1. About this policy
ecomsbd is a Bangladesh-first seller operations and commerce management platform. This Privacy Policy explains how we collect, use, store and share information through the ecomsbd Android app (com.ecomsbd.app) and the web platform at scalemyprints.com. “We”, “us” and “our” refer to the operation of ecomsbd.
This policy applies to sellers, shop owners, their team members and visitors to our website. It also describes how we process information about customers and suppliers that sellers enter, import or sync into the service. Sellers are responsible for their own customer notices, permissions and lawful use of that information.
2. Account, shop and team information
When you register or sign in, Supabase Auth processes your email address, password for email/password sign-in, authentication identifiers and session information. If you choose Google Sign-In, Google and Supabase process that sign-in and provide account identifiers and available profile information, such as your email and name. Your Google password is not provided to ecomsbd.
We store account identifiers, linked sign-in information, display name, language preference and account status. We also process contact details you provide, shop name and business category, pickup contact and address, shop settings, team invitations, membership and roles. What a team member can view or change depends on their shop permissions.
3. Customer, order and business information
Sellers may provide customer names, phone and alternate phone numbers, delivery addresses, district/area, order details, notes, tags, follow-ups and shop-specific customer flags. Customer email addresses or WhatsApp contact details may be recorded for messaging. Orders can include the original text pasted by the seller, address snapshots, purchased items, prices, discounts, delivery fees, status, delivery outcomes, returns and return-to-origin (RTO) history.
We process product and variant details, SKUs, prices, costs, inventory and stock movements; supplier names, contact names, phone numbers, email addresses, addresses and notes; purchase orders, receipts, supplier payments and payables. Uploaded spreadsheets, import rows, payout statements and generated export files may contain these same categories of information.
Customer/order information is processed on behalf of the seller to operate their shop, fulfil orders, arrange delivery, reconcile money, manage customer relationships and provide the features they use. Raw identifiable customer records and a shop’s private notes are not made available to unrelated sellers. Customers should normally contact the seller they bought from to ask about their order or request access, correction or deletion of information held for that shop.
4. Financial and operational information
We process cash-on-delivery (COD) amounts, receivables, courier charges and payouts, reconciliation results and discrepancies, transaction references, ledger entries, cashflow, expenses, costs and profit calculations. These are records used to manage the seller’s business; ecomsbd does not itself collect the customer’s COD payment.
ecomsbd currently operates in free launch mode with billing disabled. We do not currently collect card, bKash or Nagad payment credentials for an ecomsbd subscription. Business payment amounts or references entered by a seller are distinct from payment credentials.
5. Device information, local storage and diagnostics
We process app installation identifiers, device platform, device model and operating system/app versions where reported, session identifiers and activity timestamps. Firebase Cloud Messaging uses registration tokens and installation/device information to deliver push notifications; we associate registered push tokens with signed-in devices.
Our systems process IP addresses and request metadata to handle connections and protect the service. Application diagnostics include request paths, methods, status codes, timing, request/trace identifiers, and relevant user or shop identifiers. Security/session records can include user-agent information and hashed IP information. Hosting and authentication providers also process connection metadata to operate their services.
The web platform uses authentication cookies and browser storage for sessions and language preferences. The mobile app stores session credentials securely and keeps local business data and pending changes to support offline work and later synchronisation. Files you deliberately choose to upload are processed for that feature; the app does not request access to your contacts, SMS inbox, call logs, microphone, camera or precise device location.
Our analytics features calculate the seller’s operational figures from business records. We do not currently run third-party product/usage analytics, advertising trackers or session replay in the web or mobile app. Firebase Analytics and Crashlytics are not integrated. Sentry error-reporting support exists on the backend but is not enabled in the current production configuration.
6. Connected services and messaging
When you connect an available courier integration, such as Steadfast, Pathao or RedX, we process the merchant account details and credentials you provide. Booking or managing a parcel can share recipient name, phone, delivery/pickup address, items, delivery instructions, COD amount and parcel references with that courier, and return delivery, return and settlement information to your shop. Manual courier records do not by themselves connect to a courier API.
When an available Shopify, WooCommerce or Custom Website connection is enabled, we process store identifiers, access credentials, selected orders/customer information, products, variants, stock, fulfilment/status information and webhook/synchronisation records as required by the selected features. Seller-created API keys and webhooks can allow the seller’s authorised software and designated endpoints to receive the data permitted by their scopes and subscribed events.
Messaging features store the contacts you enter, message templates, rendered message content, campaign selections, consent/opt-out evidence, sending attempts and provider references. Delivery or read/open statuses are processed only where the configured channel reports them. Sending through WhatsApp requires an enabled Meta/WhatsApp Business connection and approved templates. The Messenger connection implementation handles Page connection and webhook health; it does not store or answer Messenger message contents, and Messenger campaign sending is unavailable.
An adapter being present does not mean a provider receives information. Sharing occurs only when a service is active and the relevant connection or feature is used. In the current deployment, Shopify and Meta setup credentials are absent, business email delivery is disabled, and customer SMS sending is unavailable. The optional Resend email transport would receive recipient addresses and message content only if configured and used. These gated services are not current recipients merely because their integrations exist.
7. How we use information
We use information to authenticate accounts, manage shops and team access, process and synchronise orders, maintain inventory, arrange seller-requested courier operations, reconcile COD and payouts, calculate costs/profit, manage procurement and customer relationships, deliver configured messages and notifications, run seller-selected workflows, provide exports, investigate errors and abuse, maintain security and respond to requests.
First-party risk/history features use the relevant shop’s own customer and delivery history. No external risk provider is currently registered, so the external-risk feature does not currently send customer lookups to a third party. It is not a shared identifiable customer blacklist.
