Privacy Policy

What we collect

When you place an order, we collect your name, phone number, delivery address, district and thana, any note you add to the order, and your email address if you give one. Our server also records your IP address and browser type with the order, and the two Meta cookies described below when your browser has them. If you press Place Order and the order does not go through (for example because the district is missing), we keep what you had typed into the form, the items in your cart, your browser type and the ad tag for 30 days, so that we can call you about your order; the record is marked as done once you place the order. If you write to us through the contact form or subscribe to our newsletter, we keep what you send us (your name, email address, phone number and message) together with your browser type and a scrambled form of your IP address. Like most websites, our server also writes a technical log of every request it receives, including form submissions: the time, the page or form address, the page you came from, your IP address and your browser. We use it to find faults and stop abuse.

How we use it

We use your information to process and deliver your orders, respond to enquiries, and send you updates you have requested. We do not sell or rent your personal data to third parties. To fulfil an order we pass the details that are needed to the courier that delivers your parcel and to bKash when you pay online. A notification service (ntfy.sh) alerts us to each new order, contact message and newsletter sign-up, and to an order that did not go through when a phone number was typed (at most once a day for the same number), and receives its details (for a sign-up, your email address). Limited information is shared with Meta and Google to measure and show our advertising — see "Cookies and analytics" and "Advertising and conversion measurement" below.

Cookies and analytics

Your shopping cart is stored in your own browser (local storage), and a session cookie is used only when you sign in to the admin area. While you fill in the checkout form, what you type is also kept in your browser for that tab only (session storage), so that it is still there if you come back from bKash without paying; it is deleted when your order is placed or the tab is closed. We run our own visitor counter: it gives your browser a random ID in a cookie (raya_vid, kept for one year) and records the pages viewed, whether the Buy Now, Add to Cart and Place Order buttons were shown or pressed, the device type, the referring site, and which of our ads or links brought you here (an anonymous tag in the link, such as the ad's name). The ID is not linked to your name or your orders; the ad tag is also saved with an order placed in the same visit, so that we can see which ads lead to orders.

We also use Google Analytics 4, which sets cookies (_ga, _ga_*) to recognise returning browsers and records the pages you view and the products you look at, add to your cart, and buy, together with order totals. Google Analytics does not receive your name, phone number, email or address. Google explains what it does with this information in How Google uses information from sites or apps that use our services.

If your browser sends the Do-Not-Track signal, neither our counter nor Google Analytics is loaded. You can also block Google Analytics with a browser add-on such as Google's opt-out extension.

Advertising and conversion measurement

We advertise on Facebook and Instagram. To measure those ads, and to show our ads to people who have visited this site, we use two tools from Meta Platforms (the company behind Facebook and Instagram): the Meta Pixel, a small script from Meta that runs in your browser, and the Conversions API, through which our own server reports the same events to Meta.

What Meta receives: the pages you visit on this site, the products you view, add to your cart and start to check out, and the orders you place (the products and the order value). With these come your IP address, your browser type, the address of the page, and two cookies: _fbp, which the Pixel sets to recognise your browser, and _fbc, which holds the ad click ID if you arrived from a Meta ad (kept for 90 days). When you place an order, our server also sends your name, email and phone number, each turned into a one-way SHA-256 fingerprint first: Meta can match the order to an account, but it does not receive the raw values. We do not send Meta your delivery address. Meta may combine what it receives with other information it holds, and it uses it to measure advertising and to choose which ads to show.

Your choices: if your browser sends the Do-Not-Track signal, we do not load the Meta Pixel and do not report your browsing to Meta; an order you place is still reported as described above. An ad blocker that blocks Facebook tracking stops the Pixel. You can control how Meta uses this information for advertising in your ad preferences at facebook.com/adpreferences, and you can opt out of interest-based advertising from many companies at aboutads.info/choices and youronlinechoices.eu. Meta and Google process this information on their own servers outside Bangladesh.

How we protect it

Your data is stored securely and accessed only by authorised personnel involved in fulfilling your order. We use industry-standard security measures including encrypted connections (HTTPS) to protect data in transit.

Your rights

You may request to view, correct, or delete any personal data we hold about you at any time by contacting us directly. We will respond to all reasonable requests within a reasonable timeframe.

Contact

For any privacy-related questions, please contact us at rayafragrance4000bc@gmail.com or visit our contact page.