Who we are
Aroma Avenue sells fragrances online to customers in Bangladesh. This policy explains how we handle personal information when you visit this website, place an order, create an account or contact us. We are responsible for deciding how that information is used.
[CLIENT TO CONFIRM] The registered business name and address responsible for personal data, and the name or role of the person who handles privacy requests.
What we collect
When you place an order
- your name, mobile number and delivery address (house, road, area, city and district);
- your email address, if you give one — it is optional for guest orders;
- the items you order, the amounts charged, any coupon used and any note you add;
- the date and time you accepted our exchange policy, and a copy of the text you accepted.
When you pay an advance
- the payment channel you used, the transaction ID (TrxID), the last 4 digits of the number or account you paid from, and the amount you tell us you sent;
- a screenshot of the payment, if you choose to send one.
We never ask for, and never store, your wallet PIN, an OTP or card details.
When you create an account
- your email address, name and phone number;
- your password, which is stored only in scrambled (hashed) form by our login provider — no one at Aroma Avenue can see it;
- saved addresses, your wishlist, your order history and any reviews you write.
When you contact us or subscribe
- the name, email address, phone number and message you send through the contact form;
- your email address, if you sign up for our newsletter;
- messages you send us by phone, WhatsApp, email or social media.
When you use the website
- your IP address, which we use to limit repeated attempts at checkout, log-in, coupon checks and order tracking;
- the order number and last 4 phone digits you enter to track an order, which we use only to find that order;
- browser, device and page-visit information collected by Google Analytics and the Meta Pixel, when we have them switched on.
How we use it
- to confirm, pack and deliver your order, and to collect cash on delivery;
- to verify your payment against our own wallet or bank statement;
- to contact you about your order — by phone, SMS, WhatsApp or email — including payment problems and delivery arrangements;
- to prevent fraud, such as the reuse of a transaction ID or repeated fake payment submissions from the same phone number;
- to answer your questions and handle exchanges and refunds;
- to run your account, if you have one, and publish reviews you submit;
- to send our newsletter, only if you have subscribed;
- to understand which pages are useful and improve the website;
- to keep the business and tax records the law requires.
Why we are allowed to use it
We use your information only where we have a clear reason to:
- To carry out our agreement with you — processing and delivering an order is not possible without your name, phone number and address.
- Our legitimate interests — keeping the shop secure, preventing payment fraud and improving our service, in ways you would reasonably expect.
- Your consent — for the newsletter and for analytics and advertising cookies. You can withdraw consent at any time.
- Legal obligations — keeping accounting and tax records, and responding to lawful requests from authorities.
[CLIENT TO CONFIRM] The data protection law that currently applies to the business in Bangladesh, and a legal review of this policy against it before launch.
Who we share it with
We do not sell your personal information. We share it only with the services we need to run the shop:
- Courier partners receive your name, phone number, delivery address and the amount to collect, so they can deliver your parcel.
- Supabase hosts our database and account logins, and sends account emails such as password reset links.
- Vercel hosts the website and processes the requests your browser makes to it.
- Resend delivers our order emails and the messages you send through the contact form.
- Upstash counts repeated attempts for our rate limits. It stores only scrambled (hashed) versions of IP addresses and phone numbers, and each count expires within an hour.
- Google Analytics and Meta receive browsing information when we have analytics or the Meta Pixel switched on.
When you send an advance, the payment is processed by your own wallet provider or bank under their terms. We see only what appears on our statement and what you enter at checkout.
We may also disclose information when the law requires it, or to the relevant payment provider and law enforcement when we have reasonable grounds to suspect fraud.
Some of these services store data on servers outside Bangladesh. We choose providers that protect data with encryption and strict access controls.
[CLIENT TO CONFIRM] The courier partners used (for example Pathao, Steadfast, RedX or Paperfly), and the region where the Supabase database is hosted.
How long we keep it
We keep personal information only for as long as we need it:
- order, payment and delivery records — for as long as tax and accounting law requires;
- account information — until you ask us to delete your account;
- contact form messages — for as long as we need to resolve your question;
- newsletter subscriptions — until you unsubscribe;
- rate-limit counts — up to one hour;
- analytics data — for the retention period set in Google Analytics and Meta.
[CLIENT TO CONFIRM] The exact retention period for each category above: order and payment records (including the number of years required for tax records), closed accounts, contact messages, and the Google Analytics data retention setting.
How we protect it
- The whole website is served over an encrypted (HTTPS) connection.
- Our database refuses any request that is not allowed to see the data it asks for, so a customer can only ever read their own orders and addresses.
- Transaction IDs and payment screenshots are visible only to our staff who verify payments.
- Tracking an order needs both the order number and the last 4 digits of the phone number, and the tracking page shows a partly hidden address.
- Only staff who need personal information to do their job can access it.
Your choices and rights
You can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong or out of date;
- delete your information, except records we must keep by law or to deal with an open order, refund or fraud case;
- stop sending you the newsletter.
If you have an account, you can update your name, phone number and saved addresses yourself from your account. For anything else, contact us using the details below. We may ask you to confirm your identity before acting on a request, so that no one else can obtain your information.
[CLIENT TO CONFIRM] The time within which privacy requests are answered, for example 30 days.
Cookies and browser storage
This website stores a small amount of information in your browser:
| What | Why | How long |
|---|
| Your bag (local storage) | Keeps the items you have added on this device, so they are still there when you come back. | Until you check out, empty the bag or clear your browser data |
| Wishlist and recently viewed (local storage) | Remembers products you saved or looked at on this device. | Until you remove them or clear your browser data |
| Announcement dismissal (cookie) | Remembers that you closed the announcement bar. | 30 days |
| Login session (cookies) | Keeps you signed in to your account. | Until you log out or the session expires |
| Analytics and advertising (cookies) | Set by Google Analytics and the Meta Pixel, when switched on, to measure visits and ads. | Set by Google and Meta, up to two years |
Local storage never leaves your device. You can clear cookies and local storage at any time in your browser settings; the shop will still work, but your bag and wishlist on that device will be emptied.
[CLIENT TO CONFIRM] Whether analytics and advertising cookies are loaded only after a visitor agrees, which would need a consent banner before Google Analytics or the Meta Pixel is switched on.
Children
Our shop is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We will update this policy when the way we handle information changes. The date at the top of this page shows the latest version. If a change significantly affects how we use information you have already given us, we will tell you on this website and, where we have your email address, by email.
Questions about your personal information are welcome. You can reach Aroma Avenue here: