Privacy Policy

2.1 Information You Provide Directly

• Account Registration: Full name, email address, phone number, and password when you create an account.
• Order Placement: Delivery address (district, city, zip code), order contents, and payment details — payment is processed securely by our licensed payment partners; we do not store card numbers or mobile banking credentials.
• Profile Information: Any additional details you voluntarily add to your account profile.
• Communications: Messages you send via our contact form, email, or customer support channels.
• Product Reviews: Reviews or ratings you submit for products you have purchased.

2.2 Information from Social Login

If you choose to sign in using Google or Facebook, we receive limited profile information from those platforms as authorised by you. See Section 5 for full details on what is collected and how it is used.

2.3 Automatically Collected Information

• Log Data: IP address, browser type and version, operating system, referring URLs, pages visited, and time spent.
• Device Information: Device type, screen resolution, and language settings.
• Cookies & Similar Technologies: See Section 7 for details.

We use the information we collect to:

• Process, fulfil, and track your orders.
• Create and manage your customer account.
• Send order confirmations, shipping updates, and delivery notifications.
• Respond to your enquiries and provide customer support.
• Personalise your shopping experience and product recommendations.
• Send promotional emails and newsletters — only with your explicit consent and with an easy unsubscribe option in every email.
• Detect, prevent, and investigate fraudulent or unauthorised activity.
• Comply with our legal obligations under Bangladesh law.
• Improve and develop our website, products, and services.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We share your personal information only in the following limited circumstances:

4.1 Service Providers

• Pathao Courier: We share your name, phone number, and delivery address with Pathao Courier Ltd. to fulfil deliveries. Pathao's use of your data is governed by their own privacy policy.
• Payment Processors: Payment transactions are handled by licensed payment service providers (bKash, SSL Commerz, or similar). We do not retain full card or mobile banking credentials.
• Email Service Providers: We use third-party email platforms to send transactional and marketing emails on our behalf.
• Error Monitoring: We use Sentry for error monitoring, which may process anonymised diagnostic data.

4.2 Legal Requirements

We may disclose your information to law enforcement, regulatory authorities, or courts when required by applicable Bangladesh law, court order, or to protect the safety and rights of Kowsary, our customers, or the public.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email before your information becomes subject to a different privacy policy.

We offer the option to sign in to your Kowsary account using Google OAuth or Facebook Login. This section explains exactly what data we access and how we use it.

5.1 What Data We Receive

5.2 How We Use Social Login Data

• To create or authenticate your Kowsary account without requiring a separate password.
• To pre-fill your name and email address for your account and order records.
• The provider ID (Google/Facebook) is stored securely to identify your account on future sign-ins.
• We do not post to your social media accounts, access your messages, or read your social activity.

5.3 Revoking Social Login Access

You may revoke Kowsary's access to your Google or Facebook account at any time through your respective account settings (Google Account → Security → Third-party apps or Facebook → Settings → Apps and Websites). Revoking access does not delete your Kowsary account or order history — you can still log in by setting a password from your Account Security page.

5.4 Platform Policy Compliance

Our use of Google OAuth complies with the Google API Services User Data Policy, including the Limited Use requirements. Our use of Facebook Login complies with the Meta Platform Terms and Developer Policies. We do not use data obtained through these integrations for purposes beyond what is disclosed in this policy.

If you signed up or logged in using Facebook or Google and want your Kowsary account and personal data deleted, use either of the following methods:

1. Self-service: Log in to your Kowsary account, go to Settings → Profile, and use the Delete Account option. You will need to confirm with your account password — if you signed up via Facebook or Google and have not set a password yet, you can set one from the same page first.
2. By request: Email hello@kowsary.com from your registered email address with the subject line "Data Deletion Request." We will verify your identity and complete the deletion within 30 days.

Deletion permanently removes your profile information and Facebook/Google login identifiers from our systems, subject to the legal retention obligations described in Section 9 (e.g. order records retained for tax compliance under Bangladesh law).

We implement industry-standard security measures to protect your personal data:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using SSL/TLS (HTTPS).
• Password Hashing: Passwords are hashed using bcrypt — they are never stored in plain text.
• Access Controls: Only authorised personnel with a legitimate business need may access your personal data.
• Regular Security Reviews: We conduct periodic security assessments and vulnerability scans of our platform.
• Secure Infrastructure: Our servers are hosted in data centres with physical and logical access controls.

While we implement strong security measures, no system is 100% immune to breach. In the event of a data breach that poses a risk to your rights, we will notify you as required by applicable Bangladesh law.

We use cookies and similar technologies to provide, improve, and secure our services.

You can manage or delete cookies through your browser settings at any time. Note that disabling cookies may affect website functionality such as maintaining your login session or cart contents.

As a Kowsary customer, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at hello@kowsary.com. We will respond within 30 days.

We retain your personal information only for as long as necessary:

• Account Data: Retained while your account is active. Upon account deletion, personal data is deleted or anonymised within 30 days, unless law requires longer retention.
• Order Records: Retained for a minimum of 5 years in compliance with Bangladesh commercial and tax law requirements.
• Marketing Preferences: Retained until you opt out or request deletion.
• Log & Diagnostic Data: Retained for up to 12 months for security, debugging, and fraud prevention.

Our website and services are not intended for, nor directed to, individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a child under 18, please contact us immediately at hello@kowsary.com and we will promptly delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Update the "Effective Date" at the top of this page.
• Send a notification to the email address associated with your account.
• Display a prominent notice on our website for at least 30 days prior to the changes taking effect.

Your continued use of Kowsary after any changes take effect constitutes your acceptance of the revised policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:

This Privacy Policy is governed by and construed in accordance with the laws of the People's Republic of Bangladesh, including the Digital Security Act, 2018, the ICT Act, 2006 (as amended), and the Consumer Rights Protection Act, 2009. Any disputes shall be subject to the exclusive jurisdiction of the courts of Dhaka, Bangladesh.