Privacy Policy

1. Who is responsible for your data

• Merchants and their staff: LixKart is responsible for your account data.
• Shoppers:each store is run by an independent merchant. The merchant decides how your order data is used and is responsible for it. LixKart stores and processes it on the merchant’s behalf. For questions about an order, contact the store first.

2. What we collect

From merchants and staff

• Name, mobile number, email address and password (stored only as a secure hash).
• Store details: business name, address, logo, products, prices, settings and staff roles.
• Billing records: plan, amount, date, and the payment method, sender number and transaction ID returned by the payment gateway. We never receive your wallet PIN or full card number.
• Login activity and an audit log of changes made in the admin panel.
• Credentials you connect, such as courier API keys and ad pixel tokens. We store these encrypted.

From shoppers (on behalf of merchants)

• Name, mobile number, delivery address and, if given, email address.
• Cart contents, orders, order history, coupon use and product reviews.

Automatically

• IP address, browser and device type, pages visited, and error logs, used for security and to keep the service running.
• Cookies and local storage, described in section 6.

3. How we use it

• To create and secure accounts, including sending verification and password-reset codes by SMS or email.
• To run stores: show products, take orders, calculate delivery charges, and book couriers.
• To send order updates by SMS or email when the merchant has turned them on.
• To process plan payments and keep billing records.
• To prevent fraud and abuse, keep stores isolated from each other, and investigate problems.
• To send merchants service notices and, occasionally, product news, which you can opt out of at any time.
• To meet our legal obligations.

4. Who we share it with

We share data only with service providers that help us run LixKart, and only what each one needs:

• Hosting and network: our servers and Cloudflare, which carries and protects web traffic.
• Payments: our payment partner, and the bKash, Nagad or other wallet you pay with.
• SMS and email: our SMS gateway and Resend, to deliver codes and notifications.
• Images: Cloudflare R2, which stores and serves product and store images.
• Couriers:the courier a merchant books (Steadfast, Pathao, RedX or Paperfly) receives the shopper’s name, phone, address and cash-on-delivery amount.
• Meta: if a merchant turns on the Meta Pixel or Conversions API, purchase events are sent to Meta.
• Google: if a merchant adds Google Analytics or Tag Manager, Google receives page-view data from that store.

We may also disclose data when Bangladeshi law, a court order or a government authority requires it, or to protect people from fraud or harm. Some providers process data outside Bangladesh, and we only choose providers that protect it properly.

5. How we protect it

All traffic is encrypted with HTTPS. Passwords are hashed, connected tokens are encrypted, and each store’s data is isolated at the database level so one store can never read another’s. Staff access is controlled by roles and permissions. No system is perfectly secure, so if a breach affects your data we’ll tell you without undue delay.

6. Cookies

• Essential: the admin panel uses cookies to keep you signed in, and storefronts use browser storage to remember your cart. These are needed for the service to work.
• Analytics and advertising: a store may add Google Analytics, Google Tag Manager or the Meta Pixel, which set their own cookies. These are controlled by the merchant.

You can clear or block cookies in your browser settings, but signing in or checking out may stop working.

7. How long we keep it

• Account and store data: for as long as the store is active.
• Shopper data: for as long as the merchant keeps it. Merchants can edit or delete customers from their admin panel.
• Billing records: as long as Bangladeshi tax and accounting law requires.
• Security and server logs: for a limited period, then deleted.

When a store is deleted, all of its data is permanently removed from our live database.

8. Your choices and rights

You can ask to access, correct, export or delete the personal data we hold about you. Merchants can update most details themselves in the admin panel. Shoppers should contact the store, or contact us and we’ll pass the request on to the merchant. We reply within 30 days.

9. How to delete your data

Merchants: email [email protected]from the email address or mobile number on your account and ask us to delete your account and store. We’ll confirm the request, then permanently delete the store, its products, orders and customers within 30 days.

Shoppers: ask the store you bought from to delete your customer record.

10. Children

LixKart is not intended for anyone under 18, and we don’t knowingly collect data from children.

11. Changes to this policy

If we make an important change, we’ll notify merchants by email, SMS or in the admin panel before it takes effect, and update the date at the top of this page.

12. Contact

LixKart, Dhaka, Bangladesh. Email: [email protected]