Privacy Policy
BizSyncBD (“we”, “us”) is a Shopify app that helps online stores in Bangladesh run cash-on-delivery sales: a COD checkout, courier delivery-history checks, fraud blocking, courier booking and tracking, SMS, printable invoices and labels, and ad-event reporting. This policy explains what information we handle, why, who we share it with and what choices people have.
Who this covers
- Merchants – store owners and staff who install the app.
- Shoppers – people who buy from a merchant's store. For a shopper's information, the merchant decides why and how it is used and we process it on the merchant's behalf. If you are a shopper and want to see, correct or delete your information, please ask the store you bought from; we will help them carry out your request.
Information we handle
From merchants
- Shop details that Shopify provides when the app is installed: store domain, store name, store email, and the access token Shopify issues to the app.
- Web-dashboard logins that the merchant creates: a user name and a password, which we store only as a bcrypt hash.
- Settings the merchant chooses, including the credentials for couriers, bKash and ad platforms. These are stored encrypted (AES-256-GCM).
- Billing is handled by Shopify. We receive the plan status. We never see card details.
From shoppers, through the merchant's store
- Order details: name, phone number, delivery address, email (if given), items, amounts, notes and payment method.
- For COD orders placed through our checkout: IP address, browser (user agent) and a device identifier, used for fraud blocking.
- Ad-click identifiers when a shopper arrives from an ad (for example Meta fbclid and _fbp, TikTok ttclid and _ttp, Google gclid and analytics identifiers), kept in first-party cookies on the store for up to 90 days.
- Abandoned checkouts: if a shopper types a name, phone number or address into the COD form but does not place the order, we save what was typed so the merchant can follow up.
- Courier delivery history: for phone numbers on orders we ask the merchant's connected couriers for the delivery statistics they hold for that number. We keep the answer so it need not be fetched again, and the same saved answer can be reused when another store checks the same number.
Technical
- Request and error logs, kept for a short time (see below).
How we use it
- To run the features the merchant has switched on.
- To assess order risk and block repeat offenders according to the rules the merchant sets.
- To book parcels with couriers and read their status updates.
- To send the SMS messages the merchant sets up.
- To report purchases to Meta, TikTok and Google when the merchant connects them.
- To give support, keep the service secure and prevent abuse, and to meet legal duties.
We do not sell personal information, and we do not use shoppers' information for our own advertising.
Who we share it with
Merchants choose which of these services are switched on.
| Service | Why | What is sent |
|---|---|---|
| Shopify | To run the app: reading and updating orders, customers and products, and billing. | Store data and orders through Shopify's own interfaces. |
| Couriers you connect (Steadfast, Pathao, CarryBee) | To book and track parcels, and to check a phone number's delivery history. | Recipient name, phone, address and cash-on-delivery amount when booking; the phone number when checking history. |
| bKash | Only if you turn on bKash payments. | Amount, invoice reference and the customer's phone number to start a payment. |
| SMS service | To send the messages you set up. | Message text and the recipient's number, passed through our own SMS service to a bulk-SMS provider in Bangladesh. |
| OpenAI | Only when you use the AI order-reading tool. | The customer message you paste in, which may contain a name and address, so the order fields can be pulled out. Nothing else is sent. |
| Meta, TikTok and Google | Only if you connect them, to report purchases for your ads. | Order value and items, a hashed phone number or email, IP address, browser details and the ad-click identifiers. |
| IP-location services (ipwho.is, ipapi.co) | To estimate the country, region, city and internet provider behind an order's IP address, for fraud blocking. | The IP address only. |
| Hosting (Contabo) | To run the servers. | Everything we store, on servers in Mumbai, India. |
We may also disclose information when the law requires it or to protect people from fraud or harm.
Where it is stored
Our servers are hosted by Contabo, in Mumbai, India. Some of the services listed above process information in other countries.
How long we keep it
- Orders, customers and settings: while the app is installed. When a store uninstalls, we stop using its data; Shopify then sends us an erasure request 48 hours later and we delete the store's data. A store that reinstalls before then finds its history still there.
- Ad-event history: 180 days. Hourly event counts: 400 days.
- Invoice and label files: deleted after about 24 hours.
- Checkout diagnostic events: 14 days. Request logs: 7 days. Database performance logs: 14 days.
- Customer erasure: when Shopify tells us a customer asked to be erased, we remove that customer's personal details from the store's order records, delete the customer record and the device and IP records tied to their orders, and delete the saved courier answers for their phone number.
Security
All traffic uses HTTPS. Stored credentials are encrypted, dashboard passwords are hashed, and requests that claim to come from Shopify are checked by signature. Access to our servers is limited to us. No system is perfectly secure, so we cannot promise absolute security.
Cookies and browser storage on a merchant's store
The checkout script keeps a few first-party values in the shopper's browser: the ad-click identifiers above (cookies), a device identifier used for fraud protection (kept until the shopper clears the browser's storage), and the form entries for the current visit (cleared when the tab closes). If the merchant connects Meta, TikTok or Google, those companies' tags also load on the store. Merchants are responsible for any cookie notice their store needs; the app does not show one.
Your rights
You may ask to access, correct or delete your information, or to object to how it is used. Shoppers should ask the store first. Merchants can write to us at support@bizsyncbd.com. We answer within 30 days.
Children
The service is for businesses and is not aimed at children.
Changes to this policy
If we change this policy we will update the date above and, for material changes, tell merchants in the app or by email.
Contact
BizSyncBD, Bangladesh
support@bizsyncbd.com