Privacy Policy

Onnomatra provides store-building, hosting, commerce management and connected messaging services. This policy explains the personal information we receive, why we use it, who receives it, how long we keep it and how to make a request about it. Our Contact page provides the business address and other contact details.

Onnomatra handles its own account, billing, security and support activities. Merchants decide how they use customer information for their stores and instruct the processing needed to operate those stores. They must provide their own privacy notices and obtain required permissions. You may contact us directly about information held by Onnomatra even if you do not have an account.

We receive account and business names, email addresses, phone numbers, team details, store content, products, orders, customer contact and delivery details, payment references and status, support messages and information you submit to Builder AI. Connected services provide the data described below.

We also process session identifiers, IP addresses and operational or security logs needed to run and protect the service. Information comes from you, your authorized team, customers interacting with a store and providers connected by an authorized merchant. Provide only information relevant to the feature you use.

We use information to create and secure accounts, operate stores and inboxes, process payments, fulfil requested features, respond to support and data requests, investigate abuse and maintain necessary transaction records. We limit use to these stated purposes and another use permitted by applicable law.

Processing is based on the permissions or consent required for the relevant feature, performance of the requested service or contract, and applicable legal obligations or other lawful grounds. Where we rely on consent, it must be specific and voluntary; you can request its withdrawal using the process below. Accepting general website terms does not by itself authorize every unrelated use of personal data.

Newsletter subscription is optional and requires email confirmation. You can unsubscribe using the link in a newsletter. Necessary account, security and payment communications are separate from marketing emails.

When an authorized merchant connects a supported Meta channel, we process the selected Page or business messaging identifiers and names, granted permissions and access credentials. Depending on the channel and permissions, we receive customer identifiers, display names, profile images, phone numbers, message text, media information, timestamps and delivery or read events. A merchant may add contact details to a conversation.

We use these details to operate the authorized inbox, receive and display conversations, send merchant replies, show message status and support order enquiries. Connecting a Page does not give us unrestricted access to a personal Facebook inbox. Authentication takes place with Meta; Onnomatra does not ask for or store your Facebook, Instagram or WhatsApp login password.

Instagram connections use the authorized professional account ID, username and profile information, conversation participant identifiers, direct messages and supported attachments, including images and audio, to show and reply to customer conversations. We access only the data allowed by the permissions you grant; connecting an account does not authorize unrelated publishing or advertising.

WhatsApp connections use the authorized Business Portfolio, WhatsApp Business Account and phone-number identifiers, business display information and granted access, together with customer phone numbers, messages, supported attachments and message-status events. We use them to identify the selected business number, verify its authorized connection and route incoming messages and merchant replies. The merchant keeps ownership of its account and manages any Meta usage charges through its own billing arrangement; Onnomatra does not need the merchant's payment-card details to operate the inbox.

Message media may load from provider-hosted URLs. Availability depends on the provider and those URLs may expire; we do not promise indefinite recovery of an attachment. Meta message content and access credentials are not used to build advertising profiles.

When you use Builder AI, your prompt, conversation and relevant page, template and media context are sent to the selected AI service to answer your request or edit the page. Include only information you are authorized to share and review generated content before publishing.

Merchants may enable Google Tag Manager, Meta Pixel, TikTok Pixel or related advertising and analytics tools. Those tools can receive shopping events and relevant customer or browser identifiers. The merchant is responsible for the notices and consent required before tracking. A messaging connection is separate from enabling advertising or analytics.

Authorized members of the relevant store can access information according to their permissions. We use infrastructure providers, including Cloudflare for hosting and database services, to operate Onnomatra. Meta receives messages and connection requests when its integrations are used. The selected AI service receives the context described above.

Platform subscription payments are processed through PayStation. Merchant storefronts may also use bKash where configured. Payment references, amounts, status and necessary customer or billing details are exchanged to match payments to the right account or order. Email and SMS providers process the addresses or numbers needed for verification and service messages. Connected courier and other services receive the information needed for the features a merchant enables.

We do not sell personal information. We may disclose relevant records to comply with a binding legal obligation, protect lawful rights or investigate misuse, subject to applicable law. Another provider’s independent handling of information is also governed by its own notice.

We encrypt stored messaging connection credentials and restrict access according to store permissions and operational responsibilities. No online service can guarantee absolute security. Do not send payment PINs, OTPs, passwords or access tokens to support.

Infrastructure and connected providers may process information outside Bangladesh. Such processing is subject to the permissions, lawful grounds, safeguards and transfer restrictions that apply to the information. This policy is not a blanket consent to unrestricted international transfers. Contact us for information about the providers involved in your request.

We investigate reported security incidents and take appropriate protective action. We notify affected people or competent authorities where required by applicable law.

