Privacy policy

This policy says what information we keep, why we keep it, who receives it, how long it stays, and what rights you have.

1. Who we are, and who this policy is for

• We are StallNow. Under the name StallNow, we provide software to build and run online shops.
• This policy is for: shop owners and staff; people who message us on WhatsApp about a sample shop; and visitors to our website (stallnow.com).
• If you buy from a shop, that shop is responsible for your data; we keep it on the shop's behalf. See that shop's "Privacy policy" page, and section 11 below.

2. At a glance

• Our website sets no cookies and collects nothing about you.
• To run shops, we keep owners' and staff members' names, mobile numbers and e-mail addresses.
• Customers' data belongs to the shop. We keep it for the shop; we never sell it or use it for our own promotion.
• Customers' money never passes through us.
• Section 5 lists which services receive data, and where they are.
• You can ask to see, correct or delete your data; we act within 30 days.

3. What we keep

• Owners and staff: name, mobile number, e-mail (if given), role; a password (if set) only in coded (hashed) form; the IP address and browser of each sign-in; a record of who changed what in the dashboard; which version of the terms and privacy policy you accepted, and when.
• Our bills: each bill (with the shop's name and the owner's name, phone and address), and the record of your payments, the transaction ID (TrxID) and the number you paid from.
• For a sample shop: the WhatsApp number, the photos and prices sent, the page name, and the shop built from them.
• Visitors to our website: nothing.
• Customers (for shops): name, phone, address, e-mail (if given), orders; the IP address and browser at the time of the order; which ad or link they came from; order-lookup codes (only in coded form); online payment transaction IDs; the courier's consignment number and delivery updates.

4. Why we keep it, and on what basis

• Opening accounts, signing in and running shops: to perform our agreement with you.
• Bills, receipts and payment records: to perform the agreement, and because the law requires records.
• Security (sign-in limits, known devices, the record of operators' actions): to perform the agreement, and legal duty.
• Building a sample shop: your consent (sending photos on WhatsApp and answering our questions). You can withdraw it at any time, and we then delete the sample shop.
• Service updates, billing SMS, and notices of changes to prices or terms: to perform the agreement.
• Customers' data: on the shop's instructions; the shop decides the basis.

5. Who receives it

• GreenWeb: sending SMS (order updates, verification codes, billing SMS); Bangladesh.
• Anthropic: drafting product names and descriptions from photos; United States. What is sent to them is deleted within 30 days (kept up to 2 years only if a breach of their rules is suspected), and it is not used to train their AI without permission.
• Meta: only for shops that turned on the Pixel or the Conversions API. Our WhatsApp conversations also run on Meta's service.
• bKash, Nagad, SSLCOMMERZ, Steadfast and Pathao: in the shop's own accounts, on the shop's instructions. If you pay our bill through bKash, bKash processes it as a transaction on our merchant account.
• Certificate authorities (Let's Encrypt, ZeroSSL): to run HTTPS, a shop's address is sent to them, and it appears in public certificate logs. Sample shops' addresses appear there too, even though they don't appear on Google.
• Government or courts: only on a written, lawful request (section 15).
• If we add a service, we update this list first and tell shops at least 30 days before.

6. Data outside Bangladesh

• Anthropic and Meta are in the United States or Ireland.
• We never collect national ID, passport, TIN or biometric data.

7. How long we keep it

• Everything stays while the account is open.
• A verification code works for 5 minutes and is deleted within 2 days.
• Carts stay 30 days.
• Ad-measurement events: 30 days once sent to Meta, 90 days otherwise.
• Unaccepted invitations are deleted 30 days after they expire.
• The raw records of courier updates stay 180 days.
• What is deleted from the database leaves the database backups within 30 days. The photo backup is separate: so that a mistaken deletion can be undone, photos deleted from a shop stay in it; only the photos of deleted sample shops leave it within 30 days.
• The sample shop's schedule is in section 4 of the terms.
• A closed shop's data is kept for at least 12 months after it closes; if we need to delete it after that, we tell the owner at least 30 days before.
• Bills, payment records and acceptance records stay 6 years after the account closes.

8. Cookies

• Our website (stallnow.com) has no cookies.
• The shop dashboard uses these necessary cookies:
• to keep you signed in (14 days);
• to remember your known device, so that no one can lock you out with wrong attempts (one year);
• to remember whether you sign in by mobile number or e-mail (one year);
• to remember your number between sending a code and the code page (ten minutes);
• to remember your language.
• Each shop's cookies are listed on that shop's "Privacy policy" page, which we write from the shop's settings.

9. Security

• HTTPS everywhere.
• Data is kept separate from shop to shop.
• Payment and courier credentials are encrypted and never sent to the browser.
• Passwords and verification codes are stored in the database only in coded form. To be sent by SMS, a code waits in a work queue for a few moments and is deleted once sent, or within an hour if sending fails.
• There are limits on sign-in attempts and on sending codes; if many wrong codes are entered for a number, signing in with it from a new device is paused and the number gets an SMS.
• Backups are made every night, in a separate place.
• Every action of our operators is written in the shop's activity record.
• Even so, no system is completely secure.

10. Your rights

• You can see your data and get a copy. A shop owner downloads the shop's data from the dashboard's "Download your data" page; for a copy of your own account's data, write to us as below.
• You can ask for wrong data to be corrected.
• You can ask for it to be deleted.
• You can withdraw consent.
• You can object to a decision made automatically by rule.
• How: WhatsApp 01303-451005, e-mail touch@stallnow.com. We may send a code to your number to check it's you. We act within 30 days.
• We cannot delete what the law requires us to keep (such as bill records); we tell you why.
• If you are not satisfied with our answer, you can complain to the National Data Management Authority.

11. What customers should do

• Tell the shop you bought from first; its contact details are on the shop's "Contact" page.
• If you get no answer within 7 days, write to us; we tell the shop and help.
• For complaints about a purchase you can also contact the Directorate of National Consumer Rights Protection (hotline 16121).

12. Children

• You must be at least 18 to open an account.
• Shops are not made for children. A shop will not knowingly collect data from anyone under 18 without a guardian's consent.

13. If data is breached

• Within 72 hours of finding out, we tell the shops or people whose data is involved, what happened and what we are doing.
• We tell the Authority as its rules require.

14. AI and decisions made automatically

• AI only drafts product names and descriptions; a person reads them before they are shown in a shop.
• Two decisions happen automatically by rule: limits on sign-in attempts, and closing a shop to customers when an unpaid bill's grace ends. Before the second, we tell you the date and time by SMS; a member of our team can pause it or reopen the shop at any time. If you object, tell us on WhatsApp.

15. Government requests

• On a written, lawful request, we give only what was asked for.
• We tell the shop involved unless the law forbids it.
• We keep a record of every request.

16. Changes to this policy

• We tell you at least 30 days before a change.
• Earlier versions are listed with their dates at the foot of this page.

17. Contact

• StallNow: WhatsApp 01303-451005, e-mail touch@stallnow.com.