Ecomsixx ("we", "us", "the platform") provides AI business automation software to Bangladesh SMEs. This policy explains what personal data we collect, how we use it, who we share it with, and how you can control it. It aligns with the Bangladesh Digital Security Act 2018 and the Draft Data Protection Act (DPDP) of Bangladesh.

1. What we collect

When you sign up and use Ecomsixx, we collect:

Account data: your name, phone number, business name, business type, order volume estimate.
Website purchase intent: when you submit a "Get this template" order on our public website pages, we collect your name, phone, email, business name, business type, domain preference, IP address, and browser user-agent. Used to contact you within 4 hours to confirm your order.
Business content: product catalog, business hours, delivery info, FAQ, website content you provide, uploaded documents. This data is used to configure your AI assistant.
Customer conversation data: messages exchanged between your customers and your AI (via Facebook, Instagram, WhatsApp, or website widget). This includes customer phone numbers, names, addresses, and message content.
Meta channel credentials: access tokens you provide for Facebook/Instagram/WhatsApp. These are encrypted at rest using AES-256-GCM.
Usage & technical data: IP address, browser, session activity, error logs.

2. How we use it

Deliver AI replies to your customers.
Improve your AI configuration and product catalog matching.
Send OTP codes for authentication and campaign SMS on your behalf.
Prevent fraud and abuse of the platform.
Communicate service updates, feature announcements, and support responses.

3. Who we share it with

We do NOT sell your data or your customers' data. We share limited data with these processors:

Convex - database + serverless runtime (US-hosted; data-in-transit encrypted).
OpenRouter / Anthropic - to generate AI replies. Message content is sent for inference; per their policies, it is not used to train models.
BulkSMSBD - to send SMS OTPs and campaign SMS.
Apify - to scrape your website when you opt into auto-provisioning.
Meta (Facebook / Instagram / WhatsApp) - messages transit via Meta's Cloud API.
SSLCommerz / bKash - for payment processing (billing data only, no message content).

4. Data retention

Account data: kept for as long as your account exists.
Customer conversations and contacts: kept for the life of the account. We do not currently delete them on a schedule. You can delete them at any time from your dashboard, or ask us to and we will.
SMS delivery logs: 180 days, then deleted automatically.
OTP codes: deleted automatically within 24 hours of being issued.
Scraped website content: replaced on each re-scrape.

When you close your account, ask us to delete your data and we will do it. We do not run an automatic purge on a timer, so closure alone does not erase anything.

5. Your rights

You (and your customers) can request at any time:

A copy of your personal data.
Correction of inaccurate data.
Deletion of your data ("right to be forgotten").
Export of your data in a portable format (CSV/JSON).
Withdrawal of consent to processing.

Email privacy@ecomsixx.com - we respond within 30 days.

6. Security

We protect your data with: AES-256-GCM encryption for stored tokens, HMAC-SHA256 signature verification on webhooks, HTTPS everywhere, CSPRNG-generated authentication tokens, and per-tenant isolation on every database query.

7. Cookies

We use one first-party session cookie (ecomsixx_session) for authentication. No third-party analytics or ad-tracking cookies.

8. Children

Ecomsixx is a B2B product. We do not knowingly collect data from anyone under 18.

9. Changes

Material changes to this policy will be notified via email to your registered address at least 30 days before taking effect.

Privacy Policy