Privacy Policy

1. Who we are

FcommerceBD is operated by [LEGAL COMPANY NAME], [REGISTERED ADDRESS], Bangladesh. For any privacy question, contact support@fcommercebd.net.

2. Information we collect

• Account information — your name, email address, phone number and business name.
• Business data you enter — products, prices, orders, invoices, expenses, suppliers and customer records including customer names, phone numbers and delivery addresses.
• Facebook data — when you connect a Page, we store the Page ID, name, category, profile picture, follower count, and the access tokens needed to publish on your behalf.
• Usage data — logs of actions taken in the dashboard, used for support and abuse prevention.

3. How we use it

We use your data to operate the service: to display your dashboard, publish posts you create to your connected Page, send SMS campaigns you initiate, pass delivery details to your chosen courier, process subscription payments, and provide support.

4. Facebook permissions

We request the minimum permissions needed to publish on your behalf: pages_show_list to list the Pages you manage, pages_read_engagement to read basic Page details, and pages_manage_posts to publish posts you create. We never post without your action, and we never read your personal profile, friends or private messages. Access tokens are encrypted at rest and are never exposed to the browser.

5. Sharing your data

We do not sell your data. We share it only with the service providers needed to deliver the features you use: Meta (Facebook publishing), your SMS gateway, courier partners you select such as Steadfast, and payment providers such as bKash and SSLCommerz. Each processes data under its own terms.

6. Your customers' data

Customer records you store belong to you. We process them on your behalf. You are responsible for having a lawful basis to collect and use them, including consent for SMS marketing.

7. Retention and deletion

We keep your data while your account is active. You can delete individual records at any time from the dashboard. Disconnecting a Facebook Page immediately deletes the stored tokens for that Page. To delete your entire account and its data, email support@fcommercebd.net and we will action it within 30 days.

8. Security

Data is transmitted over HTTPS and access tokens and payment credentials are encrypted at rest. No system is perfectly secure; we ask that you use a strong, unique password and control who you invite as staff.

9. Your rights

You may request a copy of your data, ask us to correct inaccurate information, or ask us to delete your account. Contact support@fcommercebd.net.

10. AI assistant connections

You can connect an AI assistant you already use — such as ChatGPT or Claude — to your FcommerceBD store, and then manage the store by chatting. This is optional: everything works from the dashboard without it.

• How you connect. The assistant opens a FcommerceBD sign-in page. You sign in with your FcommerceBD email and password on our site — the assistant never sees your password — and approve a consent screen that shows which store is connected, what the assistant will be able to do, and where you will be sent back. Only the account owner can connect an assistant.
• What it can see. Only your own store, and only what a request needs: orders, products and stock, sales, revenue and profit reports, customer summaries (customer phone numbers are shown only as their last four digits), and your Facebook posts and Page names. It cannot see other stores, your password, payment credentials, or the access tokens we hold for Facebook, SMS or couriers.
• What it can do. Create, update and archive products, and draft, schedule, publish or delete Facebook posts. Publishing, scheduling, deleting, archiving and large stock reductions wait for your explicit approval in the assistant before anything changes. Every action is checked against your account's permissions and plan, exactly as in the dashboard.
• What the assistant provider receives. The answers to your requests are sent to the assistant you connected (for example OpenAI for ChatGPT, or Anthropic for Claude) and are handled under that provider's terms and your settings with them. We do not receive your conversations with the assistant — only the individual requests it sends us. We do not sell this data or use it to train AI models.
• Access tokens. A connection works with OAuth tokens that are limited to your store and to FcommerceBD's assistant endpoint: an access token valid for 60 minutes and a refresh token valid for 30 days that is replaced each time it is used. We never ask you to copy an API key into an assistant.
• Audit log. Every request an assistant makes — reads and changes, including refused or unconfirmed ones — is recorded in your store's audit log with what was requested, when, and the result. It is kept as part of your account data (see Retention and deletion).
• Revoking access. You are in control: disconnect FcommerceBD in your assistant's settings at any time. To cut off every assistant connection on our side immediately, email support@fcommercebd.net; revoked tokens stop working at once, and an access token that is no longer refreshed expires within 60 minutes.

11. Changes

We may update this policy. Material changes will be notified in the dashboard.