Privacy Policy

Emarze Commerce (“Emarze”, “we”, “us”) operates an AI agent that answers messages arriving on a merchant’s social channels, confirms sales, and writes the resulting orders into the merchant’s store. We are based at Gazipur, Dhaka, Bangladesh.

This policy covers two very different groups of people, and the difference runs through everything below:

• Merchants — the businesses that hold an Emarze account. We decide how their account data is handled, so for that data we are the data controller.
• End customers — the people who message a merchant on Instagram, Facebook, Messenger, WhatsApp or TikTok. We process their messages on the merchant’s instructions, which makes the merchant the controller and us the processor.

We do not ask for national ID numbers, dates of birth or any special category data, and the agent is not built to collect them. If an end customer volunteers something sensitive in a message, it is stored as part of that conversation and protected the same way as the rest of it.

• To run the service — reading incoming messages, drafting replies in your voice, quoting your catalogue, and creating orders.
• To bill you — issuing invoices, taking subscription payments, and following up failed ones.
• To support you — answering your questions, which sometimes means our staff opening a specific conversation you have pointed us to.
• To keep the service safe — detecting abuse, fraud and intrusion attempts, and meeting our obligations under Bangladeshi law.
• To improve the product — using aggregated usage statistics that identify no person and no business.

Bangladesh does not yet have a single comprehensive data protection statute in force. We therefore hold ourselves to the standards that do apply to us and to the ones our merchants’ customers reasonably expect:

• Contract — most processing is simply what is needed to deliver the service you signed up for.
• Consent — you consent when you connect a channel and grant the permissions requested; you withdraw it by disconnecting that channel.
• Legal obligation — tax and company records we are required to keep, and lawful requests from Bangladeshi authorities.
• Legitimate interests — security, fraud prevention and product improvement, where those interests do not override anyone’s rights.

Where a merchant serves customers in the EU or UK, the GDPR may apply to that merchant. In those cases we act as processor under a data processing agreement, which we will provide on request.

When you connect Facebook, Instagram or WhatsApp, we receive data through Meta’s official APIs under permissions you approve. We use it only to provide the features you asked for, and we comply with the Meta Platform Terms and Developer Policies, including their limits on retention and onward transfer.

• We request the narrowest set of permissions that makes a feature work, and drop permissions we no longer need.
• Platform data is never sold, never used for advertising, and never combined with data belonging to another merchant.
• Disconnecting a channel revokes our access immediately and starts deletion of the data we held for it.

You can delete platform data at any time by following our data deletion instructions.

We share personal data only with the providers we need in order to run Emarze, each under a contract that limits them to our instructions:

We will also disclose data where we are legally required to — a court order or a lawful request from a Bangladeshi authority — and where it is necessary to establish or defend a legal claim. If Emarze is acquired or merged, data transfers with the business, and we will tell you before that happens.

Our servers and several of our providers are located outside Bangladesh, so running the service involves transferring data abroad. Where a provider is in a country without an equivalent data protection regime, we rely on contractual safeguards — standard contractual clauses or their equivalent — to keep the protections travelling with the data.

• Traffic is encrypted in transit with TLS, and data is encrypted at rest.
• Passwords are hashed, never stored in a readable form, and never visible to our staff.
• Access to production data is limited to the staff who need it, and every access is logged.
• Channel access tokens are stored encrypted and are usable only by the account that authorised them.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authorities without undue delay, and explain what happened and what we are doing about it.

• Access — ask what we hold about you and get a copy.
• Correction — have anything inaccurate fixed.
• Deletion — have your data erased, subject to records we must keep by law.
• Export — take your orders, customers and catalogue with you in a machine-readable file.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — disconnect a channel at any time, without affecting anything done before you did.

Write to contact@emarze.com to exercise any of these. We will respond within 30 days and will not charge you. If you are unhappy with the outcome, you may complain to the Directorate of National Consumer Rights Protection or take the matter to the courts of Dhaka.

Emarze is a business tool and is not for anyone under 18. We do not knowingly collect data from children. If you believe a child’s data has reached us, tell us and we will delete it.

We update this policy when the service or the law changes. The effective date at the top always reflects the current version. If a change materially affects your rights, we will email you at least 14 days before it takes effect.

Questions about this policy can go to our team, who will answer within five working days.