Our scheduled cleanup removes chat messages and completed message-processing records older than 30 days. Cleanup runs periodically and in batches, so eligible records may remain longer while a backlog is cleared. Records needed to finish processing or retry a message remain until processing is complete. Contact profiles, channel connections and order records are kept separately.

Store-library images uploaded or last replaced more than 1 year ago are eligible for daily cleanup when no saved product, page, shared layout, template or other saved record references them. Draft references also count. Images still in use are retained. Cleanup removes eligible images from the library and storage in batches. Videos, other file types, system assets and personal support-ticket attachments are outside this image-cleanup rule.

Using Remove account in Chat integrations deletes that connection, its stored access credentials and linked conversation, message and messaging identity records from Onnomatra. Separately saved store customer and order records are not deleted by removing a channel. Revoking access through Meta stops future authorized access but does not itself delete records already held by Onnomatra; request deletion using the process below. We keep other information only as needed for the stated service purposes, legal recordkeeping, security or resolving a dispute, and remove or anonymize it when no longer needed, subject to applicable law.

For Meta data, verified correction and deletion requests are handled promptly. We also remove that data when it is no longer needed for a permitted purpose, when the relevant account or service ends, or when Meta requires removal, unless applicable law requires retention. A legal preservation requirement can override routine cleanup for the affected records.

You may ask for access to your information, correction of inaccurate details, deletion, withdrawal of consent or another right available under applicable law. Email support@onnomatra.com. You do not need to sign in or hold an Onnomatra account to request help about your own data.

For deletion, use the subject “Onnomatra data deletion request”. Include your account email or store name or URL, the connected Facebook Page, Instagram account or WhatsApp business name where relevant, and what you want removed. For a conversation, include the channel and approximate date. You may request removal of a conversation, contact record or account data.

We may ask for proportionate information to confirm your identity or authority. Do not send passwords, access tokens, payment PINs or unnecessary identity documents. A customer can ask the merchant to help identify the relevant records.

Support reviews the request, confirms the outcome or explains what information is still needed, and follows applicable legal deadlines. If a lawful retention requirement prevents deletion of particular records, we explain the reason and available next steps. Withdrawing consent can affect features that need that information; it does not undo earlier lawful processing or remove another valid retention obligation.

Deleting information from Onnomatra does not erase copies independently held by Meta, a conversation participant or another provider. Disconnect or revoke a provider connection to stop future access, and make a separate request for retained Onnomatra records.

Onnomatra merchant accounts are intended for adults aged 18 or over. Merchants must consider any guardian permission or other safeguards required when their activities involve children’s information. Do not upload sensitive information or identity documents unless it is necessary for an authorized feature and you have a lawful basis.

If you believe a child’s or another person’s information has been collected without required authority, contact support so we can investigate and handle the appropriate correction or deletion request.

Onnomatra uses the auth_session cookie to recognize a signed-in account as you move between pages. A separate support session may be used for authorized support access. Signing out clears the relevant sign-in session. Blocking necessary session cookies prevents signed-in features from working.

These uses support the account or service you request. This policy does not treat continued browsing as consent to every optional analytics or advertising tool.

Browser storage can remember interface preferences, Builder tour completion, preview state and storefront shopping information. Local storage can remain until cleared; session storage is tied to a browser tab session. A session cookie’s expiry is managed by the authentication service.

Browser settings are separate from information saved to your Onnomatra account. Clearing cookies or site storage may sign you out or reset preferences, but does not delete account, order or customer records.

A merchant can enable Google Tag Manager, Meta Pixel or TikTok Pixel on its storefront. These tools may receive page views, shopping events and customer or browser identifiers and may set their own cookies. A Tag Manager configuration may load additional services.

Merchants are responsible for explaining their chosen tools and obtaining any required consent before optional tracking. Connecting a Facebook Page to the inbox does not itself enable advertising tracking. Check the store’s privacy notice and contact its merchant about the tools used there.

Payment pages, social sign-in and embedded third-party content may use cookies or similar technology under the provider’s own policy. Their operation depends on the service you open or enable. Onnomatra does not control cookies set on an independent provider’s website.

Use your browser settings to inspect, block or delete cookies and site storage. Blocking third-party cookies can affect embedded content or external sign-in. Where a store provides tracking choices, you can use those controls to manage optional tools.

If processing relies on your consent, you can also request withdrawal through the relevant merchant or Onnomatra support. Browser controls do not erase information already received by a provider. Use the data-request process in section 9 for information held by Onnomatra.

Contact support about a privacy concern or an unresolved data request. You may also seek a remedy from a competent authority or court under applicable Bangladesh law. This policy does not restrict a statutory complaint right.

We publish revisions with an updated date and communicate material changes through the website or relevant account channels. Where a new use requires fresh consent, a policy update alone does not replace that consent.