Privacy policy

Sells Pilot is software a shop uses to answer its customers on Messenger, Instagram and WhatsApp, to keep a catalogue and to take orders. This page says what we hold, why we hold it, who else sees it and how to have it removed. It covers two different people: the merchant who opens an account, and the customer who messages a shop using Sells Pilot.

Whose data it is

A shop's messages, orders and customers belong to that shop. For that data the merchant decides what is collected and what it is used for, and we hold and process it on their instructions — so a customer asking why a shop kept their address is asking the shop, and we will help the shop answer. For a merchant's own account with us — their name, email, plan and payments — the decisions are ours, and this policy is the answer.

What we hold about a merchant

What is needed to run the account and to bill it:

• Name, email address and password, or the Facebook account id if they signed in with Facebook instead of setting a password.
• The Facebook Page, Instagram account or WhatsApp number they connected, and the access token Meta issued for it. Tokens are encrypted at rest, are never written to a log and never travel in a web address.
• Top-ups, plan, balance and the reference the payment gateway returned. We never see or store a card number, a bKash PIN or an OTP: the payment happens on the gateway's own page.
• How much the account has sent and what it cost, which is what a bill is worked out from.
• Where the account came from: the campaign tags on the link that first brought you to our site, and the website you followed it from, kept in your sign-in session until you register and then stored with the account.

What we hold about a customer who messages a shop

Only what a conversation and an order need:

• The messages themselves, in both directions, including photographs and voice notes sent to the shop.
• The page-scoped or account-scoped identifier Meta gives us for that person, and their public profile name and picture where Meta hands them over — which, for most people's privacy settings, it does not.
• What was ordered, and the name, phone number and delivery address given for it.

We do not buy contact lists, we do not take a customer's data from anywhere except the conversation they started, and a customer is never moved from one shop to another.

Why we hold it

For the reasons the shop needs it and no others:

• To answer, and to make sense to whoever picks the conversation up next — a shop reading a thread three days later needs the first half of it.
• To take, price, pack and deliver an order, and to answer "where is my order" later.
• To run and bill the account, to keep it secure, and to work out what went wrong when something did.
• For a shop that connects its Meta pixel, to tell Meta about its sales and shop-front visits so the shop can measure its own ads, as described under Cookies.
• To keep the sales records a business is required to keep.

The assistant, and what is sent to it

Draft replies are written by a large language model, which means a customer's message, the recent conversation and the catalogue lines it needs are sent to an AI provider outside Bangladesh to be answered. What is sent is the conversation and the catalogue — never a password, never an access token, never payment details.

We use these providers under business terms that do not permit them to train models on what we send. Every draft is checked against the database before it goes out, and a merchant who would rather answer every message themselves can switch the assistant off and keep everything else.

Who else sees it

Nobody who does not need to. Data is never sold, never rented, and never shared between two shops using Sells Pilot. It is shared with:

• The shop you messaged, and the staff that shop has given access to.
• Meta, because Messenger, Instagram and WhatsApp are Meta's and a reply is delivered by them; and, for a shop that connects its Meta pixel, the confirmed orders described under Cookies, with the buyer's phone, name, district, country and an id of ours for them hashed, and what a shop-front visitor looks at as it happens.
• The AI providers described above, for the messages the assistant answers.
• The payment gateway a merchant tops up through — bKash, Nagad or SSLCommerz — for that payment.
• The courier a merchant books a parcel with, which is told the name, phone number and address on that parcel and nothing else.
• The companies that host and deliver the software, under contracts that bind them to the same terms.
• Our own staff, when they are supporting a merchant or fixing a fault, and only as far as that takes them.
• A lawful authority making a lawful demand. We will tell the merchant it happened unless we are forbidden to.

How long we keep it

Conversations, orders and the catalogue are kept while the account is open, because a shop's trading history is the shop's own record and a business is required to keep it. Close an account and we delete or anonymise what is in it within 90 days, except what we are required to keep for tax and accounting, which is kept for the period the law names and used for nothing else. Backups age out on their own schedule and are overwritten within 30 days.

What you can ask for

A copy of what we hold about you, a correction of anything wrong, or deletion. A merchant can export their own orders and catalogue from the dashboard at any time and does not have to ask. A customer of a shop should ask the shop first, because it is their record — write to us and we will pass it on and see that it is answered. Either way, write to the address at the bottom of this page and we will answer within 30 days.

Deleting your data

Remove Sells Pilot from your Facebook settings and we delete what Facebook told us about you, and give you a confirmation code and a page that says when it finished. You can also write to us. The full instructions, and a plain account of what is deleted and what stays behind, are on the data deletion page: How to delete your data.

Cookies

We set a cookie to keep you signed in, one to stop forged requests, one to remember whether you are reading in English or Bangla, and — for a customer buying from a shop front — one to remember what is in the basket. A shop front also uses that cookie to count its visits: a number per day, with the kind of link that brought each visit, and nothing about who the visitor was. A browser that refuses the cookie is recognised for half an hour by a one-way code made from its connection and browser, so it is not counted again on every page; the code cannot be turned back into either, changes every day, and is kept nowhere else. Our own marketing and legal pages also carry Google Analytics, which counts visits and tells us which pages people arrive on, a Meta pixel, which tells Facebook a visit happened so we can measure our own advertising and show it to people like you, and Trustpilot's script, which lets us invite customers to review us on Trustpilot. Each can set cookies of its own, and all three run on those pages alone. A merchant's shop front is different, and the merchant decides: a shop that connects its own Meta pixel has its confirmed orders reported to Meta from our server through the Conversions API, so the shop can measure its own ads. A report says what was bought and for how much, with your phone number, first and last name, district and country, and an id of ours for you, each hashed before it leaves us; for an order from a chat, the id Messenger, Instagram or WhatsApp gives your conversation with the shop and any ad click id; and for an order from the shop front, the IP address, browser and Meta cookies it was placed with. On such a shop's shop front, the products you open, add to the basket and take to checkout are also reported from our server as you do it, with your IP address, browser and Meta cookies, whether or not you go on to order, and even when the merchant has left Meta's pixel off. Only if the merchant turns it on does the shop front also load Meta's pixel in your browser. None of the shop-front reporting — the pixel, what you look at, or the order — happens for a visitor in Europe, the UK or Switzerland, or one whose country we cannot tell. If you are reading this in Europe or the UK we ask before Google Analytics or the Meta pixel runs, and you can change that answer at any time from the banner; Trustpilot's script is not held back by that banner; everywhere else they run as described, because no law there requires us to ask and a banner nobody needs is a banner in the way. Your browser's tracking protection or an ad blocker can turn all of them off wherever you are, and nothing on the site stops working.

How it is held

Everything travels over HTTPS. Access tokens are encrypted in the database, hidden from the application's own output, and never logged. Access to production is limited to the people who need it and is recorded. No system is perfect, so if a breach affects you we will tell you and the regulator promptly rather than quietly.

Children

Sells Pilot is for businesses. It is not directed at children, and we do not knowingly hold data about anyone under 13. Tell us if you believe we do and we will delete it.

Changes to this policy

When this changes we change the date at the top, and where the change matters we tell merchants in the dashboard before it takes effect rather than after.

Contact

Questions about this policy, or a request about your own data, go to: support@sellspilot.com