Legal Document

MASH ECO Privacy Policy

Last Updated: October 2026 | Version 2.4

MASH ECO ("we", "us", or "our") operates an all-in-one cloud e-commerce platform and merchant infrastructure designed for businesses, retailers, and online merchants in Bangladesh. We are deeply committed to protecting the privacy, security, and integrity of your merchant data, your customers' transactions, and your administrative credentials. This Privacy Policy details the exact lifecycle of data collected, processed, and safeguarded on our platform.

Tenant Isolation Guarantee

Every merchant store runs in a strictly partitioned logical environment governed by indexed tenantId constraints. Your product catalog, customer records, and order history are completely isolated from all other stores.

1. Information We Collect

A. Merchant Account & KYC Information

When onboarding, we collect your full legal name, business brand name, official phone number, email address, password (stored using one-way salted bcrypt hashing), NID/trade license verification documents, and chosen subdomain or custom domain.

B. Store Configuration & Media Assets

Product descriptions, inventory levels, SKUs, category hierarchies, store logos, theme preferences (Design 01 through 05), custom domain DNS mappings, and storefront operating modes (Online/Offline).

C. Customer & End-User Transaction Data

Orders submitted through your storefront contain buyer names, delivery addresses, contact numbers, order totals, chosen payment channels (Cash on Delivery, bKash, Nagad), and tracking numbers.

D. Logistics & Courier Credentials

Encrypted merchant API credentials for integrated delivery partners (Steadfast API key & secret, Pathao Client ID & secret, REDX tokens) used exclusively for automated parcel forwarding and live consignment tracking.

E. Fraud Prevention & Security Telemetry

Historical delivery fulfillment rates, phone number risk patterns, IP geolocation, and device fingerprints processed by our automated fraud score calculator to detect return abuse and fraudulent checkouts.

2. How We Use and Process Your Data

To provide, maintain, and securely host your branded e-commerce storefront and merchant portal.
To synchronize automated courier dispatch and tracking updates via Steadfast, Pathao, and REDX.
To evaluate order risk through algorithmic fraud scoring (flagging high-risk vs. safe orders).
To manage multi-tier subscription quotas (product upload limits, staff permissions, custom domain bindings).
To enforce platform compliance and govern account states (Active, Inactive, Suspended Read-Only, or Banned).

3. Data Sharing & Third-Party Integrations

We never sell, rent, or monetize your store data or your customers' contact information. Data is shared exclusively with critical infrastructure partners necessary to deliver core platform services:

Courier Partners (Steadfast, Pathao, REDX): Customer recipient names, delivery addresses, and phone numbers dispatched for parcel delivery.
Payment Gateways (bKash, Nagad, SSLCommerz): Encrypted transaction tokens used for subscription billing and online buyer checkouts.
Cloud & Security Providers (Cloudflare, Cloudinary, AWS/VPS): Edge CDN caching, automated SSL certificate issuance, DDoS mitigation, and optimized image hosting.

4. Account Deletion & Permanent Data Purge Process

We believe in complete merchant sovereignty. You retain full ownership of your data and possess the unequivocal right to request permanent account closure and data eradication at any time. Our deletion procedure is systematic, secure, and permanent:

Step 1: Submitting Request

A merchant owner may initiate deletion from the merchant dashboard settings or by sending a verified request from their registered email to [email protected].

Step 2: Pre-requisites & Verification

The store owner must ensure there are no unfulfilled orders, unresolved customer disputes, or outstanding billing invoices before proceeding.

Step 3: 14-Day Safety Grace Period

To prevent accidental loss from compromised credentials, a mandatory 14-day cooling-off window is activated. The storefront is placed offline. During this window, the owner can cancel deletion upon identity re-verification.

Step 4: ACID Cascading Data Eradication

Upon final execution, our database executes a sequential transactional purge: the Tenant profile, all staff user accounts, product catalogs, categories, order logs, courier API keys, and all Cloudinary image assets are permanently eradicated.

Statutory Tax & Regulatory Audit Exception:

In compliance with Bangladesh financial laws, the Income Tax Act, and National Board of Revenue (NBR) audit guidelines, historical transaction invoices and tax receipts are archived in an immutable ledger for legally mandated statutory retention periods before final disposal.

5. Data Security & Storage Standards

We employ enterprise-grade security practices, including TLS 1.3 transit encryption, AES-256 data-at-rest protection for sensitive API credentials, strict session token timeouts, and automated hourly database backups.

6. Contact & Data Protection Inquiries

If you have any questions regarding your privacy rights, data export, or account closure, please contact our Data Compliance Officer:

MASH ECO

Badda Link Road, Gulshan, Dhaka, Bangladesh

Email: [email protected]

Hotline: (+880) 1880840849