Privacy Policy

Last updated: 18 October 2026

Welcome to Chitrangoda (“we”, “us”, “our”). We care about your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using https://chitrangoda.com (the “Site”) you agree to this Policy.

1. Who we are

CHITRANGODA
822/1, West Kazipara, Mirpur, Dhaka-1216
Email: support@chitrangoda.com
Phone: 01928730403

2. What this policy covers

This Policy applies to the Site, our online store, customer accounts, checkout, social logins (Facebook, Google), coupons, and the channels where you message us: our Facebook Page on Messenger, our Instagram account, and WhatsApp. It also covers how we handle those messages in our customer support tools, including AI-assisted replies (section 7B).

3. Information we collect

3.1 You provide directly

Account details: name, email, password (hashed), phone (optional), delivery address(es).
Orders: products, amounts, coupon use, delivery instructions.
Support: messages, attachments, return/exchange details.
Social Login (Facebook/Google): profile name, email (when provided), platform ID, profile image URL.

3.2 Collected automatically

Device & usage: IP address, browser, pages viewed, time on page, referring URLs.
Cookies & similar: to keep you signed in, remember cart items, and measure performance.

3.3 From third parties (when you allow)

Payment gateways: payment status & reference (we do not store full card data).
Delivery partners: tracking updates.
Analytics/ads partners: aggregated insights and campaign performance.

4. How we use your information

Provide the service: account creation, login, cart, checkout, order fulfillment.
Customer care: respond to queries, handle returns/refunds.
Personalization: remember preferences, show relevant products or offers.
Security & fraud prevention: detect suspicious activity.
Legal/compliance: invoices, tax, and record-keeping.
Marketing (with controls): send updates, offers, and newsletters (you can opt out at any time).

Legal bases (where applicable)

Contract: to process your orders and provide the Site.
Legitimate interests: improve the Site, prevent fraud, understand performance.
Consent: email marketing, certain cookies, social logins.
Legal obligation: invoices/tax records.

5. How we share information

We don’t sell your personal data. We share it only with the providers that run our service, and only what each needs:

Meta (Facebook, Instagram, WhatsApp): delivering our chats with you; Facebook login; measuring our ads (Meta Pixel and Conversions API). They receive chat messages, the login data you allow, and order events for ad measurement.
OpenAI: drafting replies for our staff to review (section 7B). It receives recent chat messages and product details.
Steadfast Courier: delivering your order. It receives your name, phone, delivery address and cash-on-delivery amount.
Payment providers (bKash, our bank for bank transfers): taking payments and refunds. They receive the payment amount and reference.
Google: website analytics and Google login. It receives usage data and the login data you allow.
Hosting and email providers: running the Site and sending order emails, with the data needed for that.
Authorities: when required by law, only what the law requires.

If our business is merged or sold, your data may pass to the new owner under this Policy.

6. Cookies & tracking

We use cookies to:

Keep you signed in and remember your cart
Measure site performance and fix issues
Personalize content and offers

You can control cookies via your browser settings. Disabling some cookies may affect functionality.

7. Social login specifics

When you choose Continue with Facebook or Continue with Google, those platforms share the data you permit (typically name and email). We use it to create/sign in your customer account.

Facebook data deletion: You can request deletion via Facebook or by contacting us. Facebook will call our endpoint to start the process: https://chitrangoda.com/facebook-data-deletion-request-callback.

7A. Messages you send us on Messenger, Instagram and WhatsApp

When you message our Facebook Page, our Instagram account or our WhatsApp number, Meta delivers the conversation to our customer support system so our team can answer you in one place.

What we receive:

The messages you send us and our replies, with their date and time and whether they were delivered and read.
Photos, videos, voice notes, files and stickers you send.
Your name (or username) and profile picture as Meta shares them, and the ID Meta gives you for our Page or account (not your password or private profile).
If you came from one of our ads or posts, which ad or post it was.
Details you choose to give us in the chat, such as your phone number, delivery address, size or an advance-payment transaction ID.

