Privacy Policy

Effective and last updated: 13 August 2026

This Privacy Policy explains how Zap (also referred to as “we”, “us”, or “our”) handles personal information when you visit our storefront, create or use a customer account, place an order, join a subscription, contact us, subscribe to marketing, or otherwise use our services. It also explains the choices and controls available to you.

1. Information we collect

We collect information you provide directly, information generated when you use the service, and limited information received from service providers.

• Account and identity information: name, email address, phone number, password authentication records, profile picture, email-verification state, notification preferences, and account-security information.
• Order and delivery information: products, quantities, prices, coupons, delivery name, phone number, address, city, postal code, shipping selection, order history, refunds, and customer-service notes.
• Payment information: payment method, transaction or reference identifiers, payment status, and evidence you submit for manual payments. Payment providers process payment credentials; Zap does not receive or store your complete card, mobile-wallet password, PIN, or one-time password.
• Shopping activity: cart contents, wishlist items, subscriptions, product reviews, review photos, product questions, and interactions needed to operate these features.
• Communications: messages sent through contact, wholesale, investment, newsletter, review, and support forms, together with our responses and delivery status for service emails.
• Technical and security information: session identifiers, IP address, browser or device user-agent, request timing, authentication and audit events, and records used for fraud prevention, rate limiting, troubleshooting, and service security.

2. How we use information

• Create and secure customer accounts, verify email addresses, maintain sessions, and provide account features.
• Operate carts, wishlists, checkout, payments, delivery, subscriptions, returns, refunds, invoices, order tracking, and customer support.
• Send transactional messages such as verification, order, payment, delivery, refund, account-security, and account-deletion notices.
• Send newsletters or promotional communications when requested, and record unsubscribe choices.
• Publish approved reviews, review photos, and product questions with the display name associated with the contribution.
• Prevent duplicate transactions, abuse, fraud, unauthorized access, and other security incidents; maintain audit and reconciliation records.
• Measure service reliability, diagnose errors, improve features, and comply with legal, accounting, tax, dispute, and enforcement obligations.

3. Why we process information

Depending on the context and applicable law, we process information to perform a contract with you or take requested steps before a contract, comply with legal obligations, pursue legitimate interests such as operating and securing the service, and act on your consent where consent is required. You may withdraw consent for future processing at any time, but this does not affect processing already completed or processing supported by another lawful basis.

4. How we share information

We do not sell personal information. We disclose only what is reasonably necessary to operate the service, complete your requests, protect users and Zap, or comply with law.

• Payment providers, including bKash and SSLCommerz when you select an enabled gateway, to initialize, validate, reconcile, or refund a transaction.
• Delivery and fulfillment providers that need recipient, contact, address, and order details to deliver purchases.
• Email, hosting, storage, security, and infrastructure providers that process information on our behalf to run the service.
• Professional advisers, authorities, or other parties where reasonably necessary to comply with law, enforce agreements, resolve disputes, or protect rights, safety, property, and service integrity.
• A successor organization in connection with a merger, financing, reorganization, sale, or transfer, subject to appropriate confidentiality and legal safeguards.

5. Cookies and local storage

Zap uses cookies and browser storage that are necessary to keep you signed in, secure sessions, remember a guest cart, preserve guest-order access, synchronize cart and authentication changes between tabs, and maintain core storefront functionality. Blocking these technologies may prevent account, cart, checkout, or order-tracking features from working correctly. If optional analytics or advertising technologies are introduced, this policy and any required consent controls will be updated before they are used.

6. Retention and account deletion

We keep personal information only for as long as reasonably necessary for the purposes described above, including fulfillment, support, security, fraud prevention, accounting, tax, dispute resolution, and legal compliance. Retention periods vary by record type and obligation. Message bodies and security records may be removed or minimized on shorter operational schedules.

Customers can request account deletion from Account Settings. The request has a 30-day cancellation period, immediately revokes other sessions, and may be deferred while an active order is being fulfilled. When finalized, account credentials, addresses, cart, wishlist, avatar, and notification preferences are removed or disconnected. Order records and limited audit, transaction, or legal records may be retained or de-identified where needed for contractual, financial, fraud-prevention, dispute, or legal obligations.

7. Your choices and rights

• Review and update your name, phone number, email, profile picture, addresses, password, and notification preferences in your account.
• Unsubscribe from marketing through the link in a marketing email or the relevant account control. Service and security messages may still be sent when necessary.
• Delete wishlist items, addresses, reviews, review photos, and other supported content using the relevant account controls.
• Request account deletion from Account Settings and cancel a pending request during the 30-day cancellation period.
• Ask to access, correct, delete, restrict, or object to our use of personal information, or request a portable copy, where applicable law provides that right. We may need to verify your identity and may retain information where an exception applies.

8. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including authenticated access, role-based administration, session controls, security logging, validation, rate limiting, signed access tokens, and payment verification. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Use a unique password and contact us promptly if you believe your account has been compromised.

9. International processing

Some service providers may process information outside Bangladesh. Where required, we use appropriate contractual or other safeguards intended to protect information when it is transferred across borders.

10. Children

The service is not directed to children under 18, and we do not knowingly collect personal information directly from children without appropriate authorization. If you believe a child has provided personal information, contact us so we can review and take appropriate action.

11. Changes to this policy

We may update this policy as our services, providers, or legal obligations change. The current version will be published on this page with a revised effective date. Where a change is material, we will provide additional notice when required.

12. Contact us

For privacy questions or requests, use our Contact page. Describe the request and the account or order it concerns, but do not send passwords, one-time codes, or complete payment credentials. We may ask for information needed to verify your identity before acting on a request.