If a shop opts in to network intelligence, its eligible operational results can contribute to aggregate benchmarks. Published benchmarks use minimum participation/sample requirements, contribution limits and coarse rounding; insufficient groups are suppressed. They do not reveal another seller’s identity, individual customer records or exact shop-level results. You can change participation in the Network intelligence settings; previously published anonymous aggregates are not individual customer records.
8. Sharing and service providers
Information is available to authorised members of the relevant shop according to their roles. Restricted platform support/administration access is used for service operation and support; customer phone details are masked by default, with specially authorised, reason-recorded access for supported investigations.
Supabase provides account authentication and the hosted PostgreSQL business database. Google provides Google Sign-In when chosen, and Firebase Cloud Messaging provides push delivery. Cloudflare R2 stores private uploaded import/payout files and export files. Northflank hosts the backend API, background processing and Redis infrastructure. Vercel hosts the web application, and Cloudflare provides domain/network infrastructure. These services process the information needed for those functions, including relevant connection metadata.
Couriers, commerce platforms, messaging providers and seller-designated API/webhook destinations receive information only in the circumstances described in section 6. Their handling of information in their own services is also governed by their own terms and privacy policies.
We do not sell personal information or share it with advertisers for advertising. Information may be disclosed where required by an applicable legal obligation or valid legal request, or as necessary to investigate abuse, protect security and resolve disputes.
9. International processing
Although ecomsbd focuses on Bangladesh, our cloud, authentication and delivery providers operate internationally. Information may be processed or stored outside Bangladesh where those providers operate. We do not promise Bangladesh-only storage. The applicable services and their role in processing information are described above.
10. Retention and account deletion
We retain information for as long as necessary for the purposes described in this policy, including operating the service, security, reconciliation, dispute resolution, applicable legal obligations and enforcement. There is no single fixed retention period for all records. Export downloads expire; the export history and audit records may remain after the downloadable content is removed.
A shop owner can initiate deletion in the mobile app under Settings → Your data and privacy → Closing your account, where available. The current workflow schedules deletion after a 14-day cooling-off period, displays the scheduled date and allows cancellation during that period. Access continues until the deletion workflow runs. This workflow is shop-specific: deleting one shop does not delete a separate active shop or an account still needed for membership in another shop.
When the workflow completes, it anonymises customer profile names, phone details, addresses and notes; clears specified CRM free text and message content/recipient details; removes device push tokens; revokes shop sessions and memberships; and clears the shop name and pickup contact/address. It removes import/export objects from R2. For members with no other active shop membership, it clears account contact details and deletes their linked Supabase authentication identity.
The automated workflow does not erase every stored copy. Financial ledger, receivable, payout and profit records, audit history and payout source evidence remain for reconciliation, accountability and disputes. Other retained operational records can include order/address snapshots, original imported or pasted information, integration/event records, supplier records and connection configuration; some can still contain personal information. We therefore do not describe all retained records as anonymous. Further access or erasure requests require review of the affected records and any justified retention need.
Deleting an ecomsbd shop does not itself delete information already held independently by a courier, connected store or other provider, or copies you have downloaded. Contact the relevant provider for its own deletion controls.
11. Access, correction and controls
You can view your information and use the available account, shop and customer editing controls, subject to your role. Authorised users can export supported datasets from Data & privacy in the mobile app; customer exports require the appropriate owner permission. You can review/revoke devices and sessions, manage team roles, disconnect available integrations, revoke API keys and change network participation. Disconnecting a service stops the enabled connection; it does not automatically erase historical records.
For information or corrections not covered by these controls, use the privacy contact below. We may need to verify your identity and authority over the shop before providing information or acting on a request. If you are a shop’s customer, identify the relevant shop so your request can be directed to the seller responsible for the record.
12. Security and connected-service credentials
We use HTTPS, authenticated access, shop-scoped permissions, restricted administrative access and logging safeguards to protect information. Stored customer phone fields and connected-service credentials use application-level encryption where implemented. Credential APIs return connection status or masked indicators instead of returning stored secrets in plaintext. Newly generated API/webhook secrets may be shown once so the authorised seller can configure their connection.
These measures reduce risk but do not guarantee absolute security or mean that every business field is encrypted at the application level. Keep your account and connected-service credentials private, use appropriate team permissions and revoke access when it is no longer needed.
13. Notifications and messaging choices
Push notifications can carry operational alerts and relevant shop/order references. You can manage notification categories, push preferences and available quiet-hour settings in the app, and change notification permission in your device settings. Disabling push does not remove the shop’s underlying business records or in-app notification history.
Customer messaging depends on the seller’s recorded transactional or marketing consent and the availability of the channel. Where supported, customers can use message opt-out/unsubscribe controls or ask the seller to stop messages. A marketing opt-out does not by itself delete an order or its required operational records.
14. Children
ecomsbd is a seller/business operations service and is not directed to children. We do not ask for a date of birth as part of the account profile. If you believe a child has provided personal information through an account, contact us so we can review the circumstances and take appropriate action. Sellers remain responsible for the customer information they submit.
15. Changes to this policy
We will update this page when our data practices change and revise the “Last updated” date. Where a change requires additional notice or permission, we will provide it through an appropriate service notice or consent flow before applying that change.
16. Contact
For privacy questions, support, access, correction or deletion requests, contact the operator of ecomsbd at: uprightseo24@gmail.com.
You do not need to sign in to the app to request account and associated data deletion. See our account deletion page.
Where possible, write from your account email and identify the relevant shop. We process your message and contact details to verify and handle your request. Google (Gmail) hosts our support mailbox and processes the emails you send. Do not send passwords, sign-in codes or connected-service secrets.