Privacy Policy

1. Scope

This policy explains how AmarPilot ("AmarPilot", "we", "us") handles data when you use our website, apps and services (the "Service"). It covers sellers and their team members. For data about shoppers who buy from a store powered by AmarPilot, see the section "Your customers' data" below and the Storefront Terms.

2. What we collect

• Account details — name, business name, phone, email, and login credentials.
• Business data you enter — orders, customers, products, inventory, payments, and reports.
• Messaging content — messages and media (such as images) your customers send to your connected channels, and replies you send.
• Billing data — plan, credits, and payment metadata. Card details are handled by our payment provider, not stored by us.
• Usage & device data — logs, IP address, device and browser information needed to run and secure the Service.
• Push notification tokens — when you sign in on a mobile device, Google's Firebase Cloud Messaging issues a token we store so we can deliver notifications to that device. Signing out or deleting your account deletes the token.

Advertising and app analytics. We do not use advertising identifiers, we do not run ad attribution, and we do not build advertising profiles. The mobile app ships with Google Analytics for Firebase, but collection is switched off by default and no analytics events are sent while it is off. If we ever turn it on for a release, we will update this policy and the Google Play Data safety declaration first.

3. How we use it

To operate your workspace, sync couriers and messaging channels, process billing, send notifications you request, provide support, and keep the Service secure and reliable. Each business's data is isolated from every other.

4. Your customers' data

When you enter or receive information about your own customers, you control that data and decide how it is used — you are the data controller and AmarPilot acts as your processor, handling it on your instructions to run the Service. You are responsible for having a lawful basis and any required consent to collect and message your customers, and for your own privacy notice to them.

5. Sharing & sub-processors

We do not sell your data. We share it only with service providers that help us run the Service, and only as needed to carry out actions you initiate:

• couriers you connect (for delivery and tracking);
• SMS and email providers (to send messages you request);
• Meta/WhatsApp (for messaging on channels you connect);
• payment providers (to process plan, credit and order payments);
• Google — Firebase Cloud Messaging to deliver push notifications to your devices, and Google Play billing when you buy a plan, an SMS pack or a template inside the Android app. Google receives the purchase token and tells us whether the purchase is valid; we never see your card details;
• cloud hosting and file storage providers (to host the Service and store uploaded files).

These providers may process data outside Bangladesh; we take reasonable steps so it stays protected. We may also disclose data if required by law or to protect rights and safety.

6. Meta / WhatsApp data

If you connect a Meta/WhatsApp channel, we receive and store the messages and media your customers send so you can read and reply. We use this only to provide the messaging feature. You or your customer can request deletion of this data; contact us and we will delete the associated message data, subject to legal retention limits.

7. Uploaded files & media retention

Files you upload and media received from customers are stored with our file-storage provider and served over signed URLs. We retain them while needed to provide the Service; some media may be removed automatically after a retention period or on request.

8. Data retention

We keep your data while your account is active and for a reasonable period afterwards, then delete or anonymise it, unless a longer period is required by law (for example, billing and tax records).

9. Security

We use reasonable technical and organisational measures — encryption in transit, access controls, and isolation between businesses — to protect your data. No system is perfectly secure, so we cannot guarantee absolute security. Keep your credentials safe and tell us promptly of any suspected breach.

10. Your choices & rights

You can access and update your account data, export or delete your data, and disconnect any integration. Depending on applicable law you may have rights to access, correct, delete, or restrict processing of your personal data. Contact us to make a request and we will respond within a reasonable time.

To close your account, follow the steps on Delete your account. That page lists exactly what deletion erases, what we keep for legal and accounting reasons, and how to ask us to delete it for you.

11. Cookies

We use essential cookies to keep you signed in and to keep the Service secure. We do not use them to sell your data.

12. Children

The Service is for businesses and is not directed to children. We do not knowingly collect data from anyone under 18.

13. Changes

We may update this policy from time to time. When we make material changes we'll update the date above and flag them where we reasonably can.

14. Contact

Questions about your data, or a request about the rights above? Reach us through the contact form on our home page and we'll answer directly.