Privacy Policy

HishabKhata is a product of 2HAAS ("2HAAS", "we", "us"), an order-intelligence service for ecommerce sellers. All data collected through HishabKhata is stored and processed by 2HAAS. This policy explains what personal data we collect, why, and the choices you have.

1. Data we collect

• Account data: name, email, phone, company/store name and password (stored hashed).
• Store data you connect: orders, products and customer details (names, phone numbers, addresses) imported from your WooCommerce store, and delivery/COD status from courier services such as Steadfast, Pathao, RedX and Sundarban. For your customers' data, you decide why it is used and 2HAAS processes it on your behalf to provide the service; for your own account and marketing data, 2HAAS is the controller.
• Integration credentials: API keys and tokens you supply so we can sync your store and couriers.
• Payment data: plan, amount, method, transaction ID and sender number for subscription payments (bKash, Nagad, bank transfer). We do not store card numbers.
• Marketing & usage data: the page you arrived from, campaign tags (UTM parameters), ad click identifiers, pages viewed, device/browser information and IP address. See our Cookie Policy.

2. How we use it

• To provide, secure and support the service (sync orders, track deliveries, compute customer insights).
• To process payments and manage your subscription.
• To understand which marketing channels bring customers, so we can spend advertising budget effectively. This includes reporting a completed purchase (hashed email/phone, plan and amount) back to Google and Meta so they can measure and optimise our ads.
• To communicate with you about your account, billing and service changes.

3. Who we share it with

2HAAS does not sell personal data. We share it only with:

• Infrastructure providers that 2HAAS uses to host and deliver the service (hosting, database, email/SMS delivery). They act only on our instructions.
• Courier and store platforms you connect, as needed to perform the integration.
• Analytics and advertising providers - Google (Analytics), Meta (Pixel / Conversions API) and TikTok (Pixel) - where you have not declined cookies, and for server-side purchase reporting as described above.
• Authorities, where legally required.

Some of these providers process data outside Bangladesh.

4. Retention

We keep your data while your account is active. If you delete your account, it is scheduled for permanent deletion after a 40-day grace period in which you can cancel. We keep limited records (such as a marker that a trial was used, and payment records) where needed to prevent abuse and meet legal and accounting duties.

5. Your rights

You may request access to, correction of, or deletion of your personal data, object to marketing use, or withdraw cookie consent at any time (use "Cookie settings" in the site footer). Where the GDPR or UK GDPR applies to you, you also have the right to portability and to complain to your data-protection authority. Email [email protected] to exercise these rights.

6. Security

We use access controls, encrypted connections (HTTPS) and hashed passwords. No system is perfectly secure; please use a strong, unique password and keep your API keys private.

7. Children

The service is for businesses and is not directed at anyone under 18.

8. Changes

We may update this policy; the date above shows the latest version. Material changes will be notified by email or in the app.

9. Contact

2HAAS - [email protected]