Who this covers
Two different groups of people appear in this policy, and they are treated differently.
Operators are the business owner, store administrators, and staff teammates who sign in to Kothbel. We hold their account credentials, subscription billing records, and settings directly, and we are responsible for them as the Data Controller.
Customers are the people who visit a merchant's online storefront, place an order, or message a business on Facebook Messenger, Instagram Direct, WhatsApp, or web live chat. Their messages, names, delivery addresses, and phone numbers belong to that business. Kothbel stores and processes them on that business's instructions, as a service provider — in regulatory terms, the business is the controller and we are the processor. The business decides what is collected, how long it is kept, and who on their team can see it.
If you are the customer of a business that uses Kothbel and you want your order data corrected or removed, ask that business first — they can update or delete your record directly from their dashboard. You can also write to privacy@kothbel.com and we will ensure the merchant processes the request.
What the dashboard, storefronts and API store
We collect only the information required to run the commerce platform, process orders, and operate the live customer communication channels:
- Merchant accounts
- Email, display name, mobile phone number, store subdomain slug, assigned staff role, API keys, and a salted password hash for every login. Never a plain-text password.
- Storefronts and catalogs
- Product listings, descriptions, categories, pricing, stock quantities, product images, categories, discount rules, and customized landing page layouts.
- Orders and checkouts
- Customer name, recipient phone number, delivery address (division, district, upazila, street address), ordered items, order total, delivery fee, payment method (COD or digital payment), and fulfillment timeline.
- Live conversations
- For businesses using the Omnichannel Live Inbox: customer platform ID (e.g. Page-Scoped ID on Messenger or WhatsApp phone number), social display name, avatar URL, whether AI or a human is handling the chat, and message thread history.
- Voice and images
- Customer voice notes sent during chat are transcribed to text for AI assistance; raw audio is stored in private Cloudflare R2 object storage with time-limited pre-signed URLs. Photos sent during inquiries are resized in the browser to strip location and device metadata before upload.
- Billing records
- Subscription plan tier, payment timestamps, billing history, and payment gateway transaction references (bKash, Nagad, card transaction IDs). We do not collect or store full credit card numbers or card CVV codes.
- How long we keep it
- While a business uses Kothbel, and afterwards for 30 days in grace mode upon cancellation to allow data export. After 30 days, store data is permanently purged from primary databases.
We do not ask for, and the product has no fields for, payment card CVV numbers, national identity cards (NID), or health information.
AI Sales Brain and conversational processing
Kothbel includes an integrated AI Sales Assistant that helps businesses answer customer questions, recommend products, and record customer orders 24/7 in natural Bengali and English.
How it works
When a customer sends a message on Facebook Messenger, Instagram Direct, WhatsApp, or the storefront live chat, the message is routed through Kothbel's AI Gateway to an enterprise LLM (such as Google Gemini or Anthropic Claude) along with that business's product catalog and order guidelines.
Human takeover
Any human staff member can claim a conversation in the Live Inbox at any moment. When a human takes over, the AI agent is instantly muted for that thread.
Courier integrations and logistics dispatch
Merchants connect their own delivery accounts with Bangladesh couriers (Steadfast Courier, Pathao Courier, RedX) directly from their Kothbel Store Admin.
When a merchant books a parcel consignment, Kothbel transmits only what the courier requires to deliver the package: the recipient's name, phone number, shipping address, parcel weight, and the Cash on Delivery (COD) collection amount.
These dispatches take place using the merchant's own API keys over authenticated HTTPS connections and are governed by the respective courier's terms and privacy policies.
Delivery intelligence and return prevention
To help merchants avoid fraudulent orders and costly Return-to-Origin (RTO) courier fees, Kothbel evaluates parcel delivery completion metrics associated with phone numbers.
How the data is protected
- Everything travels over modern TLS 1.3 / HTTPS encryption.
- Passwords are salted and hashed using cryptographic one-way functions, never in plain text, and compared in constant time.
- Each business's courier credentials and payment keys are encrypted with AES-256-GCM before writing to the database and decrypted only server-side when an outbound API request is initiated.
- Every database table partitions records by
tenant_id. Requests are authenticated at the Edge before reaching the database, preventing cross-tenant leakage. - Every request carries an authenticated session token, and the server — never the browser — decides which stores that user may view.
- Authentication endpoints and storefront checkout APIs are protected by rate-limiting circuits and bot defense.
Who on a team can see what
- Owner
- Complete administrative access to their store workspace: products, orders, live inbox, customer records, billing, team management, and API settings.
- Store Admin
- Full operational access to catalog, orders, customers, and live inbox. Cannot modify store ownership or view master billing cards without permission.
- Staff / Teammate
- Restricted operational access: can respond to assigned live chats, update order statuses, or fulfill parcels. Cannot access financial or security settings.
These boundaries are enforced on the server for every API request.
How long things are kept
Store data, product listings, orders, and customer records are a business's working records, retained while the account is active. A business can export their products, customers, and order history as CSV or JSON files at any moment from the dashboard.
When a store subscription ends or an account is deleted, records enter a 30-day grace retention window. After 30 days, data is permanently erased from active databases. Automated database backups overwrite deleted records on a rolling lifecycle.
Your rights
Depending on where you reside, you have the right to request a copy of the personal data we hold about you, request correction of inaccurate data, request deletion, restrict how it is used, or receive it in a portable format.
Where we act on a business's behalf (see section 1), we pass customer requests directly to that business and assist them in completing the request.
To exercise any of these rights, write to privacy@kothbel.com. We reply within 30 days. We will verify your identity first to ensure that data is never released to an unauthorized party.
Where the processing happens
Kothbel is operated from Bangladesh. Computing and database services run on Cloudflare's distributed edge network with low-latency regional nodes. Enterprise AI inference through Google Cloud Vertex and Anthropic takes place on secure enterprise infrastructure. Where cross-border data transfer occurs, it is conducted under standard security safeguards.
Children
Kothbel is a business commerce platform and is not directed at children. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor's data has reached us through a merchant's store or inbox, email us at privacy@kothbel.com and we will delete it.
Changes to this policy
If we update this policy, we update the date at the top of this page. For any material change, we notify signed-in operators inside the dashboard before the change takes effect. Previous versions are available on request.
Contact
Write to privacy@kothbel.com with any question about this policy, about what we hold, or to make a data request.
বাংলায় যেকোনো প্রশ্ন সাদরে গৃহীত হবে (Questions in Bengali are warmly welcome), and a Bengali copy of this policy is available upon request.
Our terms of service are available at kothbel.com/terms.