Privacy Policy

Two forms, two places for data

Plugin — if you install it on your own WordPress site, customer names, phones, addresses and orders all stay in your own hosting's database, just as they would in WooCommerce. We do not read it, we do not copy it, and it is not stored on our servers. The app talks directly to your site.

AI in the plugin — the one exception, and only for what is given to be read: when someone on the order desk presses "Fill with AI", the pasted message and the names and prices of your products it may match, and an address whose postcode the plugin could not work out itself, go through our server to OpenAI to be read. Our server keeps only a count of how many times it read, not the message or the address. It can be switched off in the plugin under Nishchit → Features.

Nishchit SaaS — if you open a shop on nishchitbd.com, it is the other way round: all order data is kept on our servers. Customer names, mobile numbers, addresses, what they bought, how much, whether it went to courier — all of it. The rest of this page is about this form.

Your customers' data on SaaS

The details you enter on orders — name, mobile, address, products, amount — are kept in our server database, with your shop's ID on every row. One shop cannot see another shop's data.

We don't sell this data, we don't give it to advertisers, and we don't use it for anything else. We don't open your orders unless you ask us to in support.

You can download all your shop's data at any time, and if you ask us to close the shop, the data is deleted too.

To your customers, you are the one responsible — telling them how their data will be used is your job. We only store and process it on your behalf.

Pooling courier records across shops — only if you want it

The SaaS has one optional feature: seeing, in one place, what all Nishchit shops together know about a mobile number. It is off by default — unless you turn it on yourself in settings, nothing of yours is shared, and you see nothing either.

If you turn it on, this is what is shared: how many times that number took a delivery, how many times it returned one, how many times an order was cancelled — just these three numbers. No name, no address, no order number, no amount — and nobody can see which shop it came from.

Even the number isn't stored as is. A secret key on the server turns it into something the real number can't be recovered from — the key isn't in the database, so even if the database is stolen, the numbers can't be pulled out.

A number's totals aren't shown to anyone until at least three shops have contributed something about it — otherwise you could work out who shared what.

If you turn it off, what you shared is deleted, not just stopped from growing.

The blacklist is never shared. Which customers you turned away is your opinion, not a delivery record.

What this website collects

What you type in the order form: name, WhatsApp number, email and the domain the licence will run on. We need these to create the licence, send you the key and give support.

At payment, card or bKash details go straight to SSLCommerz. We never see or store card numbers.

Ordinary server logs — which page was opened when. They don't identify anyone.

Cookies and ad measurement

This website has a Meta (Facebook) measurement code on it — to see how many people view each page, and whether someone who came from an ad ended up taking a trial or buying. This is only about this website; it has nothing to do with your shop's order data — that stays on your own server with the plugin, and in your shop's own space on our server with the hosted service.

This puts cookies in your browser. If you turn cookies off in your browser settings, the site works just the same — we just can't count.

Besides the browser, our server also tells Meta when a trial is requested or a payment is completed. That's because during payment you leave for another site and come back — the browser's record gets lost on the way, the server's doesn't.

What is sent: your name, phone number and email — all three only in hashed form, one-way, impossible to read back. Also sent are your IP address and browser identity, which can't be hashed, and which plan was bought for how much.

What is not sent: your own shop's domain name is never sent to Meta. That identifies your business, and ad measurement has no need for it. Licence keys, passwords and payment details aren't sent either.

You can turn this matching off yourself in Facebook's Ad Preferences.

What goes in push notifications

The app's new-order notification carries only the order number and the amount — not the customer's name, phone or address. That's deliberate, because notifications show on the lock screen.

Facebook Pages and Messenger (Nishchit SaaS chat)

If a shop connects its Facebook Page to Nishchit, we receive from Meta, for that Page only: the Page's id and name and a Page access token; the id Facebook gives this app for the person who connected it; the Messenger conversations people have with that Page (the messages, pictures and files they send, and the shop's replies); and, for each person who writes, their name and profile picture as Facebook provides them.

We use this only to show those conversations to that shop's own logged-in staff, to send the replies they type, and to let them turn a conversation into an order. We do not sell it, do not use it for advertising, do not show it to other shops, and never send a message nobody typed.

These stay on our own server. The conversations are the shop's record and delete themselves after the time the shop sets (by default 90 days). When a shop disconnects its page we stop receiving that page's messages and delete the page token.

If the person who connected a Page removes Nishchit in their Facebook settings (Business integrations, or Apps and websites), Meta tells us, and every Page they connected is disconnected and its token deleted.

If you want your Messenger conversation with a shop deleted, ask that shop, or write to anik@flowsleek.com and we will delete it.

WhatsApp Business (Nishchit Cloud chat)

If a shop connects its WhatsApp Business number to Nishchit, we receive from Meta, for that number only: the WhatsApp Business Account id, the phone number id and an access token; and the WhatsApp conversations people have with that number (the messages, pictures and files they send and the shop's replies), together with each sender's WhatsApp phone number and the profile name WhatsApp provides.

এগুলো আমরা শুধু সেই দোকানের নিজের লগইন-করা স্টাফকে কথোপকথন দেখাতে, তাঁদের লেখা উত্তর পাঠাতে (হোয়াটসঅ্যাপের ২৪ ঘণ্টার সীমার মধ্যে) আর কথোপকথন থেকে অর্ডার বানাতে ব্যবহার করি। বিক্রি করি না, বিজ্ঞাপনে ব্যবহার করি না, অন্য দোকানকে দেখাই না, আর কেউ না লিখলে কোনো মেসেজ পাঠাই না।

It is stored on our own server and kept while the shop uses Nishchit. When the shop disconnects the number, we stop receiving its messages and delete its access token. A shop can delete a conversation at any time.

If you want your WhatsApp conversations with a shop removed, ask that shop, or write to anik@flowsleek.com — we will delete them.

Third parties

SSLCommerz — takes payments.

Couriers (Steadfast and, later, others) — the details you yourself send to book a parcel.

SMS gateway — the number and text of each SMS you send.

Google Firebase — to deliver push notifications.

OpenAI — to read a customer’s message that a shop’s staff paste into a new order and fill in the form (name, phone, address, products), in hosted shops and in the plugin alike; and, in the plugin, to read the postcode of an address its rules cannot place. OpenAI does not keep the message or the address, or train on them; a shop can turn this off in its settings (in the plugin, under Features).

Meta (Facebook) — to measure this website's ads. See "Cookies and ad measurement" above.

Meta (Facebook Messenger) — when a shop connects its own Page, to bring in its conversations and send replies. See "Facebook Pages and Messenger" above.

Meta (WhatsApp Business Platform) — when a shop connects its own WhatsApp number, to bring its conversations in and send replies. See "WhatsApp Business" above.

How long it is kept

Licence and payment records are kept for accounting. You can ask for support conversations to be deleted once the matter is closed.

To delete your account and its data, just tell us on WhatsApp or by email.

Contact

Any questions: WhatsApp +8801977141107 or anik@hostthewebsite.com.