How we use it:

To answer your questions, take and confirm orders, arrange delivery, and handle returns and complaints.
To recognise you as a returning customer: when the phone number you give us matches a customer account, we link the chat to that account so we can see your past orders.
To keep our service quality up: response times and which staff member handled a chat.

Who sees it: only our authorised staff, through our admin system with individual logins. Internal notes our staff add to a chat are never sent to you.

Meta processes these messages as the provider of Messenger, Instagram and WhatsApp under its own privacy policy (Meta Privacy Policy).

7B. AI-assisted replies

We may use an AI service (OpenAI) to draft replies to your messages, so our team can answer faster. A staff member reads every draft and decides what is sent.

What is sent to the AI: the recent messages in your conversation and product information from our catalogue (name, price, sizes, stock). We leave out your phone number and address unless the task is taking your order.
What the AI cannot do: give discounts, change prices, confirm payments, or see other customers’ conversations. Prices and stock come from our own system, not from the AI.
Your conversation history stays in our own system. We use OpenAI through its business API, where customer content is not used to train OpenAI’s models by default.
If you prefer that your messages are not processed by AI, tell us in the chat or email support@chitrangoda.com and we will answer you without it.

8. Payments

Online payments are made by bKash or bank transfer; orders can also be paid cash on delivery. We receive the payment amount and transaction reference, and we never ask for or store your bKash PIN, card numbers or CVV. For details, see bKash’s or your bank’s privacy policy.

9. Data retention

Accounts & orders: retained for as long as your account is active and as required for legal/tax purposes.
Marketing data: kept until you unsubscribe or your consent is withdrawn.
Logs & analytics: kept for a reasonable period for security and performance.
Chat conversations (Messenger, Instagram, WhatsApp): kept for 24 months after the last message, then deleted, unless linked to an order we must keep for legal or tax reasons.
Copies of photos and files sent in chats: kept for 90 days.
Technical delivery records of chat events: kept for 14 days.
AI request logs (what was asked and the draft returned): kept for 90 days for quality checks.

We delete or anonymize data when it is no longer needed.

10. Your rights & choices

Subject to applicable law, you can:

Access the data we hold about you
Update/correct your information
Delete your account (unless we must keep certain records by law)
Opt out of marketing at any time (via email footer link or by contacting us)

To make a request, email support@chitrangoda.com from your registered email.

11. Children’s privacy

Our Site is not directed to children under 13 (or the age required by local law). We do not knowingly collect data from children. If you believe a child has provided data, contact us to delete it.

12. International transfers

Your data may be processed outside your country. We take steps to ensure appropriate safeguards consistent with this Policy and applicable laws.

Meta and OpenAI process data on servers outside Bangladesh, including in the United States. We use them under their business terms and send only what each task needs.

13. Security

We use reasonable technical and organizational measures (HTTPS/TLS, access controls, hashed passwords, least-privilege access) to protect your data. No method is 100% secure; report any concerns to support@chitrangoda.com .

14. Third-party links

The Site may link to third-party sites. Their privacy practices are governed by their own policies.

15. Changes to this Policy

We may update this Policy to reflect changes in our practices or for legal reasons. We’ll post the new version here with an updated “Last updated” date. Significant changes may be notified via email or Site notice.

15A. How to delete your data

You can ask us to delete the messages and other data we hold about you at any time.

Send us a message on Messenger, Instagram or WhatsApp saying “Delete my data”, or email support@chitrangoda.com with the name and phone number you used with us.
We confirm the request with you within 3 working days.
Within 30 days we delete your chat history, the photos and files you sent, your contact details in our support system, and any AI logs about your conversations.
We keep only what the law requires (for example invoices for orders you placed), and we tell you what was kept and why.

If you signed in with Facebook, you can also remove our app in your Facebook settings (Settings & privacy → Settings → Apps and websites) and request deletion there; Facebook then sends the request to us.

Deleting your data from our system does not delete the messages from your own Messenger, Instagram or WhatsApp app; you can delete those in the app.

16. Contact us

Questions or requests?
Email: support@chitrangoda.com
Address: 822/1, West Kazipara, Mirpur, Dhaka-1216