Privacy

What we collect

• Account data: name, email address, organisation name, role in the organisation, language preference.
• Workspace data you enter: entity profiles (business type, sectors, regulators, topics, keywords), tasks, comments and notes.
• Lead data from public forms: name, email, company, role, sector, message and the answers you give in the assessment.
• Technical data: IP address and user agent in server logs and security events, used for rate limiting and abuse prevention.
• Usage events such as logins, exports and brief views, kept per organisation for quota and billing.

What we do not collect

• No advertising trackers and no third-party analytics scripts on this site today.
• No card or bank-account numbers; payment is by bank transfer and you keep your own records.
• No content from your own documents: we read public regulatory documents, not your files.

Why we use it

• To run the service: authentication, tenant isolation, alerts, digests, invoices.
• To reply to your request when you use a form.
• To protect the service: rate limits, audit logs and security events.
• We do not sell personal data and we do not share it with advertisers.

Where it is stored

Application data is held in a managed PostgreSQL database operated by a cloud provider outside Bangladesh, chosen for reliability and cost. The application runs on a managed hosting platform. When email sending is configured, the recipient address and message pass through the email provider named in our operations documentation. Transport is encrypted (HTTPS/TLS). Each organisation's rows are isolated with database row-level security.

How long we keep it

Account and workspace data: for the life of the organisation's account, and for a short period after closure so that exports and invoices remain available, then deleted. Leads: until the conversation ends or you ask us to delete them. Server logs and security events: a limited rolling window. Invoices and audit records required for tax purposes are kept for the statutory period.

Your choices

• Ask for a copy, a correction or deletion of your personal data by emailing us; we will act within a reasonable time and confirm.
• Organisation administrators can export workspace data at any time.
• You can switch off email digests in your preferences; account and security emails still arrive.

Cookies and local storage

• A session cookie after you log in, a locale cookie to remember Bangla or English, and a theme preference in local storage. No cross-site tracking cookies.

Changes

If this notice changes materially we will post the new date here and tell logged-in administrators in the workspace.