Privacy Policy

What we collect

To run a marketplace we collect only what an order actually needs:

• Your phone number — this is your login. We do not use passwords; we send a one-time code by SMS.
• Your name and delivery address — passed to the rider so the parcel reaches you.
• Your order history — so you can reorder, review and raise returns.
• Basic device and usage data — pages viewed, searches made, so we can fix what is broken and show you products you might actually want.

We do not store your card number. Card payments go directly to SSLCOMMERZ, a Bangladesh Bank–licensed payment gateway, and we only ever see a transaction reference.

Who we share it with

• The seller of the item you bought — they see your name, phone and delivery address, and nothing else. They may not contact you for marketing.
• Our delivery partners — the same three fields, for the duration of the delivery.
• Payment gateways — bKash, Nagad and SSLCOMMERZ, to process and refund your payment.
• Law enforcement — only where we are legally obliged under Bangladeshi law.

We do not sell your data to anyone. Ever.

Your rights

You may, at any time, ask us to:

• Show you every piece of data we hold about you
• Correct anything that is wrong
• Delete your account and personal data (we retain order records where tax law requires it)
• Stop sending you marketing SMS — reply STOP, or turn it off in Account → Notifications

Security

Traffic is encrypted with TLS. Sessions are held in an httpOnly cookie that JavaScript cannot read. Seller verification documents are stored separately from the shopping database.

Contact

Data questions go to privacy@gulumulu.com.bd. We reply within 7 working days.