Privacy policy

1. Data we collect

Account data: name, email address, phone number, password hash, brand details and billing contact.

Payment data: the transaction records you create (invoice details, amounts, customer names and contact details) and the MFS confirmation messages that your devices forward to us.

Technical data: IP address, browser type, session metadata, device identifiers for SMS-forwarding devices, and API request logs.

2. What we do not collect

NaklaPay never receives your bKash, Nagad or Rocket PIN, OTP or wallet password. The SMS forwarder transmits only the text body of transaction messages.

We do not store full card numbers, because NaklaPay is not a card processor.

3. Why we use it

We do not sell personal data, and we do not use merchant transaction data to train advertising models.

• To operate your workspace: verifying payments, matching transactions, sending notifications.
• To secure accounts: detecting abuse, enforcing rate limits, keeping audit logs.
• To provide support and respond to your requests.
• To send service announcements and, if you opt in, product updates.

4. Sharing and processors

We use a small number of service providers to run the platform: cloud hosting, email delivery and error monitoring. Each is bound by a data-processing agreement and may only process data on our instructions.

We may disclose data where required by Bangladeshi law or a valid legal order, and we will notify the account owner unless prohibited from doing so.

5. Retention

Transaction and audit records are retained for the life of the workspace plus 24 months, so that year-over-year reporting remains possible.

Contact-form messages are retained for 12 months. Deleted workspaces are purged from live systems within 30 days and from backups within 90 days.

6. Your rights

You may request access to, correction of, export of or deletion of personal data by emailing info@naklashop.com from the account email address. We respond within 30 days.

Self-hosted customers control their own database; data requests should be directed to the operator of that installation.

7. Cookies

We use one essential cookie for your signed session and one to remember the active brand. We do not run third-party advertising cookies on the dashboard.