Privacy Policy

Merchants and shoppers

We handle data for two kinds of people, in two different roles:

• Merchants are the businesses that use eCommFly to run a store, and the team members they invite. We decide how merchant data is used, so we are responsible for it.
• Shoppers are the people who visit and buy from those stores. Each store decides what it collects from its shoppers and how it uses it. We store and process that data on the merchant's behalf, following their instructions and settings.

If you're a shopper, the store you bought from is the right place to start with a question about your data. Their own privacy policy applies to you, and we help merchants answer requests from their shoppers.

What we collect from merchants

• Account details: your name, email address, phone number and password, or your name and email from Google if you sign in with Google.
• Store details: your store name, domain, products, pages, settings and the team members you add.
• Connected services: the details you enter to connect payment gateways, couriers, ad pixels, Facebook pages, WhatsApp and the Telegram, Slack or Discord channels you send alerts to.
• Billing: your plan, your store balance and its top-ups. Top-ups are paid through shurjoPay; we receive the payment's result, not your card or wallet details.
• Support: what you send us by email, phone, Telegram or chat.
• Usage and device data: your IP address, browser and device, and logs of how the dashboard and app are used, which we need to keep the service running and secure.
• The merchant app: for each phone you sign in on, whether it is Android or iOS, its name, its operating system and app version, and a push token that lets us send notifications to it. If the app crashes or hits an error, it sends a crash report with what went wrong, the phone's model, operating system and app version, and an ID for that installation of the app. Crash reports don't include your name, email or store data.

What stores collect from shoppers

Depending on how a store is set up, it may collect:

• Contact and delivery details: name, phone number, email address and billing and delivery addresses.
• Orders: what was bought, prices, the delivery option, the payment method and order notes.
• Accounts: if a shopper creates an account, their login details, wishlist and reviews. Shoppers can also sign in with Google.
• Checkouts that are not finished: once a shopper types a valid phone number or email at checkout, the form is saved as they type, so the store can follow up even if no order is placed.
• Messages: conversations with the store through Facebook Messenger or WhatsApp, if the store has connected them.
• Order confirmation calls: if the store uses automated calls, the number called, when the call was answered and ended, and the key the shopper pressed. Calls are not recorded.
• Device data: IP address, its approximate location, browser and device.

How we use data

• To run eCommFly and the stores on it: taking orders and payments, booking deliveries and sending the order emails and SMS each store turns on.
• To check orders for fraud when a store asks us to, by looking up a phone number's delivery history with couriers.
• To bill merchants and keep records of payments.
• To give support and tell merchants about changes to their account or the service, including by push notification in the merchant app.
• To find and fix crashes and errors in the merchant app.
• To keep eCommFly secure, prevent abuse and meet our legal obligations.
• To understand how eCommFly is used, so we can fix problems and improve it.

We do not sell personal data, and we do not use shoppers' data to advertise to them on our own behalf.

Who we share data with

We share data only with the services needed to run eCommFly, or that a merchant chooses to connect:

• Hosting and storage: the cloud servers and file storage that host eCommFly and store media.
• Email and SMS: our email delivery provider and MiM SMS, to send account emails and the messages stores send to shoppers.
• Payment gateways: bKash, Nagad, SSLCommerz, shurjoPay and PayStation, when a store accepts payments through them, and shurjoPay for top-ups to a store balance.
• Couriers: Pathao, Steadfast, RedX, Carrybee and eCourier, when a store books a delivery. They receive the delivery details.
• Fraud checks: BDCourier, which receives a shopper's phone number to return its delivery history.
• Meta and TikTok: when a store turns on their pixels, server-side events or catalog feed, and Meta for a store's Messenger and WhatsApp conversations.
• Google: for signing in with Google, and Google Analytics on our own website.
• Firebase: Google's Firebase Cloud Messaging, which delivers push notifications to the merchant app using its push token, and Firebase Crashlytics, which receives the app's crash reports.
• Alerts and AI assistants: the Telegram, Slack or Discord channels a merchant connects for store alerts, and AI assistants such as Claude, ChatGPT or Cursor that a merchant connects to their store.

We may also share data if the law requires it, to protect people or the service from harm, or as part of a merger or sale of our business, in which case this policy will continue to apply.

Cookies

The eCommFly dashboard and stores use cookies to keep you signed in, remember your cart and keep the service secure. Our website, ecommfly.com, also uses Google Analytics cookies to count visits and see which pages are useful.

Stores may add their own tracking, such as the Meta or TikTok pixel, through their settings. You can block or delete cookies in your browser, though signing in and checking out need them.

How long we keep data

• Account and store data is kept while the account is open.
• When a merchant deletes a store, it is permanently deleted, with all its data and media files, 7 days later.
• Checkouts that were not finished are deleted 90 days after they were last updated.
• Logs of webhooks sent and received are deleted after 60 days.
• A phone's details and push token are deleted when you sign out of the merchant app on it. A push token is also removed as soon as Firebase tells us it no longer works, for example because the app was uninstalled.
• Crash reports are kept by Firebase Crashlytics for up to 90 days.
• Billing records are kept for as long as the law requires.

Security

Data travels between your browser and eCommFly over encrypted HTTPS connections, passwords are stored hashed rather than in plain text, and access to personal data is limited to the people and services that need it. No service is completely secure, so if you think your account has been compromised, tell us straight away.

Your choices and rights

Merchants can see and change most of their data in the dashboard, and delete a store at any time. You can turn off the merchant app's push notifications in your phone's settings, and signing out of the app on a phone stops them on that phone. You can also ask us for a copy of your data, to correct it, or to delete your account by emailing hello@ecommfly.com.

Shoppers should contact the store they bought from to see, correct or delete their data. If you can't reach the store, email us and we'll pass your request on.

Data outside Bangladesh

Some of the services we use, such as hosting, email and Meta, may store or process data outside Bangladesh. When they do, we use providers that protect it to a standard consistent with this policy.

Children

eCommFly is for businesses, and merchant accounts are for people aged 18 or over. We do not knowingly collect data from children for our own purposes.

Changes to this policy

We may update this policy as eCommFly changes. We will change the date at the top when we do, and tell merchants about significant changes by email or in the dashboard.

Contact us

Email hello@ecommfly.com, or see our contact page for other ways to reach us.

Our office: 23/2 Sel Huq Sky Park (Level-4), Shaymoli, Dhaka - 1207.