Privacy, confidentiality & lawful disclosure

Last updated: 23 September 2026

In short: We keep your information private and use it only to operate, secure, and improve DropShop. We do not sell personal data. We share data only with necessary service providers or when required by valid legal process, and we limit disclosure to what is necessary.

1. Data we collect

• Seller account: name, email, and the identity returned by Google or Apple if you use social sign-in.
• Verification (KYC): legal name, mobile number, NID or passport number, a short address, optional date of birth and business name, one ID photo, a live selfie and any optional documents you upload. We run automated format, consistency and duplicate-ID checks on this data inside DropShop; identity data is not sent to analytics or automation tools, which receive only a store id and non-identifying check outcomes. Payout approval involves a person.
• Payout details: the bank or wallet account you save for payouts.
• Store data: shop name, slug, products, pricing, orders and customers you create.
• Shopper data: name, phone, delivery address and payment method submitted at storefront checkout.
• Technical and security: log, diagnostic, usage-analytics and security data needed to operate and protect the service.

2. How we use it

To operate your store, render your storefront, process orders and payments, book deliveries, verify identity for payouts, prevent fraud and abuse, keep the platform secure, provide support, and improve DropShop. We do not sell customer or seller personal data.

3. Confidentiality and internal access

We do not disclose personal, KYC, payout, order, security or account information unnecessarily. Inside DropShop, access follows least privilege and need-to-know: only people working on support, fraud and risk, compliance, security, finance or operations can access what their task requires. Store data is isolated so one seller cannot read another's records, and privileged operations run on our servers only.

4. Service providers

We share data with service providers only where needed to run DropShop, and only the minimum necessary. Depending on what you use, this can include:

• payment processors and gateways, banks and mobile wallets;
• courier and fulfilment partners, and suppliers for products you import;
• identity-verification support, where used;
• hosting, database and infrastructure providers;
• email, messaging and customer-support tools;
• analytics, fraud-prevention and security services;
• tax, accounting and legal advisers.

Where our contracts allow, we require these providers to keep data confidential and protect it appropriately.

5. Government, law-enforcement and legal requests

• We do not disclose data just because someone says they are an authority. We check the identity of the requester, the jurisdiction and the request itself, and require valid legal process where the law calls for it.
• We disclose only the minimum data legally required, and may challenge or narrow requests that are unclear or too broad.
• We keep an internal record of each request: who asked, who reviewed it, the legal basis, the scope, the date and what was disclosed.
• We tell the affected user when the law allows it and doing so would not compromise an investigation or someone's safety.

Send legal requests to legal@dropshop.bd.

6. Emergency disclosure

We may disclose information without prior legal process where reasonably necessary to prevent serious harm, fraud or a security incident, or to comply with law. When we do, we limit the data to what is needed and record the reason.

7. Other permitted disclosure

• With your consent.
• To enforce our agreements and protect the rights, property or safety of DropShop, our users or others.
• To investigate abuse or fraud, and to respond to disputes and chargebacks.
• As part of a lawful merger, acquisition or similar transaction, subject to confidentiality and applicable law.

8. What we never publish

We never make public KYC documents, bank or wallet details, payout credentials, login or session data, system secrets, or private customer and order data. Public storefronts show only the product and store information sellers choose to publish.

9. Security

We use reasonable technical and organisational safeguards, including access controls, server-side handling of credentials, verification of incoming webhooks, and validated, rate-limited public order intake. No online service can guarantee absolute security; if we become aware of an incident affecting your data, we will act to contain it and notify you where required.

10. Retention

We keep personal, KYC, transaction and security records only as long as needed to provide the service, prevent fraud, handle disputes and chargebacks, meet tax and accounting requirements, and satisfy legal, compliance and security obligations. After that we delete or anonymise them where applicable.

11. Your rights

You can access, correct, export or request deletion of your data by contacting us, subject to the retention needs above. Shopper data requests should be raised with the seller whose storefront collected it.

12. Contact

privacy@dropshop.bd · legal requests: legal@dropshop.bd