Privacy Policy

What we collect

• Account data: your name, email address, and a bcrypt hash of your password. We never store plaintext passwords.
• Order data: products ordered, currency, amount, chosen payment method, and any transaction reference you supply.
• Reviews: your rating, review text, and display name at the time of posting.
• Security logs: IP address and timestamp for sign-ins, failed sign-in attempts, and admin actions.

Why we collect it

To authenticate you, verify payments, deliver purchased source code, respond to support requests, and detect fraud or abuse. We do not sell personal data, and we do not run advertising trackers on this store.

Cookies

We set one essential cookie, bb_session, containing a signed JWT that keeps you logged in for 7 days. It is HttpOnly, SameSite=Lax, and Secure in production. No analytics or advertising cookies are set without your consent.

Retention

Account and order records are retained while your account is active and for 6 years afterwards where required for tax and accounting. Security logs are retained for 12 months. Deleted reviews are removed immediately.

Your rights

You can access and correct your profile from My Account, change your password at any time, and request export or deletion of your data by emailing privacy@bengalbytes.com. We respond within 30 days. Deletion requests that conflict with statutory record-keeping are honoured as anonymisation instead.

Processors

We use MongoDB Atlas for database hosting and Vercel for application hosting. Payments are settled directly through bKash, Nagad, Binance, or on-chain transfers — we never receive or store your card or wallet credentials.