Dukani is an e-commerce platform operated by Ogrohayon Labs. It lets merchants in Bangladesh run an online store. This page describes what we collect, why, and what you can ask us to do about it.
There are two kinds of people in this document: merchants, who sign up and run a store, and shoppers, who buy from one of those stores. The data involved is different for each.
What we collect from merchants
- Your name and email address, from Google when you sign in. We do not receive or store your Google password.
- Your store details — name, address, contact number, products, prices, and anything else you enter in the dashboard.
- Billing records — your plan, wallet balance and payment history.
What we collect from shoppers
- Order details — the name, phone number and delivery address you give at checkout, and what you ordered.
- Your email address, only if you sign in to a store with Google. Checkout itself does not ask for one.
- A session cookie, so your cart survives moving between pages.
Your order is placed with the merchant, not with Dukani. They see your details because they have to deliver to you. We process that data on their behalf.
What we do not collect
- Card numbers. Online payments go through SSLCommerz and your card details never reach our servers.
- Passwords. Sign-in is through Google only.
- We do not sell personal data, to anyone, ever.
Services we pass data to
- Google — sign-in.
- SSLCommerz — online card and mobile banking payments.
- Courier companies (Pathao, RedX, Steadfast and similar) — the delivery name, phone and address for orders a merchant books.
- Facebook — only for stores that connect a Facebook Page to the Messenger assistant: the conversation involved, and, if the store has switched on comment replies, comments left on that Page’s posts.
- Brevo — sending order emails, when a store has email enabled.
Where it is stored
On servers we rent in Europe. Data is encrypted in transit (HTTPS) and backed up daily, with backups encrypted at rest.
How long we keep it
Store and order data stays for as long as the store exists, because a merchant needs their own order history. Conversations with a store’s Messenger assistant are kept for as long as the store exists too, so the store can follow up on your order. You can ask for them to be deleted at any time.
A store its owner has closed keeps its data for up to 12 months, so it can be reopened. When a store’s data is deleted, order amounts and dates are kept without anyone’s details, because tax law requires sales records for five years; the store’s address stays reserved so nobody can impersonate it. Backups are kept for up to 60 days and then deleted.
Your choices
- See what we hold. Ask and we will tell you.
- Correct it. Merchants can edit most of it in the dashboard directly.
- Delete it. Merchants can close their store, delete its data and delete their account from the dashboard, or ask us to. We complete written requests within 15 days. Some records — order amounts, payments to Dukani — have to be kept for accounting. The steps, and what is kept, are on Delete your data.
If you are a shopper, contact the store you bought from first; they hold the relationship. If they cannot help, write to us.
To have a Messenger conversation with a store deleted, message the store’s assistant delete my data (or আমার তথ্য মুছে দিন) and reply YES when it asks — or email [email protected] with the store’s name. The conversation goes; any order you placed stays with the store for delivery and returns, and your name and phone on it are removed within six months. Shoppers with an account on a store can also delete it themselves, from their profile page on that store.
Children
Dukani is not intended for anyone under 18, and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, we will say so on this page and update the date above.
Contact
Email [email protected].