Privacy Policy

For merchant account, billing and website data, OnlyOrders is the data controller. For Customer conversations, orders and customer records that a Merchant handles through the Service, the Merchant is the controller and we act as its processor: we process that data on the Merchant's instructions and only to provide the Service. Merchants must give their own customers an appropriate privacy notice and have a lawful basis for contacting them.

• Account data: name, email address, sign-in method, Firebase user identifier and account security records.
• Business data: store name, description, contact details, guidance, catalog, product photos, prices, stock, categories and storefront settings.
• Connected platform data: Page and account identifiers, encrypted access tokens, page names, webhook events and notification Messenger identifiers you connect.
• Conversations and comments: customer messages, comments, photos, profile names/avatars supplied by the platform, AI replies, suggestions and conversation state.
• Orders and customer records: name, phone number, delivery address, order contents, totals, payment method and any transaction ID a customer provides.
• Plan and allowance data: assigned plan, usage counters, overrides and notices. We do not collect card numbers in the Service.
• Technical data: IP address, device/browser information, request logs, error diagnostics, timestamps and approximate timezone.
• Notification data: browser push subscription tokens, and the Messenger account identifiers used for merchant notices.
• Cookie choices: your consent record and, if you accept analytics, a random first-party visitor id.

We do not intentionally collect special-category data (such as health, religion or biometric data), and you should not ask Customers to provide it in a conversation. Do not send payment card numbers in chat.

• From you, when you create an account, add products or settings, or connect a channel.
• From Customers, when they message, comment, send photos or place an order through your connected platform.
• From platforms, which supply message events, profiles, page details and delivery information.
• Automatically, from your browser and our servers, as request logs and cookie choices.

Where we rely on consent (for example analytics cookies), you can withdraw it at any time through the cookie settings in the footer. Withdrawal does not affect processing that already happened.

Messages, comments and attached photos may be sent to an AI model provider (such as Google Gemini, OpenAI or Azure OpenAI) to draft replies, suggestions or product matches. The output is returned to the Service and may be sent to your customer when the agent is active. We do not use Customer conversations to train our own models. Model providers process the content under their terms and privacy commitments. AI output can be inaccurate, which is why the console lets you pause an agent, take over a conversation and reply yourself. We do not make automated decisions that produce legal or similarly significant effects about a person; order acceptance and fulfilment decisions remain with the Merchant.

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share data with service providers that help run the Service, under their terms and only as needed:

We may also disclose data if required by law, to protect rights or safety, to investigate abuse, or as part of a merger or sale of the business (subject to this policy). Merchants see the data of their own business; we do not share one merchant's data with another.

We use strictly necessary cookies for sign-in and security, plus preference storage for your theme, cart and timezone. With your consent, we use first-party analytics to count store visits anonymously. We do not use advertising or cross-site tracking cookies. See the Cookie Policy for the exact list, durations and controls.

• Account and business data: while the account is active, then for a short deletion window and any legally required period.
• Conversations, comments and orders: for the life of the business workspace unless you delete them, so you can serve returning customers and keep records.
• Platform tokens: until you disconnect the channel or delete the workspace.
• Operational logs: generally up to 30 days, longer only for security investigations.
• Anonymous visit counts: the visitor id lasts 30 days; the hashed daily count is kept with store analytics.
• Plan, billing and tax records: kept for the period required by applicable Bangladeshi tax and accounting law, including after a workspace is closed.
• Cookie choices: 180 days, unless you change them sooner.

Backups may retain copies for a limited period after deletion. Where a law requires a longer retention period, we keep only what is required.

We use TLS in transit, encrypt connected-platform tokens at rest, verify webhook signatures, restrict access to production systems and keep audit logs. No system is perfectly secure. You are responsible for protecting your credentials, and you should not send card numbers or sensitive identity documents through chat.

We and our providers process data in Bangladesh, the United States and other countries where our providers operate. Where data leaves the UK/EEA, we rely on appropriate safeguards such as standard contractual clauses or an applicable adequacy decision. You can contact us for more information about the safeguards used.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent and lodge a complaint with a supervisory authority. EU/UK residents can complain to their local data protection authority.

If you are in California, you may request to know, delete or correct personal information, and to opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, so there is no sale/share to opt out of. We will not discriminate against you for exercising a privacy right.

To exercise a right, email us at the address below. For Customer data held by a Merchant, we will forward your request to that Merchant and assist them; contact the Merchant first if you know which store you dealt with. We may need to verify identity before acting.

The Service is for businesses and is not directed to children. Merchants must be at least 18. We do not knowingly collect personal data from children. If you believe a child's data has been sent to us, contact us and we will take appropriate steps. Merchants must comply with platform age rules and their local child-protection law.

We send service and account notices through the console, email and, if you connect it, the notification Messenger account. You can disconnect that account at any time. We do not send third-party advertising or sell your contact details. Transactional notices about orders, allowances and security are part of the Service.

We may update this policy as the Service or the law changes. The updated date at the top will change, and material changes will be communicated in the console or by email where appropriate. If a change relies on consent, we will ask for it again.

For privacy questions, data requests or processor enquiries (including a data processing agreement), contact us. We have not appointed a statutory Data Protection Officer; privacy enquiries go to the address below. Where EU/UK law requires a local representative, we will publish their contact details here; until then our privacy contact handles those requests.

You can also use our data deletion instructions.