Privacy policy

Easyalap is operated by Teckpal, in Dhaka, Bangladesh. This page describes what the service stores, why, and who else sees it. It covers three different people: the merchant who signs up, the customer who messages that merchant's shop, and the visitor who reads this website or subscribes to our newsletter.

What we store about a merchant

• The email address and hashed password of each panel account. Passwords are hashed with Argon2 and are never stored or logged in readable form.
• The shop name, the team members added to it, and their roles.
• Access tokens for the channels connected, and credentials for the store connected, so the agent can read stock and orders.
• Billing records: which plan, which invoices, and the reference a payment gateway returned. Card numbers never reach us.
• Usage counters: conversations, messages and model tokens per month.

What we store about a customer who messages a shop

• The message content, in both directions, and any attachments sent.
• The name and channel identifier the channel gives us, such as a WhatsApp phone number or a Messenger scoped id, plus an email address if the customer gives one.
• Orders matched to that customer, read from the merchant's own store.
• Notes and tags the merchant's team writes about the conversation.

This data belongs to the merchant. We process it so the merchant's agent can answer, and we do not use it to build a profile of anyone across shops.

What we store about a website visitor or subscriber

• The cookie choices you make, and the region you picked or that your country suggests.
• If you subscribe to the newsletter: your email address, when you subscribed and confirmed, and where on the site you signed up. We add you only after you confirm from the email we send.
• If you use the chat on this website: what you write to our own agent, like any other customer conversation.
• Only with your consent: the analytics and advertising measurement described under Cookies.

Who else sees it

• Google (Gemini) receives conversation text, and images when a customer sends one, so a reply can be generated.
• Meta operates WhatsApp, Messenger and Instagram, and sees everything sent over those channels regardless of us.
• Supabase hosts the database and the private attachment storage.
• Upstash holds short-lived keys: rate limits, locks and the per-message deduplication key.
• SSLCommerz and Stripe take payments. They receive a merchant's billing details directly; we receive only the result.
• Vercel serves the application.
• Resend delivers our email: account and verification messages, and the newsletter and product news you agreed to receive.
• Google Analytics, only if you allow analytics cookies, measures how this website and the panel are used: pages viewed, buttons pressed and forms sent, never what was typed into them.
• Meta (the Meta Pixel and Conversions API), only if you allow advertising cookies, measures whether our ads brought people to the site. When someone who allowed it signs up or pays, our server reports that too, so it is counted even when a browser blocks it: to Meta with the email address and account id hashed (turned into a one-way code, never readable), and to Google with our internal account id, which means nothing outside Easyalap.

We do not sell data. We share nothing with advertisers except the consented measurement above, and we never share the content of any conversation.

Cookies

Nothing that measures you loads until you answer the cookie banner, and rejecting takes one click. You can change your answer at any time from Cookie settings at the bottom of every page; withdrawing removes the measurement cookies we can reach and stops any further measurement.

• Necessary, always on: ea_at and ea_rt keep you signed in; ea_region remembers the region you chose; ea_ref remembers the referral link you arrived with, for 90 days, and ea_code a discount code, for 30 days; ea_consent remembers your cookie choice; rail remembers whether the panel's sidebar is open.
• Analytics, only with your consent: _ga and _ga_*, set by Google Analytics, for up to 2 years.
• Advertising, only with your consent: _fbp and _fbc, set by the Meta Pixel, for up to 90 days.

Your browser also keeps a few settings on your device that never leave it, such as which notices and offers you closed.

Newsletter and marketing email

We send the newsletter only to people who asked for it and confirmed by email, and product news to merchants about the service they use. Every such email has a one-click unsubscribe link, which takes effect at once. Account and billing emails are not marketing and still arrive after you unsubscribe.

Where it is stored

The application runs in Singapore and the database is hosted by Supabase. Data therefore leaves Bangladesh. The processors above operate in their own regions.

How long we keep it

Conversations and contacts are kept while the merchant's account is open, because the merchant needs their own history. Audit records of actions the agent took are append-only and are kept for as long as the account exists, so that a disputed refund can be answered. When an account is closed we delete its data within 30 days. A newsletter address is deleted when you ask. After you unsubscribe we keep the address marked as unsubscribed, only so that it is never emailed again by mistake.

Your choices and rights

You can ask us for a copy of what we hold about you, to correct it, or to delete it; you can withdraw consent to cookies or email at any time without affecting anything done before; and you can object to our use of your data. Where the law of your country gives you more, such as the GDPR in the European Union and the UK, you have those rights too, including complaining to your local data protection authority. We use your data to provide the service you signed up for, to meet legal and tax duties, and, for measurement and marketing email, only with your consent.

Having your data deleted

See data deletion for how a merchant or a customer can ask for their data to be removed, and what happens when they do.

Contact

Write to privacy@easyalap.com.