use this data only to:

• show those conversations to the merchant’s authorized team members in their inbox;
• send the merchant’s replies, templates and order-related messages to the person who wrote in;
• link a conversation to a customer record or order when the merchant asks us to;
• keep the inbox working: delivery status, read receipts, media storage and abuse prevention.

We do not sell this data, use it for advertising or to build profiles, share it with other merchants, or use it to train machine-learning models. Access tokens are encrypted at rest. A merchant can disconnect a channel at any time; see Data Deletion.

We do not sell personal data. We share it only with:

• Service providers that help us run the platform, under contract and only for our purposes. They are listed with their purpose in the sub-processor list.
• Services the merchant connects, such as a payment gateway, courier or Meta, when the merchant uses them through bikrighor. Their own privacy terms apply to what they receive.
• Authorities and advisers when the law requires it, to enforce our terms, or to protect rights, safety and security.
• A successor in a merger, acquisition or asset sale, with notice to you if your data becomes subject to a different policy.

We and our providers may process data in countries other than yours, including outside Bangladesh. Where the law requires safeguards for these transfers, we rely on contractual protections and the provider’s own compliance commitments.

• Account and store data: while your account is active, and for a limited period after closing it so you can export it.
• Merchant-controlled data (customers, orders, conversations, media): until the merchant deletes it or closes the account, then deleted or anonymized within a reasonable period, normally within 90 days.
• Channel access tokens: deleted immediately when a channel is disconnected.
• Billing and tax records: as long as the law requires them, which can be several years.
• Security and audit logs: for a limited period needed to investigate abuse and incidents.
• Backups: overwritten on our normal backup cycle after deletion.

Each merchant’s data is separated at the database level so one store cannot read another’s. Connections use TLS, credentials and channel tokens are encrypted at rest, passwords are hashed, and access is limited by role. We monitor for errors and abuse. No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security. Details are in the Data Processing Addendum.

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to certain processing, and to withdraw consent. To use these rights over data we control, email [email protected]. We may need to verify your identity first and will reply within 30 days.

If your data sits in a merchant’s store, for example you bought from or messaged a shop, send the request to that merchant. If you send it to us, we will pass it on and help the merchant respond. You can also contact your local data-protection authority if you think we have handled your data unlawfully.

You can opt out of marketing emails with the link in any message. Service and security emails cannot be turned off while you have an account.

We use cookies and similar storage to keep you signed in, protect the Service and remember preferences. See the Cookie Policy.

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children for our own purposes. If you think a child has given us data, contact us and we will delete it.

We may update this policy. We will post the new version here with a new effective date and, for material changes, tell merchants by email or in the dashboard.

Agilo IT, operator of bikrighor. Email [email protected] for privacy questions and